Instruction: Generate a Nuclei template for: Panmicro E-Mobile System - Arbitrary File Read

Input:
Title: Panmicro E-Mobile System - Arbitrary File Read
Summary: Panmicro E-Mobile System - Arbitrary File Read. The Panmicro E-Mobile client/cdnfile interface has an arbitrary file reading vulnerability. Unauthenticated attackers can use this vulnerability to read important system files, database configuration files, and so on.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: panmicro-arbitrary-file-read

info:
  name: Panmicro E-Mobile System - Arbitrary File Read
  author: s4e-io
  severity: high
  description: The Panmicro E-Mobile client/cdnfile interface has an arbitrary file reading vulnerability. Unauthenticated attackers can use this vulnerability to read important system files, database configuration files, and so on.
  tags: panmicro,e-mobile,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/client/cdnfile/1C/Windows/win.ini?windows"
      - "{{BaseURL}}/client/cdnfile/C/etc/passwd?linux"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: fosstodonorg-mastodon-instance

info:
  name: Fosstodon.org (Mastodon Instance) User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Fosstodon.org (Mastodon Instance) user name information check was conducted.
  tags: osint,osint-social,fosstodonorg-mastodon-instance,discovery

http:
  - method: GET
    path:
      - "https://fosstodon.org/api/v1/accounts/lookup?acct={{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "display_name"
        part: body


Instruction: Generate a Nuclei template for: Unshare - Privilege Escalation

Input:
Title: Unshare - Privilege Escalation
Summary: Unshare - Privilege Escalation. The unshare command is used to run a command in a new namespace, which can isolate various aspects of the system, such as the mount namespace, network namespace, user namespace, and more.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: privesc-unshare

info:
  name: Unshare - Privilege Escalation
  author: daffainfo
  severity: high
  description: The unshare command is used to run a command in a new namespace, which can isolate various aspects of the system, such as the mount namespace, network namespace, user namespace, and more.
  tags: code,linux,unshare,privesc,local

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: bigbluebutton-login

info:
  name: BigBlueButton Login Panel
  author: myztique
  severity: info
  description: A BigBlueButton login panel was detected.
  tags: panel,bigbluebutton,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "content="BigBlueButton"
        part: body


Instruction: Generate a Nuclei template for CVE-2023-33439

Input:
Title: SQL Injection in faculty_evaluation_system_project faculty_evaluation_system
Summary: Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=.
Vulnerability Type: SQL Injection
Severity: high
Affected Products: faculty_evaluation_system_project faculty_evaluation_system
Indicators: error, vulnerability detected

Output:
id: CVE-2023-33439

info:
  name: Faculty Evaluation System v1.0 - SQL Injection
  author: Harsh
  severity: high
  description: Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=
  tags: cve,cve2023,sqli,faculty,authenticated,faculty_evaluation_system_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Apache Ozone - Exposure

Input:
Title: Apache Ozone - Exposure
Summary: Apache Ozone - Exposure. Detects if path /conf of Apache Ozone web application is exposed.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: apache-ozone-conf

info:
  name: Apache Ozone - Exposure
  author: icarot
  severity: info
  description: Detects if path /conf of Apache Ozone web application is exposed.
  tags: tech,ozone,apache,detect,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/conf"
    matchers:
      - type: word
        words:
          - "<source>ozone-default.xml</source>"
          - "ozone"
        part: body
        condition: and
      - type: word
        words:
          - "text/xml"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: metasploit-panel

info:
  name: Metasploit Panel - Detect
  author: lu4nx
  severity: info
  description: Metasploit Web Panel is detected
  tags: panel,metasploit,login,rapid7,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"
    matchers:
      - type: word
        words:
          - "<title>Metasploit</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Error based SQL Injection

Input:
Title: Error based SQL Injection
Summary: Error based SQL Injection. Direct SQL Command Injection is a technique where an attacker creates or alters existing SQL commands to expose hidden data,
or to override valuable ones, or even to execute dangerous system level commands on the database host.
This is accomplished by the application taking user input and combining it with static parameters to build an SQL query .

Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: sqli-error-based

info:
  name: Error based SQL Injection
  author: geeknik,pdteam
  severity: critical
  description: Direct SQL Command Injection is a technique where an attacker creates or alters existing SQL commands to expose hidden data,
or to override valuable ones, or even to execute dangerous system level commands on the database host.
This is accomplished by the application taking user input and combining it with static parameters to build an SQL query .
  tags: sqli,error,dast,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Adminer"
        part: body
      - type: regex
        condition: or


Instruction: Generate a Nuclei template for: macOS Insecure /etc/hostconfig Permissions

Input:
Title: macOS Insecure /etc/hostconfig Permissions
Summary: macOS Insecure /etc/hostconfig Permissions. Evaluates permissions on the /etc/hostconfig file used to configure system services on macOS.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: insecure-etc-hostconfig-permissions

info:
  name: macOS Insecure /etc/hostconfig Permissions
  author: geeknik
  severity: high
  description: Evaluates permissions on the /etc/hostconfig file used to configure system services on macOS.
  tags: macos,audit,local,security

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Unrestricted SSH Access from Non-Whitelisted IPs

Input:
Title: Unrestricted SSH Access from Non-Whitelisted IPs
Summary: Unrestricted SSH Access from Non-Whitelisted IPs. SSH access is not restricted to specific IP addresses, allowing connections from any source. This increases the risk of unauthorized access and brute-force attacks.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: file-ssh-unrestricted-nonwhitelist

info:
  name: Unrestricted SSH Access from Non-Whitelisted IPs
  author: pussycat0x
  severity: info
  description: SSH access is not restricted to specific IP addresses, allowing connections from any source. This increases the risk of unauthorized access and brute-force attacks.
  tags: audit,config,file,ssh

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: git-config-nginxoffbyslash

info:
  name: Nginx - Git Configuration Exposure
  author: organiccrap
  severity: medium
  description: Nginx is vulnerable to git configuration exposure.
  tags: config,exposure,nginx,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}{{paths}}"
    matchers:
      - type: word
        words:
          - "[core]"


Instruction: Generate a Nuclei template for CVE-2022-22536

Input:
Title: Vulnerability (CWE-444) in sap content_server and others
Summary: SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.

Vulnerability Type: Vulnerability (CWE-444)
Severity: critical
Affected Products: sap content_server, sap netweaver_application_server_abap, sap web_dispatcher
Indicators: error, vulnerability detected

Output:
id: CVE-2022-22536

info:
  name: SAP Memory Pipes (MPI) Desynchronization
  author: pdteam
  severity: critical
  description: SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable to request smuggling and request concatenation attacks. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.
  tags: cve,cve2022,sap,smuggling,netweaver,web-dispatcher,memory-pipes,kev,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: or
      - type: word
        words:
          - "HTTP/1.0 400 Bad Request"
          - "HTTP/1.0 500 Internal Server Error"
          - "HTTP/1.0 500 Dispatching Error"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Datadog Access Token

Input:
Title: Datadog Access Token
Summary: Datadog Access Token. Tags: datadog, exposure, tokens
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: datadog-accesstoken

info:
  name: Datadog Access Token
  author: DhiyaneshDK
  severity: info
  description: Datadog Access Token
  tags: datadog,exposure,tokens,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Facebook for WooCommerce Detection

Input:
Title: Facebook for WooCommerce Detection
Summary: Facebook for WooCommerce Detection. Tags: tech, wordpress, wp-plugin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-facebook-for-woocommerce

info:
  name: Facebook for WooCommerce Detection
  author: ricardomaia
  severity: info
  description: Facebook for WooCommerce Detection
  tags: tech,wordpress,wp-plugin,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/facebook-for-woocommerce/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: Zend Server Test Page

Input:
Title: Zend Server Test Page
Summary: Zend Server Test Page. Tags: tech, zend, discovery
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: zend-server-test-page

info:
  name: Zend Server Test Page
  author: DhiyaneshDk
  severity: info
  description: Zend Server Test Page
  tags: tech,zend,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Zend Server Test Page</title>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-40355

Input:
Title: Cross-Site Scripting (XSS) in axigen axigen_mobile_webmail
Summary: Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated attackers to execute arbitrary code and obtain sensitive information via the logic for switching between the Standard and Ajax versions.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: axigen axigen_mobile_webmail
Indicators: error, vulnerability detected

Output:
id: CVE-2023-40355

info:
  name: Axigen WebMail - Cross-Site Scripting
  author: amir-h-fallahi
  severity: medium
  description: Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated attackers to execute arbitrary code and obtain sensitive information via the logic for switching between the Standard and Ajax versions.
  tags: cve,cve2023,xss,axigen,webmail,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.hsp?passwordExpired=yes&username=\'-alert(document.domain),//"
      - "{{BaseURL}}/index.hsp?passwordExpired=yes&domainName=\'-alert(document.domain),//"
      - "{{BaseURL}}/index.hsp?m=',alert(document.domain),'"
    matchers:
      - type: word
        words:
          - "\\'-alert(document.domain),//"
          - "',alert(document.domain),'"
        part: body
        condition: or
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: RDS RI Payment Failure

Input:
Title: RDS RI Payment Failure
Summary: RDS RI Payment Failure. Identifies failed RDS Reserved Instance purchases due to payment failures, affecting potential cost savings.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: rds-ri-payment-fail

info:
  name: RDS RI Payment Failure
  author: princechaddha
  severity: high
  description: Identifies failed RDS Reserved Instance purchases due to payment failures, affecting potential cost savings.
  tags: cloud,devops,aws,amazon,rds,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: mobiproxy-dashboard

info:
  name: MobiProxy Dashboard - Detect
  author: tess
  severity: medium
  description: MobiProxy dashboard was detected.
  tags: dashboard,exposure,mobiproxy,misconfig,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>MobiProxy"
          - "Dashboard"
          - "Setting"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: opennms-web-console

info:
  name: OpenNMS Web Console Login Panel - Detect
  author: DhiyaneshDk
  severity: info
  description: OpenNMS Web Console login panel was detected.
  tags: panel,login,edb,opennms,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/opennms/login.jsp"
    matchers:
      - type: word
        words:
          - "OpenNMS Web Console"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-1595

Input:
Title: Information Disclosure in hc_custom_wp-admin_url_project hc_custom_wp-admin_url
Summary: The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request
Vulnerability Type: Information Disclosure
Severity: medium
Affected Products: hc_custom_wp-admin_url_project hc_custom_wp-admin_url
Indicators: error, vulnerability detected

Output:
id: CVE-2022-1595

info:
  name: WordPress HC Custom WP-Admin URL <=1.4 - Admin Login URL Disclosure
  author: theamanrawat,oleveloper
  severity: medium
  description: The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request
  tags: cve,cve2022,unauth,wpscan,wordpress,wp-plugin,wp,hc-custom-wp-admin-url,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: header
      - type: regex
        part: header
      - type: status
        status:
          - 302


Instruction: Generate a Nuclei template for: Weblogic T3 Protocol Detection

Input:
Title: Weblogic T3 Protocol Detection
Summary: Weblogic T3 Protocol Detection. T3 is the protocol used to transport information between WebLogic servers and other types of Java programs.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: weblogic-t3-detect

info:
  name: Weblogic T3 Protocol Detection
  author: F1tz,milo2012,wdahlenb
  severity: info
  description: T3 is the protocol used to transport information between WebLogic servers and other types of Java programs.
  tags: network,weblogic,detect,t3,oracle,detection,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - Snyk Go

Input:
Title: Content-Security-Policy Bypass - Snyk Go
Summary: Content-Security-Policy Bypass - Snyk Go. Tags: xss, csp-bypass, snyk-go
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: snyk-go-csp-bypass

info:
  name: Content-Security-Policy Bypass - Snyk Go
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - Snyk Go
  tags: xss,csp-bypass,snyk-go,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "snyk.io"
        part: header
        condition: and


Instruction: Generate a Nuclei template for: Huawei HoloSens SDC - Panel

Input:
Title: Huawei HoloSens SDC - Panel
Summary: Huawei HoloSens SDC - Panel. Huawei HoloSens SDC Panel was discovered.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: huawei-holosense-panel

info:
  name: Huawei HoloSens SDC - Panel
  author: darses
  severity: info
  description: Huawei HoloSens SDC Panel was discovered.
  tags: panel,detect,huawei,holosens,iot,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
        condition: and
  - method: POST
    path:
      - "{{BaseURL}}/cgi-bin/main.cgi"
    matchers:
      - type: dsl
        condition: and
  - method: POST
    path:
      - "{{BaseURL}}/cgi-bin/main.cgi"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: sequoiadb-login

info:
  name: SequoiaDB Login Panel - Detect
  author: dhiyaneshDk
  severity: info
  description: SequoiaDB login panel was detected.
  tags: sequoiadb,panel,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login.html#/"
    matchers:
      - type: word
        words:
          - "<title>SequoiaDB</title>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header


Instruction: Generate a Nuclei template for: WebTrees Exposed Installation

Input:
Title: WebTrees Exposed Installation
Summary: WebTrees Exposed Installation. WebTrees is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: webtrees-install

info:
  name: WebTrees Exposed Installation
  author: ritikchaddha
  severity: high
  description: WebTrees is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,webtrees,install,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Setup wizard for webtrees"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Azure SQL Managed Instance TLS Version Not Latest

Input:
Title: Azure SQL Managed Instance TLS Version Not Latest
Summary: Azure SQL Managed Instance TLS Version Not Latest. Ensure that your Microsoft Azure SQL managed instances are using the latest supported version of the TLS protocol (i.e. TLS 1.2) for inbound connections in order to enhance security by providing stronger encryption, protecting data integrity, reducing vulnerabilities to cyber attacks, and maintaining compatibility with modern browsers.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: azure-sql-mi-tls-version-outdated

info:
  name: Azure SQL Managed Instance TLS Version Not Latest
  author: princechaddha
  severity: medium
  description: Ensure that your Microsoft Azure SQL managed instances are using the latest supported version of the TLS protocol (i.e. TLS 1.2) for inbound connections in order to enhance security by providing stronger encryption, protecting data integrity, reducing vulnerabilities to cyber attacks, and maintaining compatibility with modern browsers.
  tags: cloud,devops,azure,microsoft,azure-sql,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2014-6287

Input:
Title: Code Injection in rejetto http_file_server
Summary: The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.
Vulnerability Type: Code Injection
Severity: critical
Affected Products: rejetto http_file_server
Indicators: error, vulnerability detected

Output:
id: CVE-2014-6287

info:
  name: HTTP File Server <2.3c - Remote Command Execution
  author: j4vaovo
  severity: critical
  description: HTTP File Server before 2.3c is susceptible to remote command execution. The findMacroMarker function in parserLib.pas allows an attacker to execute arbitrary programs via a %00 sequence in a search action. Therefore, an attacker can obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  tags: cve2014,cve,packetstorm,msf,hfs,rce,kev,rejetto,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?search==%00{.cookie|{{str1}}|value%3d{{str2}}.}"
    matchers:
      - type: word
        words:
          - "<title>HFS /</title>"
        part: body
      - type: word
        words:
          - "Set-Cookie: {{str1}}={{str2}};"
          - "text/html"
        part: header
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: axway-securetransport-webclient

info:
  name: Axway SecureTransport Web Client Panel - Detect
  author: righettod
  severity: info
  description: AXWAY Secure Transport Web Client panel was detected.
  tags: panel,axway,securetransport,webclient,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/html/skin/ric/C/config/default.config.json"
    matchers:
      - type: word
        words:
          - "header": "ST Web Client"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Azure App Service Application Insights Not Enabled

Input:
Title: Azure App Service Application Insights Not Enabled
Summary: Azure App Service Application Insights Not Enabled. Ensure that the Application Insights feature is enabled for all your Microsoft Azure App Services applications in order to provide advanced application monitoring. Application Insights is an extensible Application Performance Management (APM) service for developers and DevOps professionals available as monitoring feature within Azure cloud. The feature monitors your live App Services applications to automatically detect performance anomalies. I
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: azure-appservice-insights-not-enabled

info:
  name: Azure App Service Application Insights Not Enabled
  author: princechaddha
  severity: medium
  description: Ensure that the Application Insights feature is enabled for all your Microsoft Azure App Services applications in order to provide advanced application monitoring. Application Insights is an extensible Application Performance Management (APM) service for developers and DevOps professionals available as monitoring feature within Azure cloud. The feature monitors your live App Services applications to automatically detect performance anomalies. It includes powerful analytics tools to help diagnose issues and understand what users do with your application. Application Insights can be enabled for apps on various platforms including .NET, Node.js, and Java EE, hosted on-premises, hybrid, or other public cloud platforms.
  tags: cloud,devops,azure,microsoft,application-insights,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-27467

Input:
Title: Path Traversal in processwire processwire
Summary: A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: processwire processwire
Indicators: error, vulnerability detected

Output:
id: CVE-2020-27467

info:
  name: Processwire CMS <2.7.1 - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: Processwire CMS prior to 2.7.1 is vulnerable to local file inclusion because it allows a remote attacker to retrieve sensitive files via the download parameter to index.php.
  tags: cve,cve2020,processwire,lfi,cms,oss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?download=/etc/passwd"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Apache StreamPipes - Detect

Input:
Title: Apache StreamPipes - Detect
Summary: Apache StreamPipes - Detect. Checks for the presence of Apache StreamPipes by looking in the body or matching the favicon hash.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: apache-streampipes-detect

info:
  name: Apache StreamPipes - Detect
  author: Alessandro Albani - DEVisions
  severity: info
  description: Checks for the presence of Apache StreamPipes by looking in the body or matching the favicon hash.
  tags: tech,apache,streampipes,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/streampipes-backend/api/openapi.json"
      - "{{BaseURL}}/assets/img/favicon/favicon.ico"
      - "{{BaseURL}}"
    matchers:
      - type: dsl
        condition: or


Instruction: Generate a Nuclei template for: Enterprise WeChat Corpsecret Key

Input:
Title: Enterprise WeChat Corpsecret Key
Summary: Enterprise WeChat Corpsecret Key. Tags: wechat, exposure, tencent
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wechat-corpsecret-key

info:
  name: Enterprise WeChat Corpsecret Key
  author: N0el4kls
  severity: info
  description: Enterprise WeChat Corpsecret Key
  tags: wechat,exposure,tencent,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-24902

Input:
Title: Cross-Site Scripting (XSS) in quixplorer_project quixplorer
Summary: Quixplorer <=2.4.1 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: quixplorer_project quixplorer
Indicators: error, vulnerability detected

Output:
id: CVE-2020-24902

info:
  name: Quixplorer <=2.4.1 - Cross-Site Scripting
  author: edoardottt
  severity: medium
  description: Quixplorer through 2.4.1 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site, which can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: cve,cve2020,quixplorer,xss,quixplorer_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?action=post&order=bszop%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "<script>alert(document.domain)</script>&srt=yes"
          - "My Download"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Browshot API Test

Input:
Title: Browshot API Test
Summary: Browshot API Test. Easily make screenshots of web pages in any screen size, as any device
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-browshot

info:
  name: Browshot API Test
  author: daffainfo
  severity: info
  description: Easily make screenshots of web pages in any screen size, as any device
  tags: token-spray,browshot

http:
  - method: GET
    path:
      - "https://api.browshot.com/api/v1/simple?url=http://mobilito.net/&instance_id=12&width=640&height=480&key={{token}}"
    matchers:
      - type: word
        words:
          - ""cost""
          - ""priority""
          - ""url""
        part: body
        condition: and


Instruction: Generate a Nuclei template for: Woodwing Studio Server - Git Config

Input:
Title: Woodwing Studio Server - Git Config
Summary: Woodwing Studio Server - Git Config. Woodwing Studio Server .git/config file exposed.
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: woodwing-git

info:
  name: Woodwing Studio Server - Git Config
  author: pdteam
  severity: medium
  description: Woodwing Studio Server .git/config file exposed.
  tags: misconfig,woodwing,git,config,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/Server/.git/config"
      - "{{BaseURL}}/StudioServer/.git/config"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: teamtreehouse

info:
  name: Teamtreehouse User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Teamtreehouse user name information check was conducted.
  tags: osint,osint-coding,teamtreehouse,discovery

http:
  - method: GET
    path:
      - "https://teamtreehouse.com/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Member Since"
        part: body


Instruction: Generate a Nuclei template for CVE-2022-29316

Input:
Title: SQL Injection in complete_online_job_search_system_project complete_online_job_search_system
Summary: Complete Online Job Search System v1.0 was discovered to contain a SQL injection vulnerability via /eris/index.php?q=result&searchfor=advancesearch.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: complete_online_job_search_system_project complete_online_job_search_system
Indicators: error, vulnerability detected

Output:
id: CVE-2022-29316

info:
  name: Complete Online Job Search System 1.0 - Cross-Site Scripting
  author: arafatansari
  severity: high
  description: Complete Online Job Search System 1.0 contains a cross-site scripting vulnerability via index.php?q=advancesearch.
  tags: cve,cve2022,xss,eris,sqli,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Result : <script>alert(document.domain)</script>"
          - "ERIS"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-22502

Input:
Title: OS Command Injection in microfocus operation_bridge_reporter
Summary: Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.
Vulnerability Type: OS Command Injection
Severity: critical
Affected Products: microfocus operation_bridge_reporter
Indicators: error, vulnerability detected

Output:
id: CVE-2021-22502

info:
  name: Micro Focus Operations Bridge Reporter - Remote Code Execution
  author: pikpikcu
  severity: critical
  description: Micro Focus Operations Bridge Reporter 10.40 is susceptible to remote code execution. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials.
  tags: cve2021,cve,microfocus,obr,rce,kev,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
          - "dns"
        part: interactsh_protocol
      - type: word
        words:
          - "An error occurred"
          - "AUTHENTICATION_FAILED"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 401


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: steemit

info:
  name: Steemit User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Steemit user name information check was conducted.
  tags: osint,osint-social,steemit,discovery

http:
  - method: GET
    path:
      - "https://steemit.com/@{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "blog"
        part: body


Instruction: Generate a Nuclei template to detect Cross-site Scripting

Input:
Title: Cross-site Scripting (CWE-79)
Summary: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. There are many variants of cross-site scripting, characterized by a variety of terms or involving different attack topologies. However, they all indicate the same fundamental weakness: improper neutralization of dangerous input between the adversary and a victim.
Vulnerability Type: Cross-site Scripting
Severity: high
Indicators: vulnerability detected, error

Output:
id: parallels-hsphere-xss

info:
  name: Parallels H-Sphere - Cross-Site Scripting
  author: ritikchaddha
  severity: high
  description: Parallels H-Sphere contains multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  tags: hsphere,xss,edb,parallels,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/webshell4/login.php?err=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
      - "{{BaseURL}}/webshell4/login.php?login=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "value="\"><script>alert(document.domain)</script>"
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: ICTBroadcast Login Panel - Detect

Input:
Title: ICTBroadcast Login Panel - Detect
Summary: ICTBroadcast Login Panel - Detect. ICTBroadcast login panel was detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: ictbroadcast-panel

info:
  name: ICTBroadcast Login Panel - Detect
  author: rxerium
  severity: info
  description: ICTBroadcast login panel was detected.
  tags: panel,ictbroadcast,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/login.php"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2011-4640

Input:
Title: Path Traversal in spamtitan webtitan
Summary: Directory traversal vulnerability in logs-x.php in SpamTitan WebTitan before 3.60 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the fname parameter in a view action.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: spamtitan webtitan
Indicators: error, vulnerability detected

Output:
id: CVE-2011-4640

info:
  name: WebTitan < 3.60 - Local File Inclusion
  author: ctflearner
  severity: medium
  description: Directory traversal vulnerability in logs-x.php in SpamTitan WebTitan before 3.60 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the fname parameter in a view action.
  tags: cve,cve2011,lfi,spamtitan,webtitan,authenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2016-4975

Input:
Title: Vulnerability (CWE-93) in apache http_server
Summary: Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).
Vulnerability Type: Vulnerability (CWE-93)
Severity: medium
Affected Products: apache http_server
Indicators: error, vulnerability detected

Output:
id: CVE-2016-4975

info:
  name: Apache mod_userdir CRLF injection
  author: melbadry9,nadino,xElkomy
  severity: medium
  description: Apache CRLF injection allowing HTTP response splitting attacks on sites using mod_userdir.
  tags: cve2016,cve,crlf,apache,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/~user/%0D%0ASet-Cookie:crlfinjection"
    matchers:
      - type: regex
        part: header


Instruction: Generate a Nuclei template for CVE-2015-1000012

Input:
Title: Information Disclosure in mypixs_project mypixs
Summary: Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin
Vulnerability Type: Information Disclosure
Severity: high
Affected Products: mypixs_project mypixs
Indicators: error, vulnerability detected

Output:
id: CVE-2015-1000012

info:
  name: WordPress MyPixs <=0.3 - Local File Inclusion
  author: daffainfo
  severity: high
  description: WordPress MyPixs 0.3 and prior contains a local file inclusion vulnerability.
  tags: cve,cve2015,wordpress,wp-plugin,lfi,wpscan,mypixs_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/mypixs/mypixs/downloadpage.php?url=/etc/passwd"
    matchers:
      - type: regex
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-31839

Input:
Title: Cross-Site Scripting (XSS) in tiagorlampert chaos
Summary: Cross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandler function in the handler.go component.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: tiagorlampert chaos
Indicators: error, vulnerability detected

Output:
id: CVE-2024-31839

info:
  name: CHAOS 5.0.1 'sendCommandHandler' - Cross-Site Scripting
  author: riteshs4hu
  severity: medium
  description: Cross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandler function in the handler.go component.
  tags: cve,cve2024,chaos,tiagorlampert,xss,intrusive,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2011-5252

Input:
Title: Vulnerability (CWE-20) in orchardproject orchard
Summary: Open redirect vulnerability in Users/Account/LogOff in Orchard 1.0.x before 1.0.21, 1.1.x before 1.1.31, 1.2.x before 1.2.42, and 1.3.x before 1.3.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the ReturnUrl parameter.
Vulnerability Type: Vulnerability (CWE-20)
Severity: medium
Affected Products: orchardproject orchard
Indicators: error, vulnerability detected

Output:
id: CVE-2011-5252

info:
  name: Orchard 'ReturnUrl' Parameter URI - Open Redirect
  author: ctflearner
  severity: medium
  description: Open redirect vulnerability in Users/Account/LogOff in Orchard 1.0.x before 1.0.21, 1.1.x before 1.1.31, 1.2.x before 1.2.42, and 1.3.x before 1.3.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the ReturnUrl parameter.
  tags: cve,cve2011,redirect,orchard,orchardproject,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/orchard/Users/Account/LogOff?ReturnUrl=%2f%2fhttp://interact.sh%3f"
    matchers:
      - type: regex
        part: header


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: ivanti-endpoint-manager

info:
  name: Ivanti Endpoint Manager - Detect
  author: ritikchaddha
  severity: info
  description: Detects the presence of Ivanti Endpoint Manager (formerly LANDesk Management Suite) servers.
  tags: tech,ivanti,epm,detect,landdesk,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/ldlogon.dll"
      - "{{BaseURL}}/core/login"
      - "{{BaseURL}}/webaccess"
    matchers:
      - type: word
        words:
          - "Ivanti Endpoint Manager"
          - "LANDesk Management"
          - "Ivanti(R) Cloud Services"
          - "Ivanti Cloud Services Appliance"
          - "LANDesk(R) Cloud Services Appliance"
          - "LANDesk(R) Management"
        part: body
        condition: or
      - type: word
        words:
          - "LANDesk"
          - "Ivanti EPM"
        part: header
        condition: or
      - type: regex
        part: response
        condition: or


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: nginx-ui-dashboard

info:
  name: Nginx UI Panel - Detect
  author: gy741
  severity: info
  description: Nginx UI panel was detected.
  tags: panel,nginx,exposure,f5,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Nginx UI"
          - "Main Config"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: fortiweb-login

info:
  name: Fortinet FortiWeb Login Panel - Detect
  author: PR3R00T,daffainfo
  severity: info
  description: Fortinet FortiWeb login panel was detected.
  tags: panel,fortinet,fortiweb,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"
    matchers:
      - type: word
        words:
          - "Please login"
          - "ftnt-fortinet-grid"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-61884

Input:
Title: Path Traversal in oracle configurator
Summary: Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Vulnerability Type: Path Traversal
Severity: high
Affected Products: oracle configurator
Indicators: unauthorized

Output:
id: CVE-2025-61884

info:
  name: Oracle E-Business Suite - Server-Side Request Forgery
  author: Kazgangap
  severity: high
  description: Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator.
  tags: cve,cve2025,oracle,e-business,kev,vkev

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-30943

Input:
Title: Vulnerability (CWE-73) in moodle moodle and others
Summary: The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.
Vulnerability Type: Vulnerability (CWE-73)
Severity: medium
Affected Products: moodle moodle, fedoraproject extra_packages_for_enterprise_linux, fedoraproject fedora
Indicators: error, vulnerability detected

Output:
id: CVE-2023-30943

info:
  name: Moodle - Cross-Site Scripting/Remote Code Execution
  author: ritikchaddha
  severity: medium
  description: The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. Moodle versions 4.1.x before 4.1.3 and 4.2.x before 4.2.0 are susceptible to an unauthenticated arbitrary folder creation, tracked as CVE-2023-30943. An attacker can leverage the creation of arbitrary folders to carry out a Stored Cross-Site Scripting (XSS) attack on the administration panel, resulting in arbitrary code execution on the server as soon as an administrator visits the panel.
  tags: cve,cve2023,moodle,xss,rce,authenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<img src=x onerror=alert(document.domain)>"
          - ">archive"
          - "File icon"
        part: body_4
        condition: and
      - type: word
        words:
          - "text/html"
        part: header_4
      - type: status
        status:
          - 200
        part: header_4


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: iptime-default-login

info:
  name: ipTIME Default Login
  author: gy741
  severity: high
  description: ipTIME default admin credentials were discovered.
  tags: iptime,default-login,vuln

http:
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "setCookie"
          - "efm_session_id"
          - "login.cgi"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: OpenVas Login Panel - Detect

Input:
Title: OpenVas Login Panel - Detect
Summary: OpenVas Login Panel - Detect. An OpenVas Admin login panel was detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: openvas-panel

info:
  name: OpenVas Login Panel - Detect
  author: rxerium
  severity: info
  description: An OpenVas Admin login panel was detected.
  tags: panel,openvas,admin,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Greenbone Security Assistant"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: pop3-detect

info:
  name: POP3 Protocol - Detect
  author: pussycat0x
  severity: info
  description: POP3 protocol was detected.
  tags: network,detect,pop3,mail,detection,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-29300

Input:
Title: Deserialization of Untrusted Data in adobe coldfusion
Summary: Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Vulnerability Type: Deserialization of Untrusted Data
Severity: critical
Affected Products: adobe coldfusion
Indicators: error, vulnerability detected

Output:
id: CVE-2023-29300

info:
  name: Adobe ColdFusion - Pre-Auth Remote Code Execution
  author: rootxharsh,iamnoooob,pdresearch
  severity: critical
  description: Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
  tags: cve,cve2023,adobe,rce,coldfusion,deserialization,kev,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: aem-sling-login

info:
  name: Adobe Experience Manager Sling User Login - Detect
  author: dhiyaneshDk
  severity: info
  description: Adobe Experience Manager Sling user login panel was detected.
  tags: panel,aem,adobe,sling,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/system/sling/cqform/defaultlogin.html"
    matchers:
      - type: word
        words:
          - "<title>Login</title>"
          - "j_username"
          - "j_password"
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: patientslikeme

info:
  name: PatientsLikeMe User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: PatientsLikeMe user name information check was conducted.
  tags: osint,osint-health,patientslikeme,discovery

http:
  - method: GET
    path:
      - "https://www.patientslikeme.com/members/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "s profile | PatientsLikeMe</title>"
        part: body


Instruction: Generate a Nuclei template for CVE-2021-41648

Input:
Title: SQL Injection in online-shopping-system-advanced_project online-shopping-system-advanced
Summary: An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId parameter. Using a post request does not sanitize the user input.
Vulnerability Type: SQL Injection
Severity: high
Affected Products: online-shopping-system-advanced_project online-shopping-system-advanced
Indicators: error, vulnerability detected

Output:
id: CVE-2021-41648

info:
  name: PuneethReddyHC action.php SQL Injection
  author: daffainfo
  severity: high
  description: An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping through the /action.php prId parameter. Using a post request does not sanitize the user input.
  tags: cve2021,cve,sqli,packetstorm,online-shopping-system-advanced_project,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/action.php"
    matchers:
      - type: word
        words:
          - "text/html"
        part: header
      - type: word
        words:
          - "Warning: mysqli_num_rows() expects parameter 1 to be"
          - "xdebug-error xe-warning"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: mastodon-mastodon

info:
  name: Mastodon-mastodon User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Mastodon-mastodon user name information check was conducted.
  tags: osint,osint-social,mastodon-mastodon,discovery

http:
  - method: GET
    path:
      - "https://mastodon.social/@{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "profile:username"
        part: body


Instruction: Generate a Nuclei template for: AIC Intelligent Campus System - Password Exposure

Input:
Title: AIC Intelligent Campus System - Password Exposure
Summary: AIC Intelligent Campus System - Password Exposure. Due to the design logic defects, the super password is leaked, which can kill more than 40 campus systems.<br>

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: aic-intelligent-password-exposure

info:
  name: AIC Intelligent Campus System - Password Exposure
  author: SleepingBag945
  severity: medium
  description: Due to the design logic defects, the super password is leaked, which can kill more than 40 campus systems.<br>
  tags: aic,exposure,password,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/datacenter/dataOrigin.ashx?c=login"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: New Relic API Service Key

Input:
Title: New Relic API Service Key
Summary: New Relic API Service Key. Tags: newrelic, exposure, tokens
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: newrelic-api-service-key

info:
  name: New Relic API Service Key
  author: DhiyaneshDK
  severity: info
  description: New Relic API Service Key
  tags: newrelic,exposure,tokens,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: teamcity-guest-login-enabled

info:
  name: JetBrains TeamCity - Guest User Access Enabled
  author: Ph33r
  severity: high
  description: TeamCity provides the ability to turn on the guest login allowing anonymous access to the TeamCity UI.
  tags: misconfig,teamcity,jetbrains,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Location: /overview.html"
          - "TCSESSIONID="
        part: header
        condition: and
      - type: status
        status:
          - 302


Instruction: Generate a Nuclei template for: Sitefinity Login

Input:
Title: Sitefinity Login
Summary: Sitefinity Login. This template identifies the Sitefinity login page.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: sitefinity-login

info:
  name: Sitefinity Login
  author: dhiyaneshDK
  severity: info
  description: This template identifies the Sitefinity login page.
  tags: sitefinity,edb,panel,progress,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/Sitefinity/Authenticate/SWT"
    matchers:
      - type: word
        words:
          - "Telerik.Sitefinity.Web.UI.UserPreferences"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: FE collaborative Office templateOfTaohong_manager.jsp - Path Traversal

Input:
Title: FE collaborative Office templateOfTaohong_manager.jsp - Path Traversal
Summary: FE collaborative Office templateOfTaohong_manager.jsp - Path Traversal. There is a directory traversal vulnerability in the templateOfTaohong_manager.jsp file of UFIDA FE collaborative office platform. Through the vulnerability, attackers can obtain directory files and other information, leading to further attacks.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: yonyou-fe-directory-traversal

info:
  name: FE collaborative Office templateOfTaohong_manager.jsp - Path Traversal
  author: SleepingBag945
  severity: medium
  description: There is a directory traversal vulnerability in the templateOfTaohong_manager.jsp file of UFIDA FE collaborative office platform. Through the vulnerability, attackers can obtain directory files and other information, leading to further attacks.
  tags: yonyou,fe,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/system/mediafile/templateOfTaohong_manager.jsp?path=/../../../"
    matchers:
      - type: word
        words:
          - "window.location="templateOfTaohong_manager.jsp?path=""
          - "var next=window.confirm("确定删除文件吗？");"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-45855

Input:
Title: Path Traversal in qdpm qdpm
Summary: qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: qdpm qdpm
Indicators: error, vulnerability detected

Output:
id: CVE-2023-45855

info:
  name: qdPM 9.2 - Directory Traversal
  author: DhiyaneshDk
  severity: high
  description: qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.
  tags: cve,cve2023,qdpm,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/uploads/"
    matchers:
      - type: word
        words:
          - "Index of /uploads</title>"
          - "attachments/</a>"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: expect - Privilege Escalation

Input:
Title: expect - Privilege Escalation
Summary: expect - Privilege Escalation. expect is a Unix scripting and testing utility that automates interactive applications such as telnet, ftp, passwd, fsck, rlogin, tip, and more. It uses scripts to control interactive applications, making it useful for automating tasks that involve user input.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: privesc-expect

info:
  name: expect - Privilege Escalation
  author: daffainfo
  severity: high
  description: expect is a Unix scripting and testing utility that automates interactive applications such as telnet, ftp, passwd, fsck, rlogin, tip, and more. It uses scripts to control interactive applications, making it useful for automating tasks that involve user input.
  tags: code,linux,expect,privesc,local

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-32738

Input:
Title: SQL Injection in cyberpower powerpanel
Summary: A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "query_ptask_lean" function within MCUDBHelper.

Vulnerability Type: SQL Injection
Severity: high
Affected Products: cyberpower powerpanel
Indicators: error, vulnerability detected

Output:
id: CVE-2024-32738

info:
  name: CyberPower - SQL Injection
  author: DhiyaneshDk
  severity: high
  description: A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3.
  tags: cve,cve2024,cyberpower,sqli,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/ndconfig?mode=lean&uid=1'%20UNION%20select%201,2,3,sqlite_version();--"
    matchers:
      - type: word
        words:
          - ":"finished""
          - ""success":"
          - "modifiedtime":"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Discover Cold Fusion cfcache.map Files

Input:
Title: Discover Cold Fusion cfcache.map Files
Summary: Discover Cold Fusion cfcache.map Files. Adobe Cold Fusion cfcache.map file is exposed.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: cold-fusion-cfcache-map

info:
  name: Discover Cold Fusion cfcache.map Files
  author: geeknik
  severity: low
  description: Adobe Cold Fusion cfcache.map file is exposed.
  tags: exposure,coldfusion,adobe,files,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cfcache.map"
    matchers:
      - type: word
        words:
          - "Mapping="
          - "SourceTimeStamp="
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-24391

Input:
Title: Unknown Vulnerability in mongo-express_project mongo-express
Summary: mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.
Vulnerability Type: Unknown Vulnerability
Severity: critical
Affected Products: mongo-express_project mongo-express
Indicators: error, vulnerability detected

Output:
id: CVE-2020-24391

info:
  name: Mongo-Express - Remote Code Execution
  author: leovalcante
  severity: critical
  description: Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server.
  tags: cve,cve2020,mongo,express,rce,intrusive,mongo-express_project,node.js,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: body_3
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Missing Nginx Rate Limiting Configuration

Input:
Title: Missing Nginx Rate Limiting Configuration
Summary: Missing Nginx Rate Limiting Configuration. Ensures that rate limiting is properly configured in Nginx to prevent excessive requests from a single client.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: file-missing-nginx-rate-limiting

info:
  name: Missing Nginx Rate Limiting Configuration
  author: pussycat0x
  severity: medium
  description: Ensures that rate limiting is properly configured in Nginx to prevent excessive requests from a single client.
  tags: audit,file,nginx,hardening

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: anydesk phishing Detection

Input:
Title: anydesk phishing Detection
Summary: anydesk phishing Detection. An anydesk phishing website was detected

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: anydesk-phish

info:
  name: anydesk phishing Detection
  author: rxerium
  severity: info
  description: An anydesk phishing website was detected
  tags: phishing,anydesk,osint,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "The Fast Remote Desktop Application – AnyDesk"
      - type: status
        status:
          - 200
      - type: dsl


Instruction: Generate a Nuclei template for: Bash Scanner

Input:
Title: Bash Scanner
Summary: Bash Scanner. Indicator for bash Dangerous Commands – You Should Never Execute on Linux
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: bash-scanner

info:
  name: Bash Scanner
  author: ransomsec
  severity: info
  description: Indicator for bash Dangerous Commands – You Should Never Execute on Linux
  tags: bash,file,shell,sh

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: SSH Host Keys < 2048 Bits Considered Weak

Input:
Title: SSH Host Keys < 2048 Bits Considered Weak
Summary: SSH Host Keys < 2048 Bits Considered Weak. SSH host keys with a bit length below 2048 are deemed weak, posing an increased vulnerability to security threats. Employing robust key lengths is crucial for fortifying the integrity of encrypted communication and thwarting potential exploits.

Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: ssh-weak-public-key

info:
  name: SSH Host Keys < 2048 Bits Considered Weak
  author: pussycat0x
  severity: low
  description: SSH host keys with a bit length below 2048 are deemed weak, posing an increased vulnerability to security threats. Employing robust key lengths is crucial for fortifying the integrity of encrypted communication and thwarting potential exploits.
  tags: enum,js,ssh,misconfig,network,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: phpMyFAQ Installation - Exposure

Input:
Title: phpMyFAQ Installation - Exposure
Summary: phpMyFAQ Installation - Exposure. phpMyFAQ installation is exposed.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: phpmyfaq-installer

info:
  name: phpMyFAQ Installation - Exposure
  author: ritikchaddha
  severity: high
  description: phpMyFAQ installation is exposed.
  tags: misconfig,phpmyfaq,install,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/setup/index.php"
    matchers:
      - type: word
        words:
          - "<title>phpMyFAQ"
          - "Setup</title>"
        part: body
        condition: and
      - type: word
        words:
          - "phpmyfaq-setup"
        part: header


Instruction: Generate a Nuclei template for CVE-2023-45249

Input:
Title: Vulnerability (CWE-1393) in acronis cyber_infrastructure
Summary: Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132.
Vulnerability Type: Vulnerability (CWE-1393)
Severity: critical
Affected Products: acronis cyber_infrastructure
Indicators: error, vulnerability detected

Output:
id: CVE-2023-45249

info:
  name: Acronis Cyber Infrastructure - Default Password
  author: darses
  severity: critical
  description: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, and 5.4.4-132 contain a remote command execution caused by use of default passwords, letting attackers execute arbitrary commands remotely, exploit requires access to the system with default credentials.
  tags: cve,cve2023,kev,acronis,network,js,postgresql,default-login,vkev,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: brickset

info:
  name: Brickset User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Brickset user name information check was conducted.
  tags: osint,osint-hobby,brickset,discovery

http:
  - method: GET
    path:
      - "https://forum.brickset.com/profile/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Activity</h2>"
        part: body


Instruction: Generate a Nuclei template for CVE-2021-24407

Input:
Title: Cross-Site Scripting (XSS) in tielabs jannah
Summary: The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX action, leading to a Reflected Cross-site Scripting (XSS) vulnerability.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: tielabs jannah
Indicators: error, vulnerability detected

Output:
id: CVE-2021-24407

info:
  name: WordPress Jannah Theme <5.4.5 - Cross-Site Scripting
  author: pikpikcu
  severity: medium
  description: WordPress Jannah theme before 5.4.5 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX action.
  tags: cve2021,cve,wordpress,xss,wp-theme,wpscan,tielabs,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "/wp-content/themes/jannah/assets/"
          - "attachment-jannah-image-"
        condition: or
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Improper Resource Shutdown or Release

Input:
Title: Improper Resource Shutdown or Release (CWE-404)
Summary: The product does not release or incorrectly releases a resource before it is made available for re-use. When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.
Vulnerability Type: Improper Resource Shutdown or Release
Severity: medium
Indicators: invalid

Output:
id: azure-takeover-detection

info:
  name: Microsoft Azure Takeover Detection
  author: pdteam
  severity: high
  description: Microsoft Azure is vulnerable to subdomain takeover attacks. Subdomain takeovers are a common, high-severity threat for organizations that regularly create and delete many resources. A subdomain takeover can occur when a D>
  tags: dns,takeover,azure,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: rstudio-detect

info:
  name: RStudio Panel - Detect
  author: philippedelteil
  severity: info
  description: RStudio panel was detected.
  tags: panel,rstudio,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "RStudio"
        part: header
      - type: status
        status:
          - 302


Instruction: Generate a Nuclei template for CVE-2014-9606

Input:
Title: Cross-Site Scripting (XSS) in netsweeper netsweeper
Summary: Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) server parameter to remotereporter/load_logfiles.php, (2) customctid parameter to webadmin/policy/category_table_ajax.php, (3) urllist parameter to webadmin/alert/alert.php, (4) QUERY_STRING to webadmin/ajaxfilemanager/ajax_get_file_listing.php, or (5) PATH_INFO to webadmin/policy/policy_table_ajax.php/.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: netsweeper netsweeper
Indicators: error, vulnerability detected

Output:
id: CVE-2014-9606

info:
  name: Netsweeper 4.0.8 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: Multiple cross-site scripting vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) server parameter to remotereporter/load_logfiles.php, (2) customctid parameter to webadmin/policy/category_table_ajax.php, (3) urllist parameter to webadmin/alert/alert.php, (4) QUERY_STRING to webadmin/ajaxfilemanager/ajax_get_file_listing.php, or (5) PATH_INFO to webadmin/policy/policy_table_ajax.php/.
  tags: cve2014,cve,netsweeper,xss,packetstorm,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/webadmin/policy/category_table_ajax.php?customctid=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Persistent Disks Attached to Suspended Virtual Machines

Input:
Title: Persistent Disks Attached to Suspended Virtual Machines
Summary: Persistent Disks Attached to Suspended Virtual Machines. Ensure that persistent disks are not attached to suspended virtual machine (VM) instances in your Google Cloud environment. Persistent disks attached to suspended VMs continue to incur charges even when the VM is not running, leading to unnecessary costs.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: gcloud-persistent-disks-suspended-vms

info:
  name: Persistent Disks Attached to Suspended Virtual Machines
  author: princechaddha
  severity: high
  description: Ensure that persistent disks are not attached to suspended virtual machine (VM) instances in your Google Cloud environment. Persistent disks attached to suspended VMs continue to incur charges even when the VM is not running, leading to unnecessary costs.
  tags: cloud,devops,gcp,gcloud,compute,storage,cost-optimization,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Sofacy Group Winexe Tool Hash - Detect

Input:
Title: Sofacy Group Winexe Tool Hash - Detect
Summary: Sofacy Group Winexe Tool Hash - Detect. Winexe tool used by Sofacy group in Bundestag APT.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: sofacy-winexe-malware-hash

info:
  name: Sofacy Group Winexe Tool Hash - Detect
  author: pussycat0x
  severity: info
  description: Winexe tool used by Sofacy group in Bundestag APT.
  tags: malware,sofacy

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-24934

Input:
Title: Cross-Site Scripting (XSS) in yellowpencil visual_css_style_editor
Summary: The Visual CSS Style Editor WordPress plugin before 7.5.4 does not sanitise and escape the wyp_page_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: yellowpencil visual_css_style_editor
Indicators: error, vulnerability detected

Output:
id: CVE-2021-24934

info:
  name: Visual CSS Style Editor < 7.5.4 - Cross-Site Scripting
  author: Splint3r7
  severity: medium
  description: The plugin does not sanitise and escape the wyp_page_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
  tags: cve,cve2021,wordpress,wp,wp-plugin,yellowpencil,xss,authenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Python App - SQL Exception

Input:
Title: Python App - SQL Exception
Summary: Python App - SQL Exception. A generic SQL exception was discovered in Python according to PEP 249.
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: python-app-sql-exceptions

info:
  name: Python App - SQL Exception
  author: geeknik
  severity: medium
  description: A generic SQL exception was discovered in Python according to PEP 249.
  tags: file,logs,python,sql

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Speedtest Panel - Detection

Input:
Title: Speedtest Panel - Detection
Summary: Speedtest Panel - Detection. Speedtest panel was discovered

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: speedtest-panel

info:
  name: Speedtest Panel - Detection
  author: rxerium
  severity: info
  description: Speedtest panel was discovered
  tags: speedtest,tracker,panel,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin/login"
    matchers:
      - type: word
        words:
          - "Login -  Speedtest Tracker"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-34032

Input:
Title: Vulnerability (CWE-20) in geoffrowland jmol
Summary: A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content.
Vulnerability Type: Vulnerability (CWE-20)
Severity: medium
Affected Products: geoffrowland jmol
Indicators: error, vulnerability detected

Output:
id: CVE-2025-34032

info:
  name: Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting
  author: madrobot,ritikchaddha
  severity: medium
  description: A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content.
  tags: cve,cve2025,moodle,xss,edb,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/filter/jmol/js/jsmol/php/jsmol.php?call=saveFile&data=%3Cscript%3Ealert(document.domain)%3C/script%3E&mimetype=text/html"
    matchers:
      - type: dsl
        condition: and
      - type: regex


Instruction: Generate a Nuclei template for: Clockwork Dashboard Exposure

Input:
Title: Clockwork Dashboard Exposure
Summary: Clockwork Dashboard Exposure. Clockwork Dashboard is exposed.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: clockwork-dashboard-exposure

info:
  name: Clockwork Dashboard Exposure
  author: dhiyaneshDk
  severity: high
  description: Clockwork Dashboard is exposed.
  tags: exposure,unauth,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/__clockwork/latest"
    matchers:
      - type: word
        words:
          - ""id":"
          - ""version":"
          - ""method":"
          - ""url":"
          - ""time":"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: qihang-media-disclosure

info:
  name: QiHang Media Web Digital Signage 3.0.9 - Cleartext Credentials Disclosure
  author: gy741
  severity: high
  description: QiHang Media Web Digital Signage 3.0.9 suffers from a clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file /xml/User/User.xml and obtain administrative login information that allows for a successful authentication bypass attack.
  tags: qihang,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/xml/User/User.xml"
    matchers:
      - type: word
        words:
          - "<?xml version"
          - "<Users>"
          - "account="
          - "password="
        part: body
        condition: and


Instruction: Generate a Nuclei template for: MySQL Database Instances - SQL Auditing Disabled

Input:
Title: MySQL Database Instances - SQL Auditing Disabled
Summary: MySQL Database Instances - SQL Auditing Disabled. SQL auditing is disabled on the MySQL database instances, meaning activities such as user queries and connection events are not logged. This may hinder the ability to track database activity, detect suspicious behavior, and comply with security auditing requirements.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: mysql-audit-disabled

info:
  name: MySQL Database Instances - SQL Auditing Disabled
  author: DhiyaneshDK
  severity: high
  description: SQL auditing is disabled on the MySQL database instances, meaning activities such as user queries and connection events are not logged. This may hinder the ability to track database activity, detect suspicious behavior, and comply with security auditing requirements.
  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,alibaba-rds

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: MQTT Unauthenticated Broker - Detect

Input:
Title: MQTT Unauthenticated Broker - Detect
Summary: MQTT Unauthenticated Broker - Detect. Detects an unauthenticated MQTT broker and attempts to subscribe to the $SYS/# topic to enumerate broker and system information.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: unauth-mqtt-broker

info:
  name: MQTT Unauthenticated Broker - Detect
  author: matejsmycka
  severity: high
  description: Detects an unauthenticated MQTT broker and attempts to subscribe to the $SYS/# topic to enumerate broker and system information.
  tags: js,tcp,network,mqtt,unauth

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200