Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: drupal-login

info:
  name: Drupal Login Panel - Detect
  author: pathtaga
  severity: info
  description: Drupal login panel was detected.
  tags: panel,drupal,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/user/login"
    matchers:
      - type: regex
        part: body
        condition: or
      - type: regex
        part: header
        condition: or


Instruction: Generate a Nuclei template for CVE-2024-4841

Input:
Title: Vulnerability (CWE-29) in lollms lollms-webui
Summary: A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. By exploiting this vulnerability, an attacker can predict the folders, subfolders, and files present on the victim's computer. The vulnerability is present in the way the application handles the 'path' parameter in HTTP requests to the '/add_reference_to_local_model' endpoint.
Vulnerability Type: Vulnerability (CWE-29)
Severity: low
Affected Products: lollms lollms-webui
Indicators: error, vulnerability detected

Output:
id: CVE-2024-4841

info:
  name: LoLLMS WebUI - Subfolder Prediction via Path Traversal
  author: s4e-io
  severity: medium
  description: A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest.
  tags: cve,cve2024,lollms-webui,traversal,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Multi-function Printer - Unauthorized Access

Input:
Title: Multi-function Printer - Unauthorized Access
Summary: Multi-function Printer - Unauthorized Access. Unauthorized access to MFP (Multi-function printer) using eSCL protocol allows attackers to scan documents left physically in the printer and send them to an arbitrary location. Furthermore, exposure of this endpoint allows attackers to gather information about the printer, serial number, model, and possibly pull documents scanned by legitimate users.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: mfp-unauth-exposure

info:
  name: Multi-function Printer - Unauthorized Access
  author: matejsmycka
  severity: medium
  description: Unauthorized access to MFP (Multi-function printer) using eSCL protocol allows attackers to scan documents left physically in the printer and send them to an arbitrary location. Furthermore, exposure of this endpoint allows attackers to gather information about the printer, serial number, model, and possibly pull documents scanned by legitimate users.
  tags: network,iot,printer,misconfig,escl,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/eSCL/ScannerCapabilities"
    matchers:
      - type: word
        words:
          - "xmlns:pwg="
          - "<scan:ScannerCapabilities"
        condition: and
      - type: word
        words:
          - "application/xml"
          - "text/xml"
        part: header
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Ensure FTP Client is Not Installed

Input:
Title: Ensure FTP Client is Not Installed
Summary: Ensure FTP Client is Not Installed. FTP clients such as ftp and tnftp use an unencrypted protocol that exposes sensitive data during transmission.These packages should only be installed when explicitly required, as their presence increases security risk.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: ftp-client

info:
  name: Ensure FTP Client is Not Installed
  author: Th3l0newolf
  severity: info
  description: FTP clients such as ftp and tnftp use an unencrypted protocol that exposes sensitive data during transmission.These packages should only be installed when explicitly required, as their presence increases security risk.
  tags: cis,local,cisecurity,audit,linux,ubuntu,ftp

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-42747

Input:
Title: Cross-Site Scripting (XSS) in auieo candidats
Summary: CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks.

Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: auieo candidats
Indicators: error, vulnerability detected

Output:
id: CVE-2022-42747

info:
  name: CandidATS 3.0.0 - Cross-Site Scripting.
  author: arafatansari
  severity: medium
  description: CandidATS 3.0.0 contains a cross-site scripting vulnerability via the sortBy parameter of the ajax.php resource. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: cve,cve2022,candidats,xss,auieo,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/ajax.php?f=getPipelineJobOrder&joborderID=50&page=0&entriesPerPage=15&sortBy=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&sortDirection=desc&indexFile=1&isPopup=0"
    matchers:
      - type: word
        words:
          - "<script>alert(document.domain)</script>"
          - "candidat"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 404


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: esphome-panel

info:
  name: ESPHome Login Panel - Detect
  author: fabaff
  severity: info
  description: ESPHome login panel was detected.
  tags: panel,esphome,iot,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"
    matchers:
      - type: word
        words:
          - "class="esphome-header"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-27191

Input:
Title: Unknown Vulnerability in lionwiki lionwiki
Summary: LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted string in the index.php f1 variable, aka Local File Inclusion. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability Type: Unknown Vulnerability
Severity: high
Affected Products: lionwiki lionwiki
Indicators: error, vulnerability detected

Output:
id: CVE-2020-27191

info:
  name: LionWiki <3.2.12 - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted strings in the index.php f1 variable, aka local file inclusion.
  tags: cve2020,cve,lionwiki,lfi,oss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?page=&action=edit&f1=.//./\.//./\.//./\.//./\.//./\.//./etc/passwd&restore=1"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: asus-router-panel

info:
  name: Asus Router Login Panel - Detect
  author: arafatansari
  severity: info
  description: Asus router login panel was detected.
  tags: panel,asus,router,iot,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/Main_Login.asp"
    matchers:
      - type: word
        words:
          - "<title>ASUS Login</title>"
          - "Sign in with your ASUS router account"
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: spotify phishing Detection

Input:
Title: spotify phishing Detection
Summary: spotify phishing Detection. A spotify phishing website was detected

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: spotify-phish

info:
  name: spotify phishing Detection
  author: rxerium
  severity: info
  description: A spotify phishing website was detected
  tags: phishing,spotify,osint,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Spotify - Web Player: Music for everyone"
      - type: status
        status:
          - 200
      - type: dsl


Instruction: Generate a Nuclei template for CVE-2019-17503

Input:
Title: Vulnerability (CWE-425) in kirona dynamic_resource_scheduling
Summary: An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd) directly: it contains sensitive information about the database through the SQL queries within this batch file. This file exposes SQL database information such as database version, table name, column name, etc.
Vulnerability Type: Vulnerability (CWE-425)
Severity: medium
Affected Products: kirona dynamic_resource_scheduling
Indicators: error, vulnerability detected

Output:
id: CVE-2019-17503

info:
  name: Kirona Dynamic Resource Scheduler - Information Disclosure
  author: LogicalHunter
  severity: medium
  description: Kirona Dynamic Resource Scheduler is susceptible to information disclosure. An unauthenticated user can directly access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd), which contains sensitive information with exposed SQL queries, such as database version, table name, and column name.
  tags: cve,cve2019,exposure,edb,packetstorm,kirona,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/osm/REGISTER.cmd"
      - "{{BaseURL}}/osm_tiles/REGISTER.cmd"
    matchers:
      - type: word
        words:
          - "DEBUGMAPSCRIPT=TRUE"
          - "@echo off"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Reposilite Login Panel - Detect

Input:
Title: Reposilite Login Panel - Detect
Summary: Reposilite Login Panel - Detect. Reposilite products was detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: reposilite-panel

info:
  name: Reposilite Login Panel - Detect
  author: righettod
  severity: info
  description: Reposilite products was detected.
  tags: panel,reposilite,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: CodeMeter Webadmin Dashboard

Input:
Title: CodeMeter Webadmin Dashboard
Summary: CodeMeter Webadmin Dashboard. CodeMeter Webadmin Dashboard is exposed.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: codemeter-webadmin

info:
  name: CodeMeter Webadmin Dashboard
  author: DhiyaneshDk
  severity: low
  description: CodeMeter Webadmin Dashboard is exposed.
  tags: misconfig,exposure,codemeter,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.html"
    matchers:
      - type: word
        words:
          - "WebAdmin | Dashboard"
          - "CodeMeter"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: ElastiCache Redis In-Transit and At-Rest Encryption - Disabled

Input:
Title: ElastiCache Redis In-Transit and At-Rest Encryption - Disabled
Summary: ElastiCache Redis In-Transit and At-Rest Encryption - Disabled. Ensure that your Amazon ElastiCache Redis cache clusters are encrypted in order to meet security and compliance requirements.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: cache-redis-encryption-disabled

info:
  name: ElastiCache Redis In-Transit and At-Rest Encryption - Disabled
  author: DhiyaneshDK
  severity: high
  description: Ensure that your Amazon ElastiCache Redis cache clusters are encrypted in order to meet security and compliance requirements.
  tags: cloud,devops,aws,amazon,elasticache,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Shopify Access Token (Public App)

Input:
Title: Shopify Access Token (Public App)
Summary: Shopify Access Token (Public App). Tags: file, keys, shopify
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: shopify-public-access

info:
  name: Shopify Access Token (Public App)
  author: DhiyaneshDK
  severity: info
  description: Shopify Access Token (Public App)
  tags: file,keys,shopify,token

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: api-dbt

info:
  name: dbt Cloud API - Test
  author: dwisiswant0
  severity: info
  description: dbt Cloud API test was conducted.
  tags: token-spray,dbt

http:
  - method: GET
    path:
      - "https://cloud.getdbt.com/api/v2/accounts/"
    matchers:
      - type: word
        words:
          - "Invalid token"
          - "Authentication credentials were not provided."
          - "User API Keys are deprecated"
        part: body
        condition: or


Instruction: Generate a Nuclei template for: UserGate NGFW/UTM Admin Panel - Detect

Input:
Title: UserGate NGFW/UTM Admin Panel - Detect
Summary: UserGate NGFW/UTM Admin Panel - Detect. Detect UserGate NGFW/UTM Admin Panel.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: usergate-ngfw-admin-panel

info:
  name: UserGate NGFW/UTM Admin Panel - Detect
  author: darses
  severity: info
  description: Detect UserGate NGFW/UTM Admin Panel.
  tags: detect,panel,usergate,ngfw,utm,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/static/console-utm-webui/js/preinit.js"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - Yandex Social

Input:
Title: Content-Security-Policy Bypass - Yandex Social
Summary: Content-Security-Policy Bypass - Yandex Social. Tags: xss, csp-bypass, yandex-social
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: yandex-social-csp-bypass

info:
  name: Content-Security-Policy Bypass - Yandex Social
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - Yandex Social
  tags: xss,csp-bypass,yandex-social,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "yandex.ru"
        part: header
        condition: and


Instruction: Generate a Nuclei template for CVE-2021-27561

Input:
Title: OS Command Injection in yealink device_management
Summary: Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.
Vulnerability Type: OS Command Injection
Severity: critical
Affected Products: yealink device_management
Indicators: error, vulnerability detected

Output:
id: CVE-2021-27561

info:
  name: YeaLink DM 3.6.0.20 - Remote Command Injection
  author: shifacyclewala,hackergautam
  severity: critical
  description: Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.
  tags: cve2021,cve,rce,yealink,mirai,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/premise/front/getPingData?url=http://0.0.0.0:9600/sm/api/v1/firewall/zone/services?zone=;/usr/bin/id;"
    matchers:
      - type: word
        words:
          - "uid"
          - "gid"
          - "groups"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Zipline - Installer

Input:
Title: Zipline - Installer
Summary: Zipline - Installer. Zipline installer setup was detected.

Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: zipline-installer

info:
  name: Zipline - Installer
  author: pussycat0x
  severity: critical
  description: Zipline installer setup was detected.
  tags: misconfig,setup,zipline,installer,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/setup"
    matchers:
      - type: word
        words:
          - "Setup Zipline"
          - "Configuration"
          - "Create a super-admin account"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-3142

Input:
Title: SQL Injection in basixonline nex-forms
Summary: The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
Vulnerability Type: SQL Injection
Severity: high
Affected Products: basixonline nex-forms
Indicators: error, vulnerability detected

Output:
id: CVE-2022-3142

info:
  name: NEX-Forms Plugin < 7.9.7 - SQL Injection
  author: r3Y3r53
  severity: high
  description: The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
  tags: time-based-sqli,cve,cve2022,wpscan,packetstorm,wordpress,sqli,wp-plugin,wp,authenticated,basixonline,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-3710

Input:
Title: Vulnerability (CWE-20) in honeywell pm43_firmware
Summary: Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).
Vulnerability Type: Vulnerability (CWE-20)
Severity: critical
Affected Products: honeywell pm43_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2023-3710

info:
  name: Honeywell PM43 Printers - Command Injection
  author: win3zz
  severity: critical
  description: Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006)
  tags: cve2023,cve,honeywell,pm43,printer,iot,rce,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: body
      - type: word
        words:
          - "Release date"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: opennebula-panel

info:
  name: OpenNebula Login Panel - Detect
  author: kh4sh3i,darses
  severity: info
  description: OpenNebula login panel was detected.
  tags: panel,opennebula,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>OpenNebula"
          - "OpenNebula Systems"
          - "target="_blank">OpenNebula"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Advantech R-SeeNet Detection

Input:
Title: Advantech R-SeeNet Detection
Summary: Advantech R-SeeNet Detection. Tags: tech, rseenet, discovery
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: rseenet-detect

info:
  name: Advantech R-SeeNet Detection
  author: pdteam
  severity: info
  description: Advantech R-SeeNet Detection
  tags: tech,rseenet,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: regex
        part: body


Instruction: Generate a Nuclei template for CVE-2015-4455

Input:
Title: Unrestricted File Upload in aviary_image_editor_add-on_for_gravity_forms_project aviary_image_editor_add-on_for_gravity_forms
Summary: Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.
Vulnerability Type: Unrestricted File Upload
Severity: critical
Affected Products: aviary_image_editor_add-on_for_gravity_forms_project aviary_image_editor_add-on_for_gravity_forms
Indicators: error, vulnerability detected

Output:
id: CVE-2015-4455

info:
  name: WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload
  author: MaStErChO
  severity: critical
  description: Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.
  tags: cve,cve2015,packetstorm,intrusive,file-upload,wordpress,aviary_image_editor_add-on_for_gravity_forms_project,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Webalizer Statistics Information Disclosure

Input:
Title: Webalizer Statistics Information Disclosure
Summary: Webalizer Statistics Information Disclosure. The remote host is running the Webalizer Report generator. Webalizer parses web logs and gives a potential attacker information regarding hosts that have accessed the server, resources accessed, total statistics for the Web server, version of Web server, and more.

Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: webalizer-statistics

info:
  name: Webalizer Statistics Information Disclosure
  author: 0x_Akoko
  severity: low
  description: The remote host is running the Webalizer Report generator. Webalizer parses web logs and gives a potential attacker information regarding hosts that have accessed the server, resources accessed, total statistics for the Web server, version of Web server, and more.
  tags: webalizer,logs,statistics,tenable,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/stats/index.html"
    matchers:
      - type: word
        words:
          - "Generated by The Webalizer"
          - "Usage Statistics"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Owncloud StatusPage detection

Input:
Title: Owncloud StatusPage detection
Summary: Owncloud StatusPage detection. Tags: tech, owncloud, status
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: owncloud-status-page

info:
  name: Owncloud StatusPage detection
  author: myztique,invisiblethreat
  severity: info
  description: Owncloud StatusPage detection
  tags: tech,owncloud,status,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/status.php"
    matchers:
      - type: word
        words:
          - ""versionstring":"
          - ""installed":"
          - ""edition":"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: Ensure etcd-cafile argument set

Input:
Title: Ensure etcd-cafile argument set
Summary: Ensure etcd-cafile argument set. Checks if the etcd-cafile argument is properly set in the etcd configuration, crucial for secure client connections to etcd.
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: k8s-etcd-cafile-set

info:
  name: Ensure etcd-cafile argument set
  author: princechaddha
  severity: medium
  description: Checks if the etcd-cafile argument is properly set in the etcd configuration, crucial for secure client connections to etcd.
  tags: cloud,devops,kubernetes,devsecops,etcd,k8s,k8s-cluster-security

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: rlogin Service Should Be Disabled

Input:
Title: rlogin Service Should Be Disabled
Summary: rlogin Service Should Be Disabled. Assessed the operational status of the rlogin service on the system.Running rlogin could have allowed unauthorized users to gain access or extract sensitive information, representing a significant security risk.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: linux-rlogin-service

info:
  name: rlogin Service Should Be Disabled
  author: songyaeji
  severity: high
  description: Assessed the operational status of the rlogin service on the system.Running rlogin could have allowed unauthorized users to gain access or extract sensitive information, representing a significant security risk.
  tags: linux,local,audit,kisa,compliance

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Virtual Machine Disk Encryption with Customer-Supplied Keys Not Enabled

Input:
Title: Virtual Machine Disk Encryption with Customer-Supplied Keys Not Enabled
Summary: Virtual Machine Disk Encryption with Customer-Supplied Keys Not Enabled. Ensure that the disks attached to your production Google Compute Engine instances are encrypted with Customer-Supplied Encryption Keys (CSEKs) in order to have complete control over the data-at-rest encryption and decryption process. CSEKs allow you to provide your own encryption keys that Google Compute Engine uses to protect the Google-generated keys used to encrypt and decrypt your instance data.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: gcloud-vm-disk-csek-not-enabled

info:
  name: Virtual Machine Disk Encryption with Customer-Supplied Keys Not Enabled
  author: princechaddha
  severity: high
  description: Ensure that the disks attached to your production Google Compute Engine instances are encrypted with Customer-Supplied Encryption Keys (CSEKs) in order to have complete control over the data-at-rest encryption and decryption process. CSEKs allow you to provide your own encryption keys that Google Compute Engine uses to protect the Google-generated keys used to encrypt and decrypt your instance data.
  tags: cloud,devops,gcp,gcloud,compute,encryption,csek,security,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: BitBucket Client ID

Input:
Title: BitBucket Client ID
Summary: BitBucket Client ID. Tags: bitbucket, exposure, tokens
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: bitbucket-clientid

info:
  name: BitBucket Client ID
  author: DhiyaneshDK
  severity: info
  description: BitBucket Client ID
  tags: bitbucket,exposure,tokens,clientid,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Detect Agentejo Cockpit

Input:
Title: Detect Agentejo Cockpit
Summary: Detect Agentejo Cockpit. Tags: tech, cockpit, discovery
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: cockpit-detect

info:
  name: Detect Agentejo Cockpit
  author: dwisiswant0
  severity: info
  description: Detect Agentejo Cockpit
  tags: tech,cockpit,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/auth/login"
    matchers:
      - type: word
        words:
          - "<title>Authenticate Please!</title>"


Instruction: Generate a Nuclei template for: Hongfan OA ioAssistance.asmx - Remote Code Execution

Input:
Title: Hongfan OA ioAssistance.asmx - Remote Code Execution
Summary: Hongfan OA ioAssistance.asmx - Remote Code Execution. There is a SQL injection vulnerability in Hongfan iOffice 10 Hospital Edition, which can be exploited by attackers to obtain sensitive database information.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: hongfan-ioffice-rce

info:
  name: Hongfan OA ioAssistance.asmx - Remote Code Execution
  author: SleepingBag945
  severity: high
  description: There is a SQL injection vulnerability in Hongfan iOffice 10 Hospital Edition, which can be exploited by attackers to obtain sensitive database information.
  tags: hongfan,oa,sqli,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: body
        condition: or
      - type: word
        words:
          - "text/xml"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2010-3203

Input:
Title: Path Traversal in xmlswf com_picsell
Summary: Directory traversal vulnerability in the PicSell (com_picsell) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the dflink parameter in a prevsell dwnfree action to index.php.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: xmlswf com_picsell
Indicators: error, vulnerability detected

Output:
id: CVE-2010-3203

info:
  name: Joomla! Component PicSell 1.0 - Arbitrary File Retrieval
  author: daffainfo
  severity: medium
  description: A directory traversal vulnerability in the PicSell (com_picsell) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the dflink parameter in a prevsell dwnfree action to index.php.
  tags: cve,cve2010,edb,joomla,lfi,xmlswf,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_picsell&controller=prevsell&task=dwnfree&dflink=../../../configuration.php"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: CoreBos - .htaccess File Exposure

Input:
Title: CoreBos - .htaccess File Exposure
Summary: CoreBos - .htaccess File Exposure. CoreBos was discovered to have .htaccess file exposed to public which includes sensitive information.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: corebos-htaccess

info:
  name: CoreBos - .htaccess File Exposure
  author: arafatansari
  severity: info
  description: CoreBos was discovered to have .htaccess file exposed to public which includes sensitive information.
  tags: exposure,corebos,huntr,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/htaccess.txt"
    matchers:
      - type: word
        words:
          - "Options -Indexes"
          - "<FilesMatch"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Watcher Panel - Detect

Input:
Title: Watcher Panel - Detect
Summary: Watcher Panel - Detect. Tags: panel, watcher, login
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: watcher-panel

info:
  name: Watcher Panel - Detect
  author: DhiyaneshDK
  severity: info
  description: Watcher Panel - Detect
  tags: panel,watcher,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/vsaas/v2/login"
    matchers:
      - type: word
        words:
          - "<title>Watcher</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-8522

Input:
Title: SQL Injection in thimpress learnpress
Summary: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: thimpress learnpress
Indicators: error, vulnerability detected

Output:
id: CVE-2024-8522

info:
  name: LearnPress < 4.2.7.1 - SQL Injection
  author: pdresearch,iamnoooob,rootxharsh
  severity: critical
  description: The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
  tags: time-based-sqli,cve,cve2024,learnpress,sqli,wp,wordpress,wp-plugin,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: amazon-ecs-defualt-page

info:
  name: Amazon ECS Sample App Default Page - Detect
  author: Splint3r7
  severity: info
  description: Amazon ECS Sample App Default Page was detected.
  tags: amazon,tech,default,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Docker Daemon Exposed

Input:
Title: Docker Daemon Exposed
Summary: Docker Daemon Exposed. Docker Daemon exposed on the network map can help remote attacker to gain access to the Docker containers and potentially the host system.

Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: exposed-dockerd

info:
  name: Docker Daemon Exposed
  author: arafatansari
  severity: critical
  description: Docker Daemon exposed on the network map can help remote attacker to gain access to the Docker containers and potentially the host system.
  tags: network,docker,exposure,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: api-vercel

info:
  name: Vercel - API Detection
  author: dwisiswant0
  severity: info
  description: Vercel API was detected.
  tags: token-spray,vercel

http:
  - method: GET
    path:
      - "https://api.vercel.com/www/user"
    matchers:
      - type: word
        words:
          - ""user":"
          - ""username":"
          - ""email":"
        part: body
        condition: and


Instruction: Generate a Nuclei template for CVE-2021-20090

Input:
Title: Path Traversal in buffalo wsr-2533dhpl2-bk_firmware and others
Summary: A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.
Vulnerability Type: Path Traversal
Severity: critical
Affected Products: buffalo wsr-2533dhpl2-bk_firmware, buffalo wsr-2533dhp3-bk_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2021-20091

info:
  name: Buffalo WSR-2533DHPL2 - Configuration File Injection
  author: gy741,pdteam,parth
  severity: high
  description: The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 does not properly sanitize user input. An authenticated remote attacker could leverage this vulnerability to alter device configuration, potentially leading to remote code execution.
  tags: cve2021,cve,buffalo,firmware,iot,tenable,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "/Success.htm"
        part: header
      - type: status
        status:
          - 302


Instruction: Generate a Nuclei template for CVE-2024-2667

Input:
Title: Unrestricted File Upload in instawp instawp_connect
Summary: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to  insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for unauthenticated attackers to upload arbitrary files.
Vulnerability Type: Unrestricted File Upload
Severity: critical
Affected Products: instawp instawp_connect
Indicators: error, vulnerability detected

Output:
id: CVE-2024-2667

info:
  name: InstaWP Connect <= 0.1.0.22 - Unauthenticated Arbitrary File Upload
  author: DhiyaneshDK
  severity: critical
  description: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to  insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for unauthenticated attackers to upload arbitrary files.
  tags: cve,cve2024,wordpress,wp-plugin,wp,instawp-connect,intrusive,file-upload,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""status":true"
          - ""message":"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Disbale Nginx Server Tokens

Input:
Title: Disbale Nginx Server Tokens
Summary: Disbale Nginx Server Tokens. Detects if 'server_tokens' is enabled in Nginx, which can reveal version information.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: file-disable-nginx-server-tokens

info:
  name: Disbale Nginx Server Tokens
  author: pussycat0x
  severity: medium
  description: Detects if 'server_tokens' is enabled in Nginx, which can reveal version information.
  tags: audit,nginx,file,hardening

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: total-web-solutions-panel

info:
  name: Total Web Solutions Panel - Detect
  author: dhiyaneshDK
  severity: info
  description: Total Web Solutions panel was detected.
  tags: panel,edb,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Total Web Solutions</title>"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: trendnet-tew827dru-login

info:
  name: TRENDnet TEW-827DRU Login Panel - Detect
  author: princechaddha
  severity: info
  description: TRENDnet TEW-827DRU login panel was detected.
  tags: panel,router,trendnet,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "var model = "TEW-827DRU";"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-48023

Input:
Title: Vulnerability (CWE-918) in anyscale ray
Summary: Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment
Vulnerability Type: Vulnerability (CWE-918)
Severity: critical
Affected Products: anyscale ray
Indicators: error, vulnerability detected

Output:
id: CVE-2023-48023

info:
  name: Anyscale Ray 2.6.3 and 2.8.0 - Server-Side Request Forgery
  author: cookiehanhoan,harryha
  severity: critical
  description: The Ray Dashboard API is affected by a Server-Side Request Forgery (SSRF) vulnerability in the url parameter of the /log_proxy API endpoint. The API does not perform sufficient input validation within the affected parameter and any HTTP or HTTPS URLs are accepted as valid.
  tags: cve,cve2023,ssrf,ray,anyscale,Anyscale,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/log_proxy?url=http://{{interactsh-url}}"
    matchers:
      - type: word
        words:
          - "dns"
        part: interactsh_protocol
      - type: word
        words:
          - "<h1> Interactsh Server </h1>"
        part: body


Instruction: Generate a Nuclei template for CVE-2013-0156

Input:
Title: Vulnerability (CWE-20) in rubyonrails rails and others
Summary: active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Vulnerability Type: Vulnerability (CWE-20)
Severity: high
Affected Products: rubyonrails rails, rubyonrails ruby_on_rails, debian debian_linux
Indicators: error, vulnerability detected

Output:
id: infoblox-netmri-rails-cookie-rce

info:
  name: Infoblox NetMRI < 7.6.1 - Remote Code Execution via Hardcoded Ruby Cookie Secret Key
  author: iamnoooob,pdresearch
  severity: critical
  description: Infoblox NetMRI virtual appliances before version 7.6.1 are vulnerable to remote code execution (RCE) due to the use of a hardcoded Ruby on Rails session cookie secret key. The Rails web component deserializes session cookies if the signing key is valid. Attackers with knowledge of this key can craft malicious session cookies that are deserialized by the application, leading to arbitrary code execution. This vulnerability is related to the known Ruby on Rails deserialization flaw (CVE-2013-0156). Infoblox did not assign a new CVE for this issue, as it is a result of the underlying Rails vulnerability.
  tags: infoblox,netmri,rails,rce,deserialization,oast,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2022-41473

Input:
Title: Cross-Site Scripting (XSS) in rpcms rpcms
Summary: RPCMS v3.0.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Search function.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: rpcms rpcms
Indicators: error, vulnerability detected

Output:
id: CVE-2022-41473

info:
  name: RPCMS 3.0.2 - Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: RPCMS 3.0.2 contains a cross-site scripting vulnerability in the Search function. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: cve,cve2022,rpcms,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/search/?q=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "<script>alert(document.domain)</script>"
          - "rpcms"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: hospital-management-panel

info:
  name: Hospital Management System Login Panel - Detect
  author: arafatansari
  severity: info
  description: Hospital Management System login panel was detected.
  tags: panel,hms,cms,hospital_management_system_project,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.html"
    matchers:
      - type: word
        words:
          - "Hospital Management System"
          - "Doctors Login"
          - "Admin Login"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Softr.io Takeover Detection

Input:
Title: Softr.io Takeover Detection
Summary: Softr.io Takeover Detection. Tags: takeover, softr, vuln
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: softr-takeover

info:
  name: Softr.io Takeover Detection
  author: philippedelteil
  severity: high
  description: Softr.io Takeover Detection
  tags: takeover,softr,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
      - type: word
        words:
          - "The application you were looking for was built on Softr"
          - "Get started with Softr"
        condition: and
      - type: status
        status:
          - 404


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: soup

info:
  name: Soup User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Soup user name information check was conducted.
  tags: osint,osint-blog,soup,discovery

http:
  - method: GET
    path:
      - "https://www.soup.io/author/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Author at Soup.io"
        part: body


Instruction: Generate a Nuclei template for: Blackbox Exporter Metrics Exposed

Input:
Title: Blackbox Exporter Metrics Exposed
Summary: Blackbox Exporter Metrics Exposed. Tags: blackbox, exposure, debug
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: blackbox-exporter-metrics

info:
  name: Blackbox Exporter Metrics Exposed
  author: DhiyaneshDk
  severity: info
  description: Blackbox Exporter Metrics Exposed
  tags: blackbox,exposure,debug,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/metrics"
    matchers:
      - type: word
        words:
          - "Blackbox exporter"
          - "blackbox_exporter_build_info"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Max Mega Menu Detection

Input:
Title: Max Mega Menu Detection
Summary: Max Mega Menu Detection. Tags: tech, wordpress, wp-plugin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-megamenu

info:
  name: Max Mega Menu Detection
  author: ricardomaia
  severity: info
  description: Max Mega Menu Detection
  tags: tech,wordpress,wp-plugin,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/megamenu/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: hackerearth

info:
  name: Hackerearth User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Hackerearth user name information check was conducted.
  tags: osint,osint-coding,hackerearth,discovery

http:
  - method: GET
    path:
      - "https://www.hackerearth.com/@{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "| Developer Profile on HackerEarth"
        part: body


Instruction: Generate a Nuclei template for: Discover wp-app.log Files

Input:
Title: Discover wp-app.log Files
Summary: Discover wp-app.log Files. wp-app.log file is exposed.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wp-app-log

info:
  name: Discover wp-app.log Files
  author: geeknik
  severity: info
  description: wp-app.log file is exposed.
  tags: exposure,logs,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-app.log"
    matchers:
      - type: word
        words:
          - "LANG"
          - "Array"
        condition: and
      - type: word
        words:
          - "text/html"
          - "application/javascript"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-24210

Input:
Title: Vulnerability (CWE-601) in kiboit phastpress
Summary: There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request to a page with the plugin and then redirect the victim to a malicious page. There is also a support comment from another user one year ago (https://wordpress.org/support/topic/phast-php-used-for-remote-fetch/) that says that the php involved in the request only go to whitelisted pages but it's possible to redirect the victim to any domain.
Vulnerability Type: Vulnerability (CWE-601)
Severity: medium
Affected Products: kiboit phastpress
Indicators: error, vulnerability detected

Output:
id: CVE-2021-24210

info:
  name: WordPress PhastPress <1.111 - Open Redirect
  author: 0x_Akoko
  severity: medium
  description: WordPress PhastPress plugin before 1.111 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: cve2021,cve,redirect,wpscan,wordpress,kiboit,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/phastpress/phast.php?service=scripts&src=https%3A%2F%2Finteract.sh"
    matchers:
      - type: regex
        part: header


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - Crisp Client

Input:
Title: Content-Security-Policy Bypass - Crisp Client
Summary: Content-Security-Policy Bypass - Crisp Client. Tags: xss, csp-bypass, crisp-client
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: crisp-client-csp-bypass

info:
  name: Content-Security-Policy Bypass - Crisp Client
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - Crisp Client
  tags: xss,csp-bypass,crisp-client,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "crisp.chat"
        part: header
        condition: and


Instruction: Generate a Nuclei template for: Loxone WebInterface Panel - Detect

Input:
Title: Loxone WebInterface Panel - Detect
Summary: Loxone WebInterface Panel - Detect. Tags: panel, login, loxone
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: loxone-web-panel

info:
  name: Loxone WebInterface Panel - Detect
  author: DhiyaneshDk
  severity: info
  description: Loxone WebInterface Panel - Detect
  tags: panel,login,loxone,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Webinterface</title>"
          - "loxone"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: CSV Injection Detection

Input:
Title: CSV Injection Detection
Summary: CSV Injection Detection. A CSV injection detection template to identify and prevent CSV injection vulnerabilities by using various payloads that could be interpreted as formulas by spreadsheet applications.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: csv-injection

info:
  name: CSV Injection Detection
  author: DhiyaneshDK,ritikchaddha
  severity: medium
  description: A CSV injection detection template to identify and prevent CSV injection vulnerabilities by using various payloads that could be interpreted as formulas by spreadsheet applications.
  tags: dast,csv,oast,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol
      - type: word
        words:
          - "text/csv"
          - "application/csv"
          - "application/vnd.ms-excel"
        part: header


Instruction: Generate a Nuclei template for: Lucee < 6.0.1.59 - Remote Code Execution

Input:
Title: Lucee < 6.0.1.59 - Remote Code Execution
Summary: Lucee < 6.0.1.59 - Remote Code Execution. Tags: lucee, rce, oast
Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: lucee-rce

info:
  name: Lucee < 6.0.1.59 - Remote Code Execution
  author: rootxharsh,iamnoooob,pdresearch
  severity: critical
  description: Lucee < 6.0.1.59 - Remote Code Execution
  tags: lucee,rce,oast,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-1020

Input:
Title: Unknown Vulnerability in wp_live_chat_shoutbox_project wp_live_chat_shoutbox
Summary: The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Vulnerability Type: Unknown Vulnerability
Severity: critical
Affected Products: wp_live_chat_shoutbox_project wp_live_chat_shoutbox
Indicators: error, vulnerability detected

Output:
id: CVE-2023-1020

info:
  name: Steveas WP Live Chat Shoutbox <= 1.4.2 - SQL Injection
  author: theamanrawat
  severity: critical
  description: The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
  tags: cve2023,cve,wpscan,sqli,wordpress,wp-plugin,wp,wp-shoutbox-live-chat,wp_live_chat_shoutbox_project,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "c8c605999f3d8352d7bb792cf3fdb25b"
          - "no_participation"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-25296

Input:
Title: Unknown Vulnerability in nagios nagios_xi
Summary: Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.
Vulnerability Type: Unknown Vulnerability
Severity: high
Affected Products: nagios nagios_xi
Indicators: error, vulnerability detected

Output:
id: CVE-2021-25296

info:
  name: Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection
  author: k0pak4
  severity: high
  description: Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php. This in turn can lead to remote code execution, by which an attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  tags: cve,cve2021,packetstorm,rce,oast,authenticated,msf,nagiosxi,kev,nagios,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "dns"
        part: interactsh_protocol
      - type: word
        words:
          - "Event Log"
          - "Display Name"
        part: body_4
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: panos-management-panel

info:
  name: PAN-OS Management Panel - Detect
  author: bhutch
  severity: info
  description: PAN-OS management panel was detected.
  tags: panel,panos,login,detect,paloaltonetworks,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/php/login.php"
    matchers:
      - type: word
        words:
          - "<TITLE>Login</TITLE>"
          - "PAN_FORM_CONTENT"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: allied-telesis-login

info:
  name: Allied Telesis Device GUI Login Panel - Detect
  author: prajiteshsingh
  severity: info
  description: Allied Telesis Device GUI login panel was detected.
  tags: panel,allied,allied_telesis,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/public/login.html"
    matchers:
      - type: word
        words:
          - "<title>Allied Telesis Device GUI</title>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2019-20141

Input:
Title: Cross-Site Scripting (XSS) in laborator neon
Summary: An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: laborator neon
Indicators: error, vulnerability detected

Output:
id: CVE-2019-20141

info:
  name: WordPress Laborator Neon Theme 2.0 - Cross-Site Scripting
  author: knassar702
  severity: medium
  description: WordPress Laborator Neon theme 2.0 contains a cross-site scripting vulnerability via the data/autosuggest-remote.php q parameter.
  tags: cve2019,cve,xss,laborator,wordpress,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/data/autosuggest-remote.php?q="><img%20src=x%20onerror=alert(1)>"
      - "{{BaseURL}}/admin/data/autosuggest-remote.php?q="><img%20src=x%20onerror=alert(1)>"
    matchers:
      - type: word
        words:
          - "><img src=x onerror=alert(1)>>)1(trela=rorreno"
        part: body
      - type: word
        words:
          - "text/html"
        part: header


Instruction: Generate a Nuclei template for: AutoLogon Enabled

Input:
Title: AutoLogon Enabled
Summary: AutoLogon Enabled. Checks if automatic logon is enabled, allowing users to bypass login prompts.
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: auto-logon-enabled

info:
  name: AutoLogon Enabled
  author: princechaddha
  severity: medium
  description: Checks if automatic logon is enabled, allowing users to bypass login prompts.
  tags: autologon,login,code,windows-audit

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Account Lockout Threshold Check

Input:
Title: Account Lockout Threshold Check
Summary: Account Lockout Threshold Check. Ensure the account lockout threshold is configured to 5 or fewer invalid login attempts to reduce the risk of brute-force attacks.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: account-lockout-threshold

info:
  name: Account Lockout Threshold Check
  author: nukunga[SungHyunJeon]
  severity: medium
  description: Ensure the account lockout threshold is configured to 5 or fewer invalid login attempts to reduce the risk of brute-force attacks.
  tags: account-management,code,windows-audit,kisa

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: udemy

info:
  name: Udemy User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Udemy user name information check was conducted.
  tags: osint,osint-tech,udemy,discovery

http:
  - method: GET
    path:
      - "https://www.udemy.com/user/{{user}}/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "| Udemy</title>"
        part: body


Instruction: Generate a Nuclei template for CVE-2025-27892

Input:
Title: SQL Injection in shopware shopware
Summary: Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE: this issue exists because of a CVE-2024-22406 and CVE-2024-42357 regression.
Vulnerability Type: SQL Injection
Severity: medium
Affected Products: shopware shopware
Indicators: error, vulnerability detected

Output:
id: CVE-2025-27892

info:
  name: Shopware < 6.5.8.13 - SQL Injection
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the "aggregations" object. The name field in this "aggregations" in nested object is vulnerable SQL-injection and can be exploited using SQL parameters.
  tags: cve,cve2025,shopware,sqli,time-based-sqli,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2000-0760

Input:
Title: Unknown Vulnerability in apache tomcat
Summary: The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.
Vulnerability Type: Unknown Vulnerability
Severity: medium
Affected Products: apache tomcat
Indicators: error, vulnerability detected

Output:
id: tomcat-snoop-servlet-exposed

info:
  name: Apache Tomcat - Snoop Servlet Information Disclosure
  author: Thabisocn
  severity: info
  description: The Snoop servlet is exposed in the Apache Tomcat examples directory.
  tags: apache,jakarta,tomcat,exposure,info-leak,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/examples/jsp/snp/snoop.jsp"
    matchers:
      - type: word
        words:
          - "Request Information"
          - "Path info"
          - "Server name"
          - "Remote address"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: kibana-panel

info:
  name: Kibana Login Panel - Detect
  author: petruknisme,daffainfo,c-sh0
  severity: info
  description: Kibana login panel was detected.
  tags: panel,kibana,elastic,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/login"
      - "{{BaseURL}}/app/kibana"
    matchers:
      - type: word
        words:
          - "<title>Kibana</title>"
          - "<title>Elastic</title>"
          - "<title>Kibana Login</title>"
        part: body
        condition: or
      - type: regex
        part: header


Instruction: Generate a Nuclei template for CVE-2022-40881

Input:
Title: Vulnerability (CWE-77) in contec solarview_compact_firmware
Summary: SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php
Vulnerability Type: Vulnerability (CWE-77)
Severity: critical
Affected Products: contec solarview_compact_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2022-40881

info:
  name: SolarView 6.00 - Remote Command Execution
  author: For3stCo1d
  severity: critical
  description: SolarView Compact 6.00 is vulnerable to a command injection via network_test.php.
  tags: cve,cve2022,solarview,rce,lfi,contec,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-42852

Input:
Title: Cross-Site Scripting (XSS) in CVE-2024-42852
Summary: Cross Site Scripting vulnerability in AcuToWeb server v.10.5.0.7577C8b allows a remote attacker to execute arbitrary code via the index.php component.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Indicators: error, vulnerability detected

Output:
id: CVE-2024-42852

info:
  name: AcuToWeb server/10.5.0.7577c8b - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: AcuToWeb server/10.5.0.7577c8b is vulnerable to reflected cross-site scripting (XSS) via the portgw parameter. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.
  tags: cve,cve2024,xss,acutoweb,opentext,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?portgw=80089948;%20alert(document.domain)"
    matchers:
      - type: word
        words:
          - "80089948; alert(document.domain);"
          - "WT_GW_PORT"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-4375

Input:
Title: Vulnerability (CWE-707) in mingsoft mcms
Summary: A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215196.
Vulnerability Type: Vulnerability (CWE-707)
Severity: medium
Affected Products: mingsoft mcms
Indicators: error, vulnerability detected

Output:
id: CVE-2022-4375

info:
  name: Mingsoft MCMS - SQL Injection
  author: ritikchaddha
  severity: critical
  description: SQL injection vulnerability in Mingsoft MCMS up to 5.2.9 via the sqlWhere parameter in /cms/category/list.
  tags: cve,cve2022,mingsoft,mcms,sqli,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "mingsoft.net"
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "java.sql.SQLSyntaxErrorException"
          - "java.sql.SQLException"
        part: body
        condition: or
      - type: word
        words:
          - "Icategorydao.xml"
          - "cms_category"
        part: body
        condition: or
      - type: status
        status:
          - 500


Instruction: Generate a Nuclei template for: OpenMetadata - Default Login

Input:
Title: OpenMetadata - Default Login
Summary: OpenMetadata - Default Login. OpenMetadata server enables default admin credentials. An attacker can execute unauthorized operations.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: openmetadata-default-login

info:
  name: OpenMetadata - Default Login
  author: icarot
  severity: high
  description: OpenMetadata server enables default admin credentials. An attacker can execute unauthorized operations.
  tags: openmetadata,default-login,misconfig,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""accessToken":"
          - ""refreshToken":"
          - ""expiryDuration":"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: FileZilla FTP Service - Detect

Input:
Title: FileZilla FTP Service - Detect
Summary: FileZilla FTP Service - Detect. FileZilla FTP service was detected.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: filezilla-ftp-detect

info:
  name: FileZilla FTP Service - Detect
  author: pussycat0x
  severity: info
  description: FileZilla FTP service was detected.
  tags: network,ftp,filezilla,detect,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Apache Answer - Detection

Input:
Title: Apache Answer - Detection
Summary: Apache Answer - Detection. Detects Apache Answer version through API endpoit

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: apache-answer-detect

info:
  name: Apache Answer - Detection
  author: omranisecurity
  severity: info
  description: Detects Apache Answer version through API endpoit
  tags: detect,tech,apache,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/answer/api/v1/siteinfo"
    matchers:
      - type: word
        words:
          - ""code":"
        part: body
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: WordPress Video Gallery <= 2.8 - SQL Injection

Input:
Title: WordPress Video Gallery <= 2.8 - SQL Injection
Summary: WordPress Video Gallery <= 2.8 - SQL Injection. The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection.

Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: contus-video-gallery-sqli

info:
  name: WordPress Video Gallery <= 2.8 - SQL Injection
  author: theamanrawat
  severity: critical
  description: The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection.
  tags: sqli,wpscan,wordpress,contus-video-gallery,unauth,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "c8c605999f3d8352d7bb792cf3fdb25b"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Smush Image Optimization – Optimize Images | Compress & Lazy Load Images | Convert WebP & AVIF | Image CDN Detection

Input:
Title: Smush Image Optimization – Optimize Images | Compress & Lazy Load Images | Convert WebP & AVIF | Image CDN Detection
Summary: Smush Image Optimization – Optimize Images | Compress & Lazy Load Images | Convert WebP & AVIF | Image CDN Detection
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-wp-smushit

info:
  name: Smush Image Optimization – Optimize Images | Compress & Lazy Load Images | Convert WebP & AVIF | Image CDN Detection
  author: ricardomaia
  severity: info
  description: Smush Image Optimization – Optimize Images | Compress & Lazy Load Images | Convert WebP & AVIF | Image CDN Detection
  tags: tech,wordpress,wp-plugin,top-100,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/wp-smushit/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: adobe-media-server

info:
  name: Adobe Media Server Login Panel
  author: dhiyaneshDK
  severity: info
  description: An Adobe Media Server login panel was detected.
  tags: panel,adobe,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Adobe Media Server</title>"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-1661

Input:
Title: Path Traversal in pluginus husky_-_products_filter_professional_for_woocommerce
Summary: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Vulnerability Type: Path Traversal
Severity: critical
Affected Products: pluginus husky_-_products_filter_professional_for_woocommerce
Indicators: error, vulnerability detected

Output:
id: CVE-2025-1661

info:
  name: HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
  tags: cve,cve2025,woocommerce-products-filter,wordpress,wp-plugin,wp,woocommerce,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2022-0189

Input:
Title: Cross-Site Scripting (XSS) in wprssaggregator wp_rss_aggregator
Summary: The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: wprssaggregator wp_rss_aggregator
Indicators: error, vulnerability detected

Output:
id: CVE-2022-0189

info:
  name: WordPress RSS Aggregator < 4.20 - Authenticated Cross-Site Scripting
  author: DhiyaneshDK
  severity: medium
  description: WordPress RSS Aggregator < 4.20 is susceptible to cross-site scripting. The plugin does not sanitize and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to reflected cross-site scripting.
  tags: cve,cve2022,wpscan,wordpress,xss,wp-plugin,authenticated,wprssaggregator,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<img src onerror=alert(`document.domain`)>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: OpenSign Login Panel - Detect

Input:
Title: OpenSign Login Panel - Detect
Summary: OpenSign Login Panel - Detect. OpenSign Login panel was discovered.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: opensign-panel

info:
  name: OpenSign Login Panel - Detect
  author: righettod
  severity: info
  description: OpenSign Login panel was discovered.
  tags: panel,opensign,login,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/locales/en/translation.json"
      - "{{BaseURL}}/"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: TFTP Service Should Be Disabled

Input:
Title: TFTP Service Should Be Disabled
Summary: TFTP Service Should Be Disabled. The tftp service was rarely needed and contained known vulnerabilities that could have been targeted by attackers.It was checked to confirm that the tftp service was properly disabled in the xinetd configuration.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: tftp-service-enabled

info:
  name: TFTP Service Should Be Disabled
  author: songyaeji
  severity: info
  description: The tftp service was rarely needed and contained known vulnerabilities that could have been targeted by attackers.It was checked to confirm that the tftp service was properly disabled in the xinetd configuration.
  tags: linux,local,code,audit,compliance,kisas

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-26793

Input:
Title: Vulnerability (CWE-1393) in CVE-2025-26793
Summary: The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents' PII. NOTE: the Supplier's perspective is that the "vulnerable systems are not following manufacturers' recommendations to change the default password."
Vulnerability Type: Vulnerability (CWE-1393)
Severity: medium
Indicators: error, vulnerability detected

Output:
id: CVE-2025-26793

info:
  name: FREEDOM Administration - Default Login
  author: Eric Daigle,DhiyaneshDK
  severity: critical
  description: The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents' PII. NOTE- the Supplier's perspective is that the "vulnerable systems are not following manufacturers' recommendations to change the default password."
  tags: cve,cve2025,freedom,admin,mesh,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Administration: Controlled Areas"
          - "Log Out"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Disable SSH Root Login

Input:
Title: Disable SSH Root Login
Summary: Disable SSH Root Login. Disabling direct root login can help prevent unauthorized users from gaining full control over your system.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: file-disable-root-login

info:
  name: Disable SSH Root Login
  author: pussycat0x
  severity: info
  description: Disabling direct root login can help prevent unauthorized users from gaining full control over your system.
  tags: audit,config,file,ssh

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: wago-plc-panel

info:
  name: WAGO PLC Panel - Detect
  author: github.com/its0x08
  severity: info
  description: WAGO PLC panel was detected.
  tags: panel,wago,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/plc/webvisu.htm"
    matchers:
      - type: word
        words:
          - "<TITLE>CoDeSys WebVisualization</TITLE>"
          - "webvisu.jar,minml.jar"
        part: body
        condition: or
      - type: word
        words:
          - "WAGO_Webs"
        part: header


Instruction: Generate a Nuclei template for CVE-2024-21633

Input:
Title: Path Traversal in apktool apktool
Summary: Apktool is a tool for reverse engineering Android APK files. In versions 2.9.1 and prior, Apktool infers resource files' output path according to their resource names which can be manipulated by attacker to place files at desired location on the system Apktool runs on. Affected environments are those in which an attacker may write/overwrite any file that user has write access, and either user name is known or cwd is under user folder. Commit d348c43b24a9de350ff6e5bd610545a10c1fc712 contains a patch for this issue.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: apktool apktool
Indicators: error, vulnerability detected

Output:
id: CVE-2024-21633

info:
  name: MobSF - Path Traversal
  author: Will Mccardell
  severity: high
  description: MobSF is vulnerable to an issue with apktool (CVE-2024-21633) that allows for RCE or arbitrary file writing. It does this through a path traversal vulnerability. This template tests for it by writing to a local file and reading that file. RCE can be achieved by overwriting jadx, as shown in the two POCs listed as references. The payload for this template exists inside the binary format of an APK, which is a zip file. This means that a hardcoded random hex string is checked for, rather than a standard dynamic random string.
  tags: cve,cve2024,mobsf,intrusive,rce,lfi,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "4acbfc74a3002cecf92e81c2a9ac75ada8acabf8f7b40706c5667efbd33be8450d67a3f2f7234f0cd3873de5fee64643d4bd5ed23a1f2c295c7ea0dabcb522ca420f2d91afcfe5b62708c9b90d51dc4ae5a81d7f2ea1befafa31920565074032a2775427dfffe63e97d46e89bcec3cd7ca81411609d98a5c4b1264db69bfe76c"
        part: body_4
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Jeecg Boot Swagger Bootstrap UI - Detect

Input:
Title: Jeecg Boot Swagger Bootstrap UI - Detect
Summary: Jeecg Boot Swagger Bootstrap UI - Detect. Jeecg Swagger Bootstrap UI exposed.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: jeecg-boot-swagger

info:
  name: Jeecg Boot Swagger Bootstrap UI - Detect
  author: ritikchaddha
  severity: info
  description: Jeecg Swagger Bootstrap UI exposed.
  tags: jeecg,swagger,detect,exposure,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/jeecg-boot/"
    matchers:
      - type: word
        words:
          - "<title>Swagger-Bootstrap-UI</title>"
        part: body


Instruction: Generate a Nuclei template for: SOPlanning - Default Login

Input:
Title: SOPlanning - Default Login
Summary: SOPlanning - Default Login. SOPlanning contains default credentials. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: soplanning-default-login

info:
  name: SOPlanning - Default Login
  author: s4e-io
  severity: high
  description: SOPlanning contains default credentials. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.
  tags: soplanning,default-login,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "title="Logout""
          - "title="Modify my profile""
          - "Settings"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Azure Public IP Create/Update Alert Not Configured

Input:
Title: Azure Public IP Create/Update Alert Not Configured
Summary: Azure Public IP Create/Update Alert Not Configured. Ensure that activity log alerts are used to detect "Create or Update Public IP Address" events within your Microsoft Azure cloud account. An activity log alert gets activated when a new activity log event that matches the condition specified in the alert occurs.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: azure-public-ip-update-unalerted

info:
  name: Azure Public IP Create/Update Alert Not Configured
  author: princechaddha
  severity: high
  description: Ensure that activity log alerts are used to detect "Create or Update Public IP Address" events within your Microsoft Azure cloud account. An activity log alert gets activated when a new activity log event that matches the condition specified in the alert occurs.
  tags: cloud,devops,azure,microsoft,public-ip,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200