Instruction: Generate a Nuclei template for: Salesforce Tableau Server - Detect

Input:
Title: Salesforce Tableau Server - Detect
Summary: Salesforce Tableau Server - Detect. Detects Salesforce Tableau Server and extracts the buildid.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: tableau-server-detect

info:
  name: Salesforce Tableau Server - Detect
  author: TechbrunchFR,aringo
  severity: info
  description: Detects Salesforce Tableau Server and extracts the buildid.
  tags: tech,detect,tableau,salesforce,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "X-Tableau: Tableau Server"
          - "Server: Tableau"
        part: header
        condition: or
      - type: word
        words:
          - "VizPortalRun"
          - "vizportal"
        part: body
        condition: or


Instruction: Generate a Nuclei template for: SpaceLogic C-Bus Home Panel - Detect

Input:
Title: SpaceLogic C-Bus Home Panel - Detect
Summary: SpaceLogic C-Bus Home Panel - Detect. Tags: panel, spacelogic, login
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: spacelogic-cbus-panel

info:
  name: SpaceLogic C-Bus Home Panel - Detect
  author: ritikchaddha
  severity: info
  description: SpaceLogic C-Bus Home Panel - Detect
  tags: panel,spacelogic,login,schneider-electric,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>SpaceLogic C-Bus Home</title>"
          - "content="SpaceLogic C-Bus Home"
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Unrestricted Upload of File with Dangerous Type

Input:
Title: Unrestricted Upload of File with Dangerous Type (CWE-434)
Summary: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Vulnerability Type: Unrestricted Upload of File with Dangerous Type
Severity: high
Indicators: vulnerability detected, error

Output:
id: roxyfileman-fileupload

info:
  name: Roxy Fileman 1.4.4 - Arbitrary File Upload
  author: DhiyaneshDK
  severity: high
  description: Roxy Fileman 1.4.4 is susceptible to remote code execution via the FORBIDDEN_UPLOADS setting, which is checked when renaming an existing file to a new file extension. An attacker can bypass this check and rename already uploaded files to any extension using the move function, which does not perform any checks.
  tags: misconfig,edb,roxy,fileman,rce,fileupload,intrusive,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-1698

Input:
Title: OS Command Injection in wago compact_controller_100_firmware and others
Summary: In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise.
Vulnerability Type: OS Command Injection
Severity: critical
Affected Products: wago compact_controller_100_firmware, wago edge_controller_firmware, wago pfc100_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2023-1698

info:
  name: WAGO - Remote Command Execution
  author: xianke
  severity: critical
  description: In multiple products of WAGO, a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behavior, Denial of Service, and full system compromise.
  tags: cve2023,cve,wago,rce,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""license":"
          - ""name":"
          - "uid="
          - "gid="
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2018-11133

Input:
Title: Cross-Site Scripting (XSS) in quest kace_system_management_appliance
Summary: The 'fmt' parameter of the '/common/run_cross_report.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to cross-site scripting.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: quest kace_system_management_appliance
Indicators: error, vulnerability detected

Output:
id: CVE-2018-11133

info:
  name: Quest KACE SMA /common/run_cross_report.php 'fmt' XSS
  author: iamnoooob,pdresearch
  severity: medium
  description: The 'fmt' parameter of the '/common/run_cross_report.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to cross-site scripting.
  tags: cve,cve2018,xss,quest,kace,sma,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "xls34403');alert(document.domain)//952');"
          - "k-run-report-message"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Security Center Plan - Disabled

Input:
Title: Security Center Plan - Disabled
Summary: Security Center Plan - Disabled. Ensure your Alibaba Cloud Security Center is on the Advanced or Enterprise Edition for enhanced security features like malware detection, webshell identification, and anomaly recognition. Upgrading provides critical protection against undetected threats.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: security-plan-disabled

info:
  name: Security Center Plan - Disabled
  author: DhiyaneshDK
  severity: medium
  description: Ensure your Alibaba Cloud Security Center is on the Advanced or Enterprise Edition for enhanced security features like malware detection, webshell identification, and anomaly recognition. Upgrading provides critical protection against undetected threats.
  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,security-center

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: kwejkpl

info:
  name: Kwejk.pl User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Kwejk.pl user name information check was conducted.
  tags: osint,osint-images,kwejkpl,discovery

http:
  - method: GET
    path:
      - "https://kwejk.pl/uzytkownik/{{user}}#/tablica/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Kwejki użytkownika"
        part: body


Instruction: Generate a Nuclei template for: Jira Unauthenticated Installed gadgets

Input:
Title: Jira Unauthenticated Installed gadgets
Summary: Jira Unauthenticated Installed gadgets. Some Jira instances allow to read the installed gadgets (sometimes it's also possible to read config xml file for some gadgets)
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: jira-unauthenticated-installed-gadgets

info:
  name: Jira Unauthenticated Installed gadgets
  author: philippedelteil
  severity: info
  description: Some Jira instances allow to read the installed gadgets (sometimes it's also possible to read config xml file for some gadgets)
  tags: atlassian,jira,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/rest/config/1.0/directory"
    matchers:
      - type: word
        words:
          - "jaxbDirectoryContents"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: mastodon-polsocial

info:
  name: Mastodon-pol.social User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Mastodon-pol.social user name information check was conducted.
  tags: osint,osint-social,mastodon-polsocial,discovery

http:
  - method: GET
    path:
      - "https://pol.social/@{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "@pol.social"
        part: body


Instruction: Generate a Nuclei template for: MongoD Server - Exposure

Input:
Title: MongoD Server - Exposure
Summary: MongoD Server - Exposure. Tags: mongod, exposure, info-leak
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: mongod-exposure

info:
  name: MongoD Server - Exposure
  author: DhiyaneshDk
  severity: low
  description: MongoD Server - Exposure
  tags: mongod,exposure,info-leak,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<title>mongod"
          - "List all commands"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Open Journal Systems Installer - Exposure

Input:
Title: Open Journal Systems Installer - Exposure
Summary: Open Journal Systems Installer - Exposure. Open Journal Systems is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: ojs-installer

info:
  name: Open Journal Systems Installer - Exposure
  author: DhiyaneshDK
  severity: high
  description: Open Journal Systems is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,ojs,install,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index/install"
      - "{{BaseURL}}/index.php/index/install"
    matchers:
      - type: word
        words:
          - "OJS Installation"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2019-2578

Input:
Title: Unknown Vulnerability in oracle webcenter_sites
Summary: Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
Vulnerability Type: Unknown Vulnerability
Severity: high
Affected Products: oracle webcenter_sites
Indicators: unauthorized

Output:
id: CVE-2019-2578

info:
  name: Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control
  author: leovalcante
  severity: high
  description: Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 suffers from broken access control. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data.
  tags: cve,cve2019,oracle,wcs,auth-bypass,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: geo-webserver-detect

info:
  name: GeoWebServer Detector Panel - Detect
  author: dhiyaneshDK,daffainfo
  severity: info
  description: GeoWebServer Detector panel was detected.
  tags: panel,geowebserver,tech,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<TITLE>GeoWebServer</TITLE>"


Instruction: Generate a Nuclei template for CVE-2022-2733

Input:
Title: Cross-Site Scripting (XSS) in open-emr openemr
Summary: Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: open-emr openemr
Indicators: error, vulnerability detected

Output:
id: CVE-2022-2733

info:
  name: Openemr < 7.0.0.1 - Cross-Site Scripting
  author: ctflearner
  severity: medium
  description: Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.
  tags: cve,cve2022,xss,openemr,authenticated,huntr,open-emr,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<img src=a onerror=alert(document.cookie)>"
          - "pricelevel"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Minimize container added capabilities

Input:
Title: Minimize container added capabilities
Summary: Minimize container added capabilities. Checks for containers in Kubernetes Deployments with added capabilities beyond the default set, increasing security risks.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: minimize-added-capabilities

info:
  name: Minimize container added capabilities
  author: princechaddha
  severity: high
  description: Checks for containers in Kubernetes Deployments with added capabilities beyond the default set, increasing security risks.
  tags: cloud,devops,kubernetes,k8s,devsecops,deployments,k8s-cluster-security

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Drupal Security Checks

Input:
Title: Drupal Security Checks
Summary: Drupal Security Checks. A simple workflow that runs all drupal related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: drupal-workflow

info:
  name: Drupal Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all drupal related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - Adobe Campaign

Input:
Title: Content-Security-Policy Bypass - Adobe Campaign
Summary: Content-Security-Policy Bypass - Adobe Campaign. Tags: xss, csp-bypass, adobe-campaign
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: adobe-campaign-csp-bypass

info:
  name: Content-Security-Policy Bypass - Adobe Campaign
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - Adobe Campaign
  tags: xss,csp-bypass,adobe-campaign,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "adobe.com"
        part: header
        condition: and


Instruction: Generate a Nuclei template for: User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds Detection

Input:
Title: User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds Detection
Summary: User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds Detection
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-userfeedback-lite

info:
  name: User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds Detection
  author: ricardomaia
  severity: info
  description: User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds Detection
  tags: tech,wordpress,wp-plugin,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/userfeedback-lite/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: Toshiba TopAccess - Default-Login

Input:
Title: Toshiba TopAccess - Default-Login
Summary: Toshiba TopAccess - Default-Login. Tags: topaccess, default-login, misconfig
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: topaccess-default-login

info:
  name: Toshiba TopAccess - Default-Login
  author: ritikchaddha
  severity: high
  description: Toshiba TopAccess - Default-Login
  tags: topaccess,default-login,misconfig,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<name>Administrator"
          - "STATUS_OK</statusOfOperation"
        part: body
        condition: and
      - type: word
        words:
          - "text/xml"
        part: content_type
      - type: status
        status:
          - 200
        part: header_2


Instruction: Generate a Nuclei template for CVE-2020-24579

Input:
Title: Authentication Bypass in dlink dsl2888a_firmware
Summary: An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. An unauthenticated attacker could bypass authentication to access authenticated pages and functionality.
Vulnerability Type: Authentication Bypass
Severity: high
Affected Products: dlink dsl2888a_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2020-24579

info:
  name: D-Link DSL 2888a - Authentication Bypass/Remote Command Execution
  author: pikpikcu
  severity: high
  description: D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55 are vulnerable to authentication bypass issues which can lead to remote command execution. An unauthenticated attacker could bypass authentication to access authenticated pages and functionality.
  tags: cve,cve2020,dlink,rce,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Azure PostgreSQL Storage Auto-Growth Disabled

Input:
Title: Azure PostgreSQL Storage Auto-Growth Disabled
Summary: Azure PostgreSQL Storage Auto-Growth Disabled. Ensure that Storage Auto-Growth feature is enabled for your production Azure PostgreSQL database servers. Storage auto-growth prevents your PostgreSQL servers from running out of storage and becoming read-only.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: azure-postgresql-storage-autogrow-disabled

info:
  name: Azure PostgreSQL Storage Auto-Growth Disabled
  author: princechaddha
  severity: high
  description: Ensure that Storage Auto-Growth feature is enabled for your production Azure PostgreSQL database servers. Storage auto-growth prevents your PostgreSQL servers from running out of storage and becoming read-only.
  tags: cloud,devops,azure,microsoft,postgresql,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: yazawaj

info:
  name: Yazawaj User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Yazawaj user name information check was conducted.
  tags: osint,osint-dating,yazawaj,discovery

http:
  - method: GET
    path:
      - "https://www.yazawaj.com/profile/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "أنا"
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: uwuai

info:
  name: Uwu.ai User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Uwu.ai user name information check was conducted.
  tags: osint,osint-social,uwuai,discovery

http:
  - method: GET
    path:
      - "https://{{user}}.uwu.ai/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "property="twitter:card""
        part: body


Instruction: Generate a Nuclei template for CVE-2018-7196

Input:
Title: Cross-Site Scripting (XSS) in osticket osticket
Summary: Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: osticket osticket
Indicators: error, vulnerability detected

Output:
id: CVE-2018-7196

info:
  name: osTicket < 1.10.2 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter.
  tags: cve,cve2018,osticket,xss,authenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2021-24169

Input:
Title: Cross-Site Scripting (XSS) in algolplus advanced_order_export_for_woocommerce
Summary: This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to reflected XSS.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: algolplus advanced_order_export_for_woocommerce
Indicators: error, vulnerability detected

Output:
id: CVE-2021-24169

info:
  name: WordPress Advanced Order Export For WooCommerce <3.1.8 - Authenticated Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: WordPress Advanced Order Export For WooCommerce plugin before 3.1.8 contains an authenticated cross-site scripting vulnerability via the tab parameter in the admin panel. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: cve2021,cve,wordpress,authenticated,wpscan,xss,wp-plugin,wp,woo-order-export-lite,edb,algolplus,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Castel Digital - Authentication Bypass

Input:
Title: Castel Digital - Authentication Bypass
Summary: Castel Digital - Authentication Bypass. SQL Injection vulnerability in Castel Digital login forms.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: castel-digital-sqli

info:
  name: Castel Digital - Authentication Bypass
  author: s4e-io
  severity: high
  description: SQL Injection vulnerability in Castel Digital login forms.
  tags: sqli,auth-bypass,castel,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Banner"
          - "Construtoras"
        part: body_2
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - Microsoft API

Input:
Title: Content-Security-Policy Bypass - Microsoft API
Summary: Content-Security-Policy Bypass - Microsoft API. Tags: xss, csp-bypass, microsoft-api
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: microsoft-api-csp-bypass

info:
  name: Content-Security-Policy Bypass - Microsoft API
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - Microsoft API
  tags: xss,csp-bypass,microsoft-api,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "microsoft.com"
        part: header
        condition: and


Instruction: Generate a Nuclei template for CVE-2021-39433

Input:
Title: Unknown Vulnerability in biqs biqsdrive
Summary: A local file inclusion (LFI) vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user.
Vulnerability Type: Unknown Vulnerability
Severity: high
Affected Products: biqs biqsdrive
Indicators: error, vulnerability detected

Output:
id: CVE-2021-39433

info:
  name: BIQS IT Biqs-drive v1.83 Local File Inclusion
  author: Veshraj
  severity: high
  description: A local file inclusion vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user.
  tags: cve2021,cve,lfi,biqsdrive,biqs,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/download/index.php?file=../../../../../../../../../etc/passwd"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: gnuboard-detect

info:
  name: Gnuboard CMS - Detect
  author: gy741
  severity: info
  description: Gnuboard CMS was detected.
  tags: tech,gnuboard,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/LICENSE.txt"
    matchers:
      - type: word
        words:
          - "GNU Board"
          - "http://sir.kr"
        part: body
        condition: and
      - type: word
        words:
          - "text/plain"
        part: header


Instruction: Generate a Nuclei template for: Audiobookshelf Login Panel - Detect

Input:
Title: Audiobookshelf Login Panel - Detect
Summary: Audiobookshelf Login Panel - Detect. Tags: panel, audiobookshelf, detect
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: audiobookshelf-panel

info:
  name: Audiobookshelf Login Panel - Detect
  author: ritikchaddha
  severity: info
  description: Audiobookshelf Login Panel - Detect
  tags: panel,audiobookshelf,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/login"
    matchers:
      - type: word
        words:
          - "<title>Audiobookshelf"
          - "content="Audiobookshelf"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-0540

Input:
Title: Authentication Bypass in atlassian jira_data_center and others
Summary: A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.
Vulnerability Type: Authentication Bypass
Severity: critical
Affected Products: atlassian jira_data_center, atlassian jira_server, atlassian jira_service_management
Indicators: error, vulnerability detected

Output:
id: CVE-2022-0540

info:
  name: Atlassian Jira Seraph - Authentication Bypass
  author: DhiyaneshDK
  severity: critical
  description: Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.
  tags: cve,cve2022,atlassian,jira,exposure,auth-bypass,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/InsightPluginShowGeneralConfiguration.jspa;"
      - "{{BaseURL}}/secure/WBSGanttManageScheduleJobAction.jspa;"
    matchers:
      - type: word
        words:
          - "General Insight Configuration"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Codoso APT Gh0st Malware Hash - Detect

Input:
Title: Codoso APT Gh0st Malware Hash - Detect
Summary: Codoso APT Gh0st Malware Hash - Detect. Tags: malware, apt, codoso
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: codoso-gh0st-malware

info:
  name: Codoso APT Gh0st Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: Codoso APT Gh0st Malware Hash - Detect
  tags: malware,apt,codoso

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Unrestricted Upload of File with Dangerous Type

Input:
Title: Unrestricted Upload of File with Dangerous Type (CWE-434)
Summary: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Vulnerability Type: Unrestricted Upload of File with Dangerous Type
Severity: high
Indicators: vulnerability detected, error

Output:
id: ueditor-arbitrary-file-upload

info:
  name: UEditor - PHP Arbitrary File Upload
  author: ChiragArtani
  severity: medium
  description: Detects arbitrary file upload vulnerability in UEditor PHP  by attempting to upload and execute a PHP file. This vulnerability allows remote attackers to upload arbitrary files including PHP files, potentially leading to remote code execution.
  tags: ueditor,file-upload,rce,intrusive,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "PHP Extension"
          - "PHP Version"
        part: body_2
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Google Places Photo API Test

Input:
Title: Google Places Photo API Test
Summary: Google Places Photo API Test. Tags: token-spray, google, places
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-googleplacesphoto

info:
  name: Google Places Photo API Test
  author: zzeitlin
  severity: info
  description: Google Places Photo API Test
  tags: token-spray,google,places,photo

http:
  - method: GET
    path:
      - "https://maps.googleapis.com/maps/api/place/photo?maxwidth=400&photoreference=CnRtAAAATLZNl354RwP_9UKbQ_5Psy40texXePv4oAlgP4qNEkdIrkyse7rPXYGd9D_Uj1rVsQdWT4oRz4QrYAJNpFX7rzqqMlZw2h2E2y5IKMUZ7ouD_SlcHxYq1yL4KbKUv3qtWgTK0A6QbGh87GB3sscrHRIQiG2RrmU_jF4tENr9wGS_YxoUSSDrYjWmrNfeEHSGSc3FyhNLlBU&key={{token}}"
    matchers:
      - type: status
        status:
          - 302


Instruction: Generate a Nuclei template for: Google Firebase DB URL Finder

Input:
Title: Google Firebase DB URL Finder
Summary: Google Firebase DB URL Finder. Find firebaseio urls to check for security permissions
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: firebase-urls

info:
  name: Google Firebase DB URL Finder
  author: panch0r3d
  severity: info
  description: Find firebaseio urls to check for security permissions
  tags: tech,firebase,google,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: Zzzcms 1.75 - Information Disclosure

Input:
Title: Zzzcms 1.75 - Information Disclosure
Summary: Zzzcms 1.75 - Information Disclosure. There is a rather strange file that directly echoes some content belonging to the inaccessible zzz_config.php. The information leakage file is located in plugins\webuploader\js\webconfig.php, and the management path name of the management background can be obtained directly. No need to blast admin and add 3 digits anymore

Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: zzzcms-info-disclosure

info:
  name: Zzzcms 1.75 - Information Disclosure
  author: ritikchaddha
  severity: low
  description: There is a rather strange file that directly echoes some content belonging to the inaccessible zzz_config.php. The information leakage file is located in plugins\webuploader\js\webconfig.php, and the management path name of the management background can be obtained directly. No need to blast admin and add 3 digits anymore
  tags: zzzcms,info,disclosure,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "var adminpath"
          - "var imageMaxSize="
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: project-insight-login

info:
  name: Project Insight Login Panel - Detect
  author: dhiyaneshDk
  severity: info
  description: Project Insight login panel was detected.
  tags: panel,edb,helpproject,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/auth/login"
    matchers:
      - type: word
        words:
          - "<title>Project Insight - Login</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Mautic Installer Exposure

Input:
Title: Mautic Installer Exposure
Summary: Mautic Installer Exposure. Mautic is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: mautic-installer

info:
  name: Mautic Installer Exposure
  author: DhiyaneshDk
  severity: high
  description: Mautic is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,mautic,install,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/installer"
    matchers:
      - type: word
        words:
          - "Mautic Installation - Environment Check"
          - "Ready to Install!"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2018-20009

Input:
Title: Cross-Site Scripting (XSS) in domainmod domainmod
Summary: DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL field.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: domainmod domainmod
Indicators: error, vulnerability detected

Output:
id: CVE-2018-20009

info:
  name: DomainMOD 4.11.01 - Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: DomainMOD through version 4.11.01 is vulnerable to cross-site scripting via the /assets/add/ssl-provider.php ssl-provider-name and ssl-provider's-url parameters.
  tags: cve,cve2018,domainmod,xss,authenticated,edb,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: minds

info:
  name: Minds User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Minds user name information check was conducted.
  tags: osint,osint-political,minds,discovery

http:
  - method: GET
    path:
      - "https://www.minds.com/{{user}}/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - ") | Minds</title>"
        part: body


Instruction: Generate a Nuclei template for CVE-2017-17731

Input:
Title: SQL Injection in dedecms dedecms
Summary: DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: dedecms dedecms
Indicators: error, vulnerability detected

Output:
id: CVE-2017-17731

info:
  name: DedeCMS 5.7 - SQL Injection
  author: j4vaovo
  severity: critical
  description: DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.
  tags: cve,cve2017,sqli,dedecms,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/plus/recommend.php?action=&aid=1&_FILES[type][tmp_name]=\%27%20or%20mid=@`\%27`%20/*!50000union*//*!50000select*/1,2,3,md5({{num}}),5,6,7,8,9%23@`\%27`+&_FILES[type][name]=1.jpg&_FILES[type][type]=application/octet-stream&_FILES[type][size]=4294"
    matchers:
      - type: word
        words:
          - "{{md5({{num}})}}"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Odoo - Database Manager Discovery

Input:
Title: Odoo - Database Manager Discovery
Summary: Odoo - Database Manager Discovery. Odoo database manager was discovered.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: odoo-database-manager

info:
  name: Odoo - Database Manager Discovery
  author: __Fazal,R3dg33k
  severity: low
  description: Odoo database manager was discovered.
  tags: panel,odoo,backup,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/web/database/manager"
    matchers:
      - type: word
        words:
          - "<title>Odoo</title>"
          - ".o_database_delete"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Clearbit API Test

Input:
Title: Clearbit API Test
Summary: Clearbit API Test. Search for company logos and embed them in your projects
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-clearbit

info:
  name: Clearbit API Test
  author: daffainfo
  severity: info
  description: Search for company logos and embed them in your projects
  tags: token-spray,clearbit

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""person":"
          - ""id":"
          - ""name":"
        part: body
        condition: and


Instruction: Generate a Nuclei template for CVE-2025-1562

Input:
Title: Missing Authorization in funnelkit funnelkit_automations
Summary: The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_or_activate_addon_plugins() function and a weak nonce hash in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to install arbitrary plugins on the site that can be leveraged to further infect a vulnerable site.
Vulnerability Type: Missing Authorization
Severity: critical
Affected Products: funnelkit funnelkit_automations
Indicators: unauthorized

Output:
id: CVE-2025-1562

info:
  name: Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control
  author: s4e-io
  severity: critical
  description: The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_or_activate_addon_plugins() function and a weak nonce hash in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to install arbitrary plugins on the site that can be leveraged to further infect a vulnerable site.
  tags: cve,cve2025,wordpress,wp-plugin,wp,wp-marketing-automations,wordpress,authenticated,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Azure OpenAI Encryption using Customer-Managed Keys Not Enabled

Input:
Title: Azure OpenAI Encryption using Customer-Managed Keys Not Enabled
Summary: Azure OpenAI Encryption using Customer-Managed Keys Not Enabled. Ensure that your Microsoft Azure OpenAI service instances are using Customer-Managed Keys (CMKs) instead of Microsoft-managed encryption keys (i.e., default keys used by Microsoft Azure for encryption at rest) in order to have a more granular control over your Azure OpenAI data encryption and decryption process.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: azure-openai-cmk-not-enabled

info:
  name: Azure OpenAI Encryption using Customer-Managed Keys Not Enabled
  author: princechaddha
  severity: high
  description: Ensure that your Microsoft Azure OpenAI service instances are using Customer-Managed Keys (CMKs) instead of Microsoft-managed encryption keys (i.e., default keys used by Microsoft Azure for encryption at rest) in order to have a more granular control over your Azure OpenAI data encryption and decryption process.
  tags: cloud,devops,azure,microsoft,openai,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - HERE API

Input:
Title: Content-Security-Policy Bypass - HERE API
Summary: Content-Security-Policy Bypass - HERE API. Tags: xss, csp-bypass, here-api
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: here-api-csp-bypass

info:
  name: Content-Security-Policy Bypass - HERE API
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - HERE API
  tags: xss,csp-bypass,here-api,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "here.com"
        part: header
        condition: and


Instruction: Generate a Nuclei template for CVE-2022-24181

Input:
Title: Cross-Site Scripting (XSS) in public_knowledge_project open_journal_systems
Summary: Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: public_knowledge_project open_journal_systems
Indicators: error, vulnerability detected

Output:
id: CVE-2022-24181

info:
  name: PKP Open Journal Systems 2.4.8-3.3 - Cross-Site Scripting
  author: lucasljm2001,ekrause
  severity: medium
  description: PKP Open Journal Systems 2.4.8 to 3.3 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary code via the X-Forwarded-Host Header.
  tags: cve,cve2022,xss,oss,pkp-lib,edb,public_knowledge_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<script>alert(document.domain)</script><x=".com/iupjournals"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-39501

Input:
Title: Vulnerability (CWE-601) in eyoucms eyoucms
Summary: EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function.
Vulnerability Type: Vulnerability (CWE-601)
Severity: medium
Affected Products: eyoucms eyoucms
Indicators: error, vulnerability detected

Output:
id: CVE-2021-39501

info:
  name: EyouCMS 1.5.4 Open Redirect
  author: 0x_Akoko
  severity: medium
  description: EyouCMS 1.5.4 is vulnerable to an Open Redirect vulnerability. An attacker can redirect a user to a malicious url via the Logout function.
  tags: cve2021,cve,redirect,eyoucms,cms,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?m=user&c=Users&a=logout&referurl=https://interact.sh"
    matchers:
      - type: regex
        part: header


Instruction: Generate a Nuclei template for CVE-2024-3822

Input:
Title: Cross-Site Scripting (XSS) in mranderson base64_encoderdecoder
Summary: The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: mranderson base64_encoderdecoder
Indicators: error, vulnerability detected

Output:
id: CVE-2024-3822

info:
  name: Base64 Encoder/Decoder <= 0.9.2 - Cross-Site Scripting
  author: omranisecurity
  severity: medium
  description: The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
  tags: cve,cve2024,wordpress,wp-plugin,wp,xss,base64-encoderdecoder,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/base64-encoderdecoder/base64-decode.php?string=PHNjcmlwdD5hbGVydCgiZG9jdW1lbnQuZG9tYWluIik8L3NjcmlwdD4="
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: caa-fingerprint

info:
  name: CAA Record
  author: pdteam
  severity: info
  description: A CAA record was discovered. A CAA record is used to specify which certificate authorities (CAs) are allowed to issue certificates for a domain.
  tags: dns,caa,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-26258

Input:
Title: Vulnerability (CWE-918) in apache struts and others
Summary: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.
Vulnerability Type: Vulnerability (CWE-918)
Severity: medium
Affected Products: apache struts, xstream xstream, debian debian_linux
Indicators: error, vulnerability detected

Output:
id: CVE-2020-26258

info:
  name: XStream <1.4.15 - Server-Side Request Forgery
  author: pwnhxl
  severity: high
  description: XStream before 1.4.15 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.
  tags: cve,cve2020,xstream,ssrf,oast,xstream_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol
      - type: word
        words:
          - "User-Agent: Java"
        part: interactsh_request


Instruction: Generate a Nuclei template for: Bomgar Security Checks

Input:
Title: Bomgar Security Checks
Summary: Bomgar Security Checks. A simple workflow that runs all Bomgar related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: bomgar-workflow

info:
  name: Bomgar Security Checks
  author: pdteam
  severity: info
  description: A simple workflow that runs all Bomgar related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Path Traversal

Input:
Title: Path Traversal (CWE-22)
Summary: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escap
Vulnerability Type: Path Traversal
Severity: high
Indicators: unexpected

Output:
id: opensis-lfi

info:
  name: openSIS 5.1 - Local File Inclusion
  author: pikpikcu
  severity: high
  description: openSIS 5.1 is vulnerable to local file inclusion and allows attackers to obtain potentially sensitive information by executing arbitrary local scripts in the context of the web server process. This may allow the attacker to compromise the application and computer; other attacks are also possible.
  tags: opensis,lfi,edb,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/opensis/ajax.php?modname=misc/../../../../../../../../../../../../../etc/passwd&bypass=Transcripts.php"
      - "{{BaseURL}}/ajax.php?modname=misc/../../../../../../../../../../../../../etc/passwd&bypass=Transcripts.php"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: pubspec-config

info:
  name: Pubspec YAML Configuration File - Detect
  author: DhiyaneshDk
  severity: info
  description: Pubspec YAML configuration file was detected.
  tags: exposure,devops,pubsec,config,cicd,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/pubspec.yaml"
      - "{{BaseURL}}/assets/pubspec.yaml"
    matchers:
      - type: word
        words:
          - "version:"
          - "environment:"
          - "dependencies:"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-6396

Input:
Title: Vulnerability (CWE-29) in aimstack aim
Summary: A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution.
Vulnerability Type: Vulnerability (CWE-29)
Severity: critical
Affected Products: aimstack aim
Indicators: error, vulnerability detected

Output:
id: CVE-2024-6396

info:
  name: Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution.
  tags: cve,cve2024,aim,aimhubio,file-write,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "{"handler":"my_resource"}"
        part: body_1
      - type: word
        words:
          - "{{filename}}.txt"
        part: body_3
      - type: word
        words:
          - "text/plain"
        part: header_3


Instruction: Generate a Nuclei template for CVE-2020-10549

Input:
Title: SQL Injection in rconfig rconfig
Summary: rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: rconfig rconfig
Indicators: error, vulnerability detected

Output:
id: CVE-2020-10549

info:
  name: rConfig <=3.9.4 - SQL Injection
  author: madrobot
  severity: critical
  description: rConfig 3.9.4 and prior has unauthenticated snippets.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
  tags: cve,cve2020,rconfig,sqli,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/snippets.inc.php?search=True&searchField=antani'+union+select+(select+concat(0x223e3c42523e5b70726f6a6563742d646973636f766572795d)+limit+0,1),NULL,NULL,NULL+--+&searchColumn=snippetName&searchOption=contains"
    matchers:
      - type: word
        words:
          - "[project-discovery]"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-0747

Input:
Title: SQL Injection in quantumcloud infographic_maker
Summary: The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: quantumcloud infographic_maker
Indicators: error, vulnerability detected

Output:
id: CVE-2022-0747

info:
  name: Infographic Maker iList < 4.3.8 - SQL Injection
  author: theamanrawat
  severity: critical
  description: The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection.
  tags: time-based-sqli,cve,cve2022,sqli,wordpress,wp-plugin,wp,infographic-and-list-builder-ilist,wpscan,quantumcloud,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2021-27314

Input:
Title: SQL Injection in doctor_appointment_system_project doctor_appointment_system
Summary: SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via username parameter at login page.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: doctor_appointment_system_project doctor_appointment_system
Indicators: error, vulnerability detected

Output:
id: CVE-2021-27314

info:
  name: Doctor Appointment System 1.0 - SQL Injection
  author: theamanrawat
  severity: critical
  description: SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via username parameter at login page.
  tags: time-based-sqli,cve2021,cve,sqli,doctor-appointment-system,packetstorm,doctor_appointment_system_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Improper Bucket Server-Side Encryption

Input:
Title: Improper Bucket Server-Side Encryption
Summary: Improper Bucket Server-Side Encryption. Determine the Server-Side Encryption (SSE) feature configuration available for the selected OSS bucket. For compliance, the SSEAlgorithm must be set to KMS.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: improper-bucket-sse

info:
  name: Improper Bucket Server-Side Encryption
  author: ritikchaddha
  severity: medium
  description: Determine the Server-Side Encryption (SSE) feature configuration available for the selected OSS bucket. For compliance, the SSEAlgorithm must be set to KMS.
  tags: cloud,devops,aliyun,alibaba,aliyun-cloud-config,oss

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-0037

Input:
Title: Unknown Vulnerability in 10web map_builder_for_google_maps
Summary: The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Vulnerability Type: Unknown Vulnerability
Severity: critical
Affected Products: 10web map_builder_for_google_maps
Indicators: error, vulnerability detected

Output:
id: CVE-2023-0037

info:
  name: WordPress 10Web Map Builder < 1.0.73 - Unauthenticated SQL Injection
  author: riteshs4hu
  severity: critical
  description: The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
  tags: wpscan,cve,cve2023,wordpress,wp-plugin,wp,wd-google-maps,sqli,time-based,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: BSDI FTP Service - Detect

Input:
Title: BSDI FTP Service - Detect
Summary: BSDI FTP Service - Detect. BSDI FTP service was detected.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: bsdi-ftp-detect

info:
  name: BSDI FTP Service - Detect
  author: pussycat0x
  severity: info
  description: BSDI FTP service was detected.
  tags: network,ftp,bsdi,detect,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Lucee Detection Workflow

Input:
Title: Lucee Detection Workflow
Summary: Lucee Detection Workflow. A simple workflow that runs all Lucee related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: lucee-workflow

info:
  name: Lucee Detection Workflow
  author: geeknik,dhiyaneshDk
  severity: info
  description: A simple workflow that runs all Lucee related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: opnsense-panel

info:
  name: OPNsense Panel - Detect
  author: Splint3r7,johnk3r
  severity: info
  description: OPNsense panel was detected.
  tags: panel,login,detect,opnsense,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2018-15811

Input:
Title: Vulnerability (CWE-326) in dnnsoftware dotnetnuke
Summary: DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
Vulnerability Type: Vulnerability (CWE-326)
Severity: high
Affected Products: dnnsoftware dotnetnuke
Indicators: error, vulnerability detected

Output:
id: CVE-2018-18325

info:
  name: DotNetNuke 9.2 - 9.2.2 - Weak Encryption & Cookie Deserialization
  author: pdteam
  severity: high
  description: DNN (DotNetNuke) versions 9.2 through 9.2.2 use a weak encryption algorithm to protect input parameters because of an incomplete fix for CVE-2018-15811. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code execution.
  tags: cve,cve2018,dotnetnuke,crypto,deserialization,rce,kev,dnnsoftware,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "[extensions]"
          - "for 16-bit app support"
        part: body
        condition: and
      - type: status
        status:
          - 404


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: voipmonitor-panel

info:
  name: VoIPmonitor Login Panel - Detect
  author: Yanyun
  severity: info
  description: VoIPmonitor login panel was detected.
  tags: panel,voipmonitor,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "appShareUrl = 'share.voipmonitor.org'"
          - "VoIPmonitor"
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: weiphp-panel

info:
  name: Weiphp Panel - Detect
  author: ritikchaddha
  severity: info
  description: Weiphp panel was detected.
  tags: panel,weiphp,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php"
    matchers:
      - type: word
        words:
          - "_blank">WeiPHP"
          - "/weiphp.css?"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Checkpoint Security Checks

Input:
Title: Checkpoint Security Checks
Summary: Checkpoint Security Checks. A simple workflow that runs all Checkpoint related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: checkpoint-workflow

info:
  name: Checkpoint Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all Checkpoint related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: ws_ftp-server-web-transfer

info:
  name: WS_FTP Server Web Transfer - Panel Detect
  author: johnk3r
  severity: info
  description: WS_FTP Server Web Transfer panel was detected.
  tags: panel,ws_ftp,progress,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2018-6530

Input:
Title: OS Command Injection in dlink dir-860l_firmware and others
Summary: OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.
Vulnerability Type: OS Command Injection
Severity: critical
Affected Products: dlink dir-860l_firmware, dlink dir-865l_firmware, dlink dir-868l_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2018-6530

info:
  name: D-Link - Unauthenticated Remote Code Execution
  author: gy741
  severity: critical
  description: OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.
  tags: cve,cve2018,d-link,rce,oast,unauth,kev,dlink,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol
      - type: word
        words:
          - "User-Agent: curl"
        part: interactsh_request


Instruction: Generate a Nuclei template for: Mysql History - File Disclosure

Input:
Title: Mysql History - File Disclosure
Summary: Mysql History - File Disclosure. The mysql_history file is a history file used by the MySQL command-line client (mysql) to store a record of the SQL commands and statements entered by a user during their interactive MySQL sessions. It serves as a command history for the MySQL client, allowing users to recall and reuse previously executed SQL commands.

Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: mysql-history

info:
  name: Mysql History - File Disclosure
  author: kazet
  severity: low
  description: The mysql_history file is a history file used by the MySQL command-line client (mysql) to store a record of the SQL commands and statements entered by a user during their interactive MySQL sessions. It serves as a command history for the MySQL client, allowing users to recall and reuse previously executed SQL commands.
  tags: misconfig,disclosure,config,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.mysql_history"
    matchers:
      - type: word
        words:
          - "_HiStOrY_V2_"
          - "show databases;"
        condition: or
      - type: word
        words:
          - "application/octet-stream"
          - "text/plain"
          - "filename=".mysql_"
        part: header
      - type: word
        words:
          - "<?xml"
          - "<env"
          - "application/javascript"
          - "application/json"
          - "application/xml"
          - "html>"
          - "text/html"
          - "image/"
        part: response
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Doppler Audit Token

Input:
Title: Doppler Audit Token
Summary: Doppler Audit Token. Tags: doppler, exposure, tokens
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: doppler-audit-token

info:
  name: Doppler Audit Token
  author: DhiyaneshDK
  severity: info
  description: Doppler Audit Token
  tags: doppler,exposure,tokens,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Hongjing Human Resource Management System - SQL Injection

Input:
Title: Hongjing Human Resource Management System - SQL Injection
Summary: Hongjing Human Resource Management System - SQL Injection. There is a SQL injection vulnerability in the categories of Hongjing Human Resource Management System, from which attackers can obtain sensitive database information.
Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: CNVD-2023-08743

info:
  name: Hongjing Human Resource Management System - SQL Injection
  author: SleepingBag945
  severity: critical
  description: There is a SQL injection vulnerability in the categories of Hongjing Human Resource Management System, from which attackers can obtain sensitive database information.
  tags: cnvd2023,cnvd,hongjing,hcm,sqli,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2010-1353

Input:
Title: Path Traversal in wowjoomla com_loginbox
Summary: Directory traversal vulnerability in the LoginBox Pro (com_loginbox) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: wowjoomla com_loginbox
Indicators: error, vulnerability detected

Output:
id: CVE-2010-1353

info:
  name: Joomla! Component LoginBox - Local File Inclusion
  author: daffainfo
  severity: medium
  description: A directory traversal vulnerability in the LoginBox Pro (com_loginbox) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.
  tags: cve,cve2010,joomla,lfi,edb,wowjoomla,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_loginbox&view=../../../../../../../../../etc/passwd%00"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Landray-OA - Remote Code Execution

Input:
Title: Landray-OA - Remote Code Execution
Summary: Landray-OA - Remote Code Execution. Landray-OA `erp_data.jsp` is vulnerable to remote code execution vulnerability.

Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: landray-oa-erp-data-rce

info:
  name: Landray-OA - Remote Code Execution
  author: SleepingBag945
  severity: critical
  description: Landray-OA `erp_data.jsp` is vulnerable to remote code execution vulnerability.
  tags: landray,rce,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "dns"
        part: interactsh_protocol
      - type: word
        words:
          - "{"message":""
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: ftm-manager-panel

info:
  name: Financial Transaction Manager Login Panel - Detect
  author: idealphase
  severity: info
  description: Financial Transaction Manager login panel was detected.
  tags: panel,ftm,ibm,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "FTM Manager"
          - "login-panel"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Azure Databases - Cloud Enumeration

Input:
Title: Azure Databases - Cloud Enumeration
Summary: Azure Databases - Cloud Enumeration. Searches for Azure databases via their registered DNS names

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: azure-db-enum

info:
  name: Azure Databases - Cloud Enumeration
  author: initstring
  severity: info
  description: Searches for Azure databases via their registered DNS names
  tags: cloud,enum,cloud-enum,azure,dns,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2019-9762

Input:
Title: SQL Injection in phpshe phpshe
Summary: A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: phpshe phpshe
Indicators: error, vulnerability detected

Output:
id: CVE-2019-9762

info:
  name: PHPSHE 1.7 - SQL Injection
  author: DhiyaneshDK
  severity: critical
  description: A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication.
  tags: cve,cve2019,phpshe,sqli,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "{{md5({{num}})}}"
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: salon24

info:
  name: Salon24 User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Salon24 user name information check was conducted.
  tags: osint,osint-blog,salon24,discovery

http:
  - method: GET
    path:
      - "https://www.salon24.pl/u/{{user}}/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Strona główna"
        part: body


Instruction: Generate a Nuclei template for: Generic Remote File Inclusion

Input:
Title: Generic Remote File Inclusion
Summary: Generic Remote File Inclusion. Tags: rfi, dast, oast
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: generic-rfi

info:
  name: Generic Remote File Inclusion
  author: m4lwhere
  severity: high
  description: Generic Remote File Inclusion
  tags: rfi,dast,oast,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "NessusCodeExecTest"
        part: body


Instruction: Generate a Nuclei template for: Quip API Test

Input:
Title: Quip API Test
Summary: Quip API Test. File Sharing and Storage for groups
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-quip

info:
  name: Quip API Test
  author: daffainfo
  severity: info
  description: File Sharing and Storage for groups
  tags: token-spray,quip

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""id":"
          - ""name":"
        part: body
        condition: and


Instruction: Generate a Nuclei template for CVE-2014-1842

Input:
Title: Path Traversal in southrivertech titan_ftp_server
Summary: Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to list all usernames via a Go action with a .. (dot dot) in the search-bar value.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: southrivertech titan_ftp_server
Indicators: error, vulnerability detected

Output:
id: CVE-2014-1842

info:
  name: Titan FTP Server Search Function < 10.40 - User Enumeration
  author: pussycat0x
  severity: medium
  description: Titan FTP Server versions prior to 10.40 build 1829 contain a directory traversal vulnerability in the web interface search functionality. Remote attackers can list all existing users by submitting "/../" in the search bar, enabling user enumeration and reconnaissance.
  tags: cve,cve2014,network,ftp,titan-ftp,tcp,passive,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2018-1207

Input:
Title: Code Injection in dell emc_idrac7 and others
Summary: Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code. A remote unauthenticated attacker may potentially be able to use CGI variables to execute remote code.
Vulnerability Type: Code Injection
Severity: critical
Affected Products: dell emc_idrac7, dell emc_idrac8
Indicators: error, vulnerability detected

Output:
id: CVE-2018-1207

info:
  name: Dell iDRAC7/8 Devices - Remote Code Injection
  author: dwisiswant0
  severity: critical
  description: Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain a CGI injection vulnerability
which could be used to execute remote code. A remote unauthenticated attacker may
potentially be able to use CGI variables to execute remote code.
  tags: cve2018,cve,dell,injection,rce,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/login?LD_DEBUG=files"
    matchers:
      - type: word
        words:
          - "calling init: /lib/"
        part: response


Instruction: Generate a Nuclei template for: Orbit Fox by ThemeIsle Detection

Input:
Title: Orbit Fox by ThemeIsle Detection
Summary: Orbit Fox by ThemeIsle Detection. Tags: tech, wordpress, wp-plugin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-themeisle-companion

info:
  name: Orbit Fox by ThemeIsle Detection
  author: ricardomaia
  severity: info
  description: Orbit Fox by ThemeIsle Detection
  tags: tech,wordpress,wp-plugin,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/themeisle-companion/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for CVE-2021-44228

Input:
Title: Vulnerability (CWE-20) in siemens 6bk1602-0aa12-0tp0_firmware and others
Summary: Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
Vulnerability Type: Vulnerability (CWE-20)
Severity: critical
Affected Products: siemens 6bk1602-0aa12-0tp0_firmware, siemens 6bk1602-0aa22-0tp0_firmware, siemens 6bk1602-0aa32-0tp0_firmware
Indicators: error, vulnerability detected

Output:
id: vmware-hcx-log4j-rce

info:
  name: VMware HCX - Remote Code Execution (Apache Log4j)
  author: pussycat0x,DhiyaneshDK
  severity: critical
  description: VMware HCX is susceptible to remote code execution via the Apache Log4j framework. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  tags: cve,cve2021,rce,jndi,log4j,vmware,kev,oast,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "dns"
        part: interactsh_protocol
      - type: regex
        part: interactsh_request


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: resumes-actorsaccess

info:
  name: Resumes actorsaccess User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Resumes actorsaccess user name information check was conducted.
  tags: osint,osint-social,resumes-actorsaccess,discovery

http:
  - method: GET
    path:
      - "https://resumes.actorsaccess.com/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "- Resume | Actors Access</title>"
        part: body


Instruction: Generate a Nuclei template for CVE-2021-3374

Input:
Title: Path Traversal in rstudio shiny_server
Summary: Directory traversal in RStudio Shiny Server before 1.5.16 allows attackers to read the application source code, involving an encoded slash.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: rstudio shiny_server
Indicators: error, vulnerability detected

Output:
id: CVE-2021-3374

info:
  name: Rstudio Shiny Server <1.5.16 - Local File Inclusion
  author: geeknik
  severity: medium
  description: Rstudio Shiny Server prior to 1.5.16 is vulnerable to local file inclusion and source code leakage. This can be exploited by appending an encoded slash to the URL.
  tags: cve2021,cve,rstudio,traversal,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/%2f/"
      - "{{BaseURL}}/sample-apps/hello/%2f/"
    matchers:
      - type: word
        words:
          - "Index of /"
      - type: regex
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Log Planner Stats Enabled in PostgreSQL Database Instances

Input:
Title: Log Planner Stats Enabled in PostgreSQL Database Instances
Summary: Log Planner Stats Enabled in PostgreSQL Database Instances. Ensure that the log_planner_stats database flag is disabled for your Google Cloud PostgreSQL database instances in order to avoid performance issues caused by excessive logging. The log_planner_stats flag controls the inclusion of PostgreSQL planner performance statistics in the PostgreSQL logs for each query.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gcloud-pg-log-planner-stats-enabled

info:
  name: Log Planner Stats Enabled in PostgreSQL Database Instances
  author: princechaddha
  severity: medium
  description: Ensure that the log_planner_stats database flag is disabled for your Google Cloud PostgreSQL database instances in order to avoid performance issues caused by excessive logging. The log_planner_stats flag controls the inclusion of PostgreSQL planner performance statistics in the PostgreSQL logs for each query.
  tags: cloud,devops,gcp,gcloud,google-cloud-sql,postgresql,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Uberflip Takeover Detection

Input:
Title: Uberflip Takeover Detection
Summary: Uberflip Takeover Detection. Uberflip takeover was detected.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: uberflip-takeover

info:
  name: Uberflip Takeover Detection
  author: pdteam
  severity: high
  description: Uberflip takeover was detected.
  tags: takeover,uberflip,hackerone,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
      - type: word
        words:
          - "Non-hub domain, The URL you've accessed does not provide a hub."


Instruction: Generate a Nuclei template for CVE-2023-47246

Input:
Title: Path Traversal in sysaid sysaid
Summary: In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.
Vulnerability Type: Path Traversal
Severity: critical
Affected Products: sysaid sysaid
Indicators: error, vulnerability detected

Output:
id: CVE-2023-47246

info:
  name: SysAid Server - Remote Code Execution
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.
  tags: cve,cve2023,sysaid,rce,kev,traversal,intrusive,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl


Instruction: Generate a Nuclei template for: WordPress Importer Detection

Input:
Title: WordPress Importer Detection
Summary: WordPress Importer Detection. Tags: tech, wordpress, wp-plugin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-wordpress-importer

info:
  name: WordPress Importer Detection
  author: ricardomaia
  severity: info
  description: WordPress Importer Detection
  tags: tech,wordpress,wp-plugin,top-100,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/wordpress-importer/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: Wordpress - Path Disclosure

Input:
Title: Wordpress - Path Disclosure
Summary: Wordpress - Path Disclosure. Wordpress internal file system path of a WordPress installation is exposed or disclosed to unauthorized users.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wp-full-path-disclosure

info:
  name: Wordpress - Path Disclosure
  author: arcc
  severity: info
  description: Wordpress internal file system path of a WordPress installation is exposed or disclosed to unauthorized users.
  tags: debug,wordpress,fpd,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-includes/rss-functions.php"
    matchers:
      - type: word
        words:
          - "Call to undefined function _deprecated_file()"
        part: body


Instruction: Generate a Nuclei template for: Use AWS-managed policy to access Amazon ECR Repositories

Input:
Title: Use AWS-managed policy to access Amazon ECR Repositories
Summary: Use AWS-managed policy to access Amazon ECR Repositories. Ensure that all EKS cluster node groups use the "AmazonEC2ContainerRegistryReadOnly" managed policy to access Amazon ECR repositories. This policy provides read-only access to Amazon EC2 Container Registry (ECR) repositories.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: eks-managed-policy-ecr-access

info:
  name: Use AWS-managed policy to access Amazon ECR Repositories
  author: princechaddha
  severity: high
  description: Ensure that all EKS cluster node groups use the "AmazonEC2ContainerRegistryReadOnly" managed policy to access Amazon ECR repositories. This policy provides read-only access to Amazon EC2 Container Registry (ECR) repositories.
  tags: cloud,devops,aws,amazon,eks,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: stackstorm-default-login

info:
  name: StackStorm Default Login
  author: PaperPen
  severity: high
  description: A StackStorm default admin login was discovered.
  tags: stackstorm,default-login,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""user":"
          - ""token":"
          - ""expiry":"
        condition: and
      - type: status
        status:
          - 201