Instruction: Generate a Nuclei template for: OS Login Not Enabled for GCP Projects

Input:
Title: OS Login Not Enabled for GCP Projects
Summary: OS Login Not Enabled for GCP Projects. Ensure that the OS Login feature is enabled at the Google Cloud Platform (GCP) project level in order to provide you with centralized and automated SSH key pair management. OS Login ensures that SSH keys are mapped with Google Cloud IAM users, facilitating centralized management of SSH access.

Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: gcloud-oslogin-disabled

info:
  name: OS Login Not Enabled for GCP Projects
  author: princechaddha
  severity: low
  description: Ensure that the OS Login feature is enabled at the Google Cloud Platform (GCP) project level in order to provide you with centralized and automated SSH key pair management. OS Login ensures that SSH keys are mapped with Google Cloud IAM users, facilitating centralized management of SSH access.
  tags: cloud,devops,gcp,gcloud,compute,security,ssh,oslogin,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: dell-idrac

info:
  name: Dell IDRAC Panel - Detect
  author: kazet
  severity: info
  description: Dell IDRAC panel was detected.
  tags: panel,idrac,dell,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/restgui/start.html"
      - "{{BaseURL}}/login.html"
    matchers:
      - type: word
        words:
          - "<idrac-start-screen"
          - "thisIDRACText"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: WordPress Plugin Gallery 3.06 - Arbitrary File Upload

Input:
Title: WordPress Plugin Gallery 3.06 - Arbitrary File Upload
Summary: WordPress Plugin Gallery 3.06 - Arbitrary File Upload. The Gallery by BestWebSoft WordPress plugin was affected by an Unauthenticated File Upload PHP Code Execution security vulnerability.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: wp-gallery-file-upload

info:
  name: WordPress Plugin Gallery 3.06 - Arbitrary File Upload
  author: r3Y3r53
  severity: high
  description: The Gallery by BestWebSoft WordPress plugin was affected by an Unauthenticated File Upload PHP Code Execution security vulnerability.
  tags: wp,wp-plugin,wordpress,wpscan,file-upload,intrusive,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: supertokens-login-panel

info:
  name: Supertokens Login Panel - Detect
  author: rxerium
  severity: info
  description: A Supertokens login panel was detected.
  tags: panel,login,supertokens,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/auth"
    matchers:
      - type: word
        words:
          - "<title>SuperTokens + React"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-27925

Input:
Title: Path Traversal in synacor zimbra_collaboration_suite
Summary: Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: synacor zimbra_collaboration_suite
Indicators: error, vulnerability detected

Output:
id: CVE-2022-37042

info:
  name: Zimbra Collaboration Suite 8.8.15/9.0 - Remote Code Execution
  author: _0xf4n9x_,For3stCo1d
  severity: critical
  description: Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
  tags: cve,cve2022,zimbra,rce,unauth,kev,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Missing Authentication for Critical Function

Input:
Title: Missing Authentication for Critical Function (CWE-306)
Summary: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Vulnerability Type: Missing Authentication for Critical Function
Severity: high
Indicators: vulnerability detected, error

Output:
id: hadoop-unauth-rce

info:
  name: Apache Hadoop YARN ResourceManager - Remote Code Execution
  author: pdteam,Couskito
  severity: critical
  description: Apache Hadoop YARN ResourceManager is susceptible to remote code execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  tags: vulhub,apache,hadoop,unauth,rce,msf,misconfig,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/ws/v1/cluster/apps/new-application"
    matchers:
      - type: word
        words:
          - ""application-id""
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: ssh-known-hosts

info:
  name: SSH Known Hosts File - Detect
  author: geeknik
  severity: info
  description: SSH known hosts file was detected.
  tags: config,exposure,ssh,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.ssh/known_hosts"
      - "{{BaseURL}}/.ssh/known_hosts.old"
    matchers:
      - type: word
        words:
          - "ssh-dss"
          - "ssh-ed25519"
          - "ssh-rsa"
          - "ecdsa-sha2-nistp256"
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: ELB Delete Protection - Disabled

Input:
Title: ELB Delete Protection - Disabled
Summary: ELB Delete Protection - Disabled. Ensure that Deletion Protection safety feature is enabled for your Amazon Gateway Load Balancers (GWLBs) in order to protect the load balancers from being accidentally deleted.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: elb-delete-protection-disabled

info:
  name: ELB Delete Protection - Disabled
  author: DhiyaneshDK
  severity: medium
  description: Ensure that Deletion Protection safety feature is enabled for your Amazon Gateway Load Balancers (GWLBs) in order to protect the load balancers from being accidentally deleted.
  tags: cloud,devops,aws,amazon,elb,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-8615

Input:
Title: Cross-Site Request Forgery (CSRF) in themeum tutor_lms
Summary: A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).
Vulnerability Type: Cross-Site Request Forgery (CSRF)
Severity: medium
Affected Products: themeum tutor_lms
Indicators: error, vulnerability detected

Output:
id: CVE-2020-8615

info:
  name: Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery
  author: r3Y3r53
  severity: medium
  description: A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).
  tags: cve,cve2020,wpscan,packetstorm,csrf,wp-plugin,wp,tutor,wordpress,themeum,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Atlassian Confluence workflow

Input:
Title: Atlassian Confluence workflow
Summary: Atlassian Confluence workflow. Workflow that runs all Confluence related nuclei templates
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: confluence-workflow

info:
  name: Atlassian Confluence workflow
  author: philippedelteil
  severity: info
  description: Workflow that runs all Confluence related nuclei templates
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Detect SSL Certificate Issuer

Input:
Title: Detect SSL Certificate Issuer
Summary: Detect SSL Certificate Issuer. Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: ssl-issuer

info:
  name: Detect SSL Certificate Issuer
  author: Lingtren
  severity: info
  description: Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.
  tags: ssl,tls,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Command Injection

Input:
Title: Command Injection (CWE-77)
Summary: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attac
Vulnerability Type: Command Injection
Severity: medium
Indicators: vulnerability detected, error

Output:
id: rusty-joomla

info:
  name: Joomla! CMS <=3.4.6 - Remote Code Execution
  author: leovalcante,kiks7
  severity: critical
  description: Joomla! CMS 3.0.0 through the 3.4.6 release contains an unauthenticated PHP object injection that leads to remote code execution.
  tags: joomla,rce,unauth,php,cms,objectinjection,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http://rusty.jooml/;pkwxhxqxmdkkmscotwvh"
          - "Failed to decode session object"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: Loginizer Detection

Input:
Title: Loginizer Detection
Summary: Loginizer Detection. Tags: tech, wordpress, wp-plugin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-loginizer

info:
  name: Loginizer Detection
  author: ricardomaia
  severity: info
  description: Loginizer Detection
  tags: tech,wordpress,wp-plugin,top-100,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/loginizer/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for CVE-2023-20888

Input:
Title: Deserialization of Untrusted Data in vmware vrealize_network_insight
Summary: Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in remote code execution.
Vulnerability Type: Deserialization of Untrusted Data
Severity: high
Affected Products: vmware vrealize_network_insight
Indicators: error, vulnerability detected

Output:
id: CVE-2023-20888

info:
  name: VMware Aria Operations for Networks - Remote Code Execution
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in remote code execution.
  tags: cve2023,cve,vmware,aria,rce,authenticated,oast,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "dns"
        part: interactsh_protocol
      - type: status
        status:
          - 500


Instruction: Generate a Nuclei template for CVE-2011-5265

Input:
Title: Cross-Site Scripting (XSS) in featurific_for_wordpress_project featurific-for-wordpress
Summary: Cross-site scripting (XSS) vulnerability in cached_image.php in the Featurific For WordPress plugin 1.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the snum parameter.  NOTE: this has been disputed by a third party.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: featurific_for_wordpress_project featurific-for-wordpress
Indicators: error, vulnerability detected

Output:
id: CVE-2011-5265

info:
  name: Featurific For WordPress 1.6.2 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in cached_image.php in the Featurific For WordPress plugin 1.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the snum parameter.
  tags: cve2011,cve,wordpress,xss,wp-plugin,featurific_for_wordpress_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Featurific For Wordpress"
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/featurific-for-wordpress/cached_image.php?snum=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-6403

Input:
Title: Vulnerability (CWE-74) in fabian school_fees_payment_system
Summary: A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Vulnerability Type: Vulnerability (CWE-74)
Severity: high
Affected Products: fabian school_fees_payment_system
Indicators: error, vulnerability detected

Output:
id: CVE-2025-6403

info:
  name: Code-Projects School Fees Payment System 1.0 - SQL Injection
  author: hnd3884
  severity: critical
  description: A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
  tags: cve,cve2025,sqli,code_projects,unauth,school_fees_payment_system,time-based

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Finger Daemon Detection

Input:
Title: Finger Daemon Detection
Summary: Finger Daemon Detection. The finger daemon runs on TCP port 79. The client will (in the case of remote hosts) open a connection to port 79.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: finger-detect

info:
  name: Finger Daemon Detection
  author: DhiyaneshDK
  severity: info
  description: The finger daemon runs on TCP port 79. The client will (in the case of remote hosts) open a connection to port 79.
  tags: network,finger,detect,detection,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Cache Poisoning Detection

Input:
Title: Cache Poisoning Detection
Summary: Cache Poisoning Detection. This template detects Cache poisoning.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: cache-poisoning

info:
  name: Cache Poisoning Detection
  author: melbadry9,xelkomy,akincibor,dogasantos
  severity: low
  description: This template detects Cache poisoning.
  tags: cache,generic,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl


Instruction: Generate a Nuclei template for CVE-2018-1335

Input:
Title: Unknown Vulnerability in apache tika
Summary: From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
Vulnerability Type: Unknown Vulnerability
Severity: high
Affected Products: apache tika
Indicators: error, vulnerability detected

Output:
id: CVE-2018-1335

info:
  name: Apache Tika < 1.1.8 - Header Command Injection
  author: pikpikcu
  severity: high
  description: Apache Tika versions 1.7 to 1.17 allow clients to send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients.
  tags: cve,cve2018,packetstorm,edb,apache,tika,rce,intrusive,vkev,vuln

http:
  - method: PUT
    path:
      - "{{BaseURL}}/meta"
    matchers:
      - type: word
        words:
          - "Content-Type: text/csv"
        part: header
      - type: word
        words:
          - "org.apache.tika.parser.DefaultParser"
          - "org.apache.tika.parser.gdal.GDALParse"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: zuul-panel

info:
  name: Zuul Panel - Detect
  author: Yuzhe-zhang-0
  severity: info
  description: ZUUL panel was detected.
  tags: panel,zuul,cicd,oss,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/tenants"
      - "{{BaseURL}}/api/status"
    matchers:
      - type: word
        words:
          - ""name":"
          - ""projects":"
          - ""queue":"
        part: body
        condition: and
      - type: word
        words:
          - "zuul_version"


Instruction: Generate a Nuclei template for CVE-2021-24145

Input:
Title: Unrestricted File Upload in webnus modern_events_calendar_lite
Summary: Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
Vulnerability Type: Unrestricted File Upload
Severity: high
Affected Products: webnus modern_events_calendar_lite
Indicators: error, vulnerability detected

Output:
id: CVE-2021-24145

info:
  name: WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload
  author: theamanrawat
  severity: high
  description: WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-type in the request. This can possibly lead to remote code execution.
  tags: cve,cve2021,auth,wpscan,wordpress,wp-plugin,wp,modern-events-calendar-lite,rce,intrusive,webnus,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "{{md5(string)}}"
        part: body_3


Instruction: Generate a Nuclei template for: Golden FTP Server Pro Service - Detect

Input:
Title: Golden FTP Server Pro Service - Detect
Summary: Golden FTP Server Pro Service - Detect. Golden FTP Server Pro service was detected.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: golden-ftp-detect

info:
  name: Golden FTP Server Pro Service - Detect
  author: pussycat0x
  severity: info
  description: Golden FTP Server Pro service was detected.
  tags: network,ftp,golden,detect,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2018-12909

Input:
Title: Path Traversal in webgrind_project webgrind
Summary: Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the webserver user has access to) via an index.php?op=fileviewer&file= URI. NOTE: the vendor indicates that the product is not intended for a "publicly accessible environment.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: webgrind_project webgrind
Indicators: error, vulnerability detected

Output:
id: CVE-2018-12909

info:
  name: Webgrind <= 1.5 - Local File Inclusion
  author: DhiyaneshDk
  severity: high
  description: Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the webserver user has access to) via an index.php?op=fileviewer&file= URI
  tags: cve,cve2018,lfi,webgrind,webgrind_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?op=fileviewer&file=/etc/passwd"
    matchers:
      - type: regex
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2018-20010

Input:
Title: Cross-Site Scripting (XSS) in domainmod domainmod
Summary: DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: domainmod domainmod
Indicators: error, vulnerability detected

Output:
id: CVE-2018-20010

info:
  name: DomainMOD 4.11.01 - Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: DomainMOD through version 4.11.01 is vulnerable to cross-site scripting via the /assets/add/ssl-provider-account.php Username field.
  tags: cve,cve2018,domainmod,xss,authenticated,edb,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Helm Dashboard - Exposure

Input:
Title: Helm Dashboard - Exposure
Summary: Helm Dashboard - Exposure. Tags: helm, exposure, dashboard
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: helm-dashboard-exposure

info:
  name: Helm Dashboard - Exposure
  author: DhiyaneshDk
  severity: medium
  description: Helm Dashboard - Exposure
  tags: helm,exposure,dashboard,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Helm Dashboard</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: SmokePing Latency Page for Network Latency Grapher

Input:
Title: SmokePing Latency Page for Network Latency Grapher
Summary: SmokePing Latency Page for Network Latency Grapher. SmokePing Latency Page is exposed.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: smokeping-grapher

info:
  name: SmokePing Latency Page for Network Latency Grapher
  author: DhiyaneshDk
  severity: low
  description: SmokePing Latency Page is exposed.
  tags: misconfig,smokeping,latency,grapher,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/smokeping/"
    matchers:
      - type: word
        words:
          - "SmokePing Latency Page for"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Command Injection

Input:
Title: Command Injection (CWE-77)
Summary: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attac
Vulnerability Type: Command Injection
Severity: medium
Indicators: vulnerability detected, error

Output:
id: seowon-router-rce

info:
  name: Seowon 130-SLC router - Remote Code Execution
  author: gy741
  severity: critical
  description: Seowon 130-SLC router lets remote attackers execute commands without authentication as admin users via the router ip & Port(if available) in the request.
  tags: unauth,iot,edb,rce,seowon,router,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-37589

Input:
Title: SQL Injection in virtuasoftware cobranca
Summary: Virtua Cobranca before 12R allows SQL Injection on the login page.
Vulnerability Type: SQL Injection
Severity: high
Affected Products: virtuasoftware cobranca
Indicators: error, vulnerability detected

Output:
id: CVE-2021-37589

info:
  name: Virtua Software Cobranca <12R - Blind SQL Injection
  author: princechaddha
  severity: high
  description: Virtua Cobranca before 12R allows blind SQL injection on the login page.
  tags: cve,cve2021,virtua,sqli,virtuasoftware,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: or
      - type: dsl


Instruction: Generate a Nuclei template for: Airtable API Key

Input:
Title: Airtable API Key
Summary: Airtable API Key. Tags: airtable, exposure, tokens
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: airtable-api-key

info:
  name: Airtable API Key
  author: DhiyaneshDK
  severity: info
  description: Airtable API Key
  tags: airtable,exposure,tokens,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: PHP Source - Backup File Information Disclosure

Input:
Title: PHP Source - Backup File Information Disclosure
Summary: PHP Source - Backup File Information Disclosure. PHP Source File is disclosed to external users.
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: php-backup-files

info:
  name: PHP Source - Backup File Information Disclosure
  author: StreetOfHackerR007,pwnhxl,mastercho,0xpugal
  severity: medium
  description: PHP Source File is disclosed to external users.
  tags: exposure,backup,php,disclosure,fuzz,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}{{filepath}}{{bakext}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<?php"
          - "<?="
        part: body
        condition: or
      - type: word
        words:
          - "?>"
          - "($"
          - "$_GET["
          - "$_POST["
          - "$_REQUEST["
          - "$_SERVER["
          - "'DB_PASSWORD'"
          - "'DBPASS'"
          - "'dbname'"
          - "'database_name'"
          - "database_type"
          - "_DB_NAME_"
          - "define('DB"
          - "environments:"
        part: body
        condition: or
      - type: word
        words:
          - "text/plain"
          - "bytes"
        part: header
        condition: or


Instruction: Generate a Nuclei template for: GitLab Personal Access Token

Input:
Title: GitLab Personal Access Token
Summary: GitLab Personal Access Token. Tags: file, keys, gitlab
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: gitlab-personal-accesstoken

info:
  name: GitLab Personal Access Token
  author: DhiyaneshDK
  severity: info
  description: GitLab Personal Access Token
  tags: file,keys,gitlab,token

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-27481

Input:
Title: SQL Injection in goodlayers good_learning_management_system
Summary: An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which allows any unauthenticated user to get access to the function "gdlr_lms_cancel_booking" where POST Parameter "id" was sent straight into SQL query without sanitization.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: goodlayers good_learning_management_system
Indicators: error, vulnerability detected

Output:
id: CVE-2020-27481

info:
  name: Good Layers LMS Plugin <= 2.1.4 - SQL Injection
  author: edoardottt
  severity: critical
  description: An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which allows any unauthenticated user to get access to the function "gdlr_lms_cancel_booking" where POST Parameter "id" was sent straight into SQL query without sanitization.
  tags: time-based-sqli,cve,cve2020,goodlayerslms,sqli,wpscan,goodlayers,wordpress,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin Detection

Input:
Title: PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin Detection
Summary: PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin Detection
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-pretty-link

info:
  name: PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin Detection
  author: ricardomaia
  severity: info
  description: PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin Detection
  tags: tech,wordpress,wp-plugin,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/pretty-link/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for CVE-2018-14013

Input:
Title: Cross-Site Scripting (XSS) in synacor zimbra_collaboration_suite
Summary: Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: synacor zimbra_collaboration_suite
Indicators: error, vulnerability detected

Output:
id: CVE-2018-14013

info:
  name: Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scripting
  author: pikpikcu
  severity: medium
  description: Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 is vulnerable to cross-site scripting via the AJAX and html web clients.
  tags: cve,cve2018,xss,zimbra,synacor,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/zimbra/h/search?si=1&so=0&sfi=4&st=message&csi=1&action=&cso=0&id=%22%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Use of Weak Credentials

Input:
Title: Use of Weak Credentials (CWE-1391)
Summary: The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker. By design, authentication protocols try to ensure that attackers must perform brute force attacks if they do not know the credentials such as a key or password. However, when these credentials are easily predictable or even fixed (as with default or hard-coded passwords and keys), then the attacker can defeat the mechanism without relying on brute f
Vulnerability Type: Use of Weak Credentials
Severity: medium
Indicators: vulnerability detected, error

Output:
id: wordpress-weak-credentials

info:
  name: WordPress - Weak Credentials
  author: evolutionsec
  severity: critical
  description: Weak WordPress Credentials were discovered.
  tags: wordpress,default-login,fuzz,fuzzing,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "/wp-admin"
          - "wordpress_logged_in"
        part: header
        condition: and
      - type: status
        status:
          - 302


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: axigen-webmail

info:
  name: Axigen WebMail PanelDetection
  author: dhiyaneshDk,idealphase
  severity: info
  description: An Axigen webmail panel was discovered.
  tags: axigen,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: regex
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: maintainer-account

info:
  name: Fortinet Maintainer Account Not Implemented - Detect
  author: pussycat0x
  severity: info
  description: In Fortinet, if a FortiGate is compromised and the password is not recoverable, a maintainer account can be used by an administrator with physical access to log into CLI.
  tags: audit,config,file,firewall,fortigate

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: wufoo takeover detection

Input:
Title: wufoo takeover detection
Summary: wufoo takeover detection. wufoo takeover was detected.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: wufoo-takeover

info:
  name: wufoo takeover detection
  author: pdteam
  severity: high
  description: wufoo takeover was detected.
  tags: takeover,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
      - type: word
        words:
          - "Profile not found"
          - "Hmmm....something is not right."
        condition: and


Instruction: Generate a Nuclei template for CVE-2022-29078

Input:
Title: Code Injection in ejs ejs
Summary: The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Vulnerability Type: Code Injection
Severity: critical
Affected Products: ejs ejs
Indicators: error, vulnerability detected

Output:
id: CVE-2022-29078

info:
  name: Node.js Embedded JavaScript 3.1.6 - Template Injection
  author: For3stCo1d
  severity: critical
  description: Node.js Embedded JavaScript 3.1.6 is susceptible to server-side template injection via settings[view options][outputFunctionName], which is parsed as an internal option and overwrites the outputFunctionName option with an arbitrary OS command, which is then executed upon template compilation.
  tags: cve,cve2022,ssti,rce,ejs,nodejs,oast,intrusive,node.js,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol
      - type: word
        words:
          - "You are viewing page number"
        part: body


Instruction: Generate a Nuclei template for CVE-2021-21234

Input:
Title: Path Traversal in spring-boot-actuator-logview_project spring-boot-actuator-logview
Summary: spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile` would not work), the base folder parameter was not sufficiently checked, so that `filename=somefile&base=../` could access a file outside the logging base directory). The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release. There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: spring-boot-actuator-logview_project spring-boot-actuator-logview
Indicators: error, vulnerability detected

Output:
id: CVE-2021-21234

info:
  name: Spring Boot Actuator Logview Directory Traversal
  author: gy741,pikpikcu
  severity: high
  description: spring-boot-actuator-logview before version 0.2.13 contains a directory traversal vulnerability in libraries that adds a simple logfile viewer as a spring boot actuator endpoint (maven package "eu.hinsch:spring-boot-actuator-logview".
  tags: cve2021,cve,springboot,lfi,actuator,spring-boot-actuator-logview_project,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/manage/log/view?filename=/windows/win.ini&base=../../../../../../../../../../"
      - "{{BaseURL}}/log/view?filename=/windows/win.ini&base=../../../../../../../../../../"
      - "{{BaseURL}}/manage/log/view?filename=/etc/passwd&base=../../../../../../../../../../"
      - "{{BaseURL}}/log/view?filename=/etc/passwd&base=../../../../../../../../../../"
    matchers:
      - type: dsl
        condition: and
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: OpenStack User Secrets Exposure

Input:
Title: OpenStack User Secrets Exposure
Summary: OpenStack User Secrets Exposure. Internal user_secrets.yml file is exposed in OpenStack.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: openstack-user-secrets

info:
  name: OpenStack User Secrets Exposure
  author: geeknik
  severity: high
  description: Internal user_secrets.yml file is exposed in OpenStack.
  tags: openstack,config,exposure,files,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/user_secrets.yml"
      - "{{BaseURL}}/user_secrets.yml.old"
    matchers:
      - type: word
        words:
          - "_password:"
          - "OpenStack environment"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Cargo Lock Packages Disclosure

Input:
Title: Cargo Lock Packages Disclosure
Summary: Cargo Lock Packages Disclosure. Tags: exposure, files, cargo
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: cargo-lock-package

info:
  name: Cargo Lock Packages Disclosure
  author: DhiyaneshDk
  severity: info
  description: Cargo Lock Packages Disclosure
  tags: exposure,files,cargo,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/Cargo.lock"
    matchers:
      - type: word
        words:
          - "[[package]]"
          - "dependencies = ["
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: sitecore-login-panel

info:
  name: Sitecore Admin Login Panel - Detect
  author: b4uh0lz
  severity: info
  description: Sitecore admin login panel was detected.
  tags: panel,sitecore,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/sitecore/admin/login.aspx"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Sitecore Login"
        part: body


Instruction: Generate a Nuclei template for: EmpireCMS Detect

Input:
Title: EmpireCMS Detect
Summary: EmpireCMS Detect. Tags: tech, empirecms, discovery
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: empirecms-detect

info:
  name: EmpireCMS Detect
  author: princechaddha
  severity: info
  description: EmpireCMS Detect
  tags: tech,empirecms,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: Joomla! htaccess file disclosure

Input:
Title: Joomla! htaccess file disclosure
Summary: Joomla! htaccess file disclosure. Joomla!  has an htaccess file to store configurations about HTTP config, directory listing, etc.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: joomla-htaccess-file

info:
  name: Joomla! htaccess file disclosure
  author: oppsec
  severity: info
  description: Joomla!  has an htaccess file to store configurations about HTTP config, directory listing, etc.
  tags: miscellaneous,misc,joomla,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/htaccess.txt"
    matchers:
      - type: word
        words:
          - "Joomla"
          - "Open Source Matters. All rights reserved"
        condition: and
      - type: word
        words:
          - "text/plain"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Bottle - Out of Band Template Injection

Input:
Title: Bottle - Out of Band Template Injection
Summary: Bottle - Out of Band Template Injection. Tags: ssti, dast, oast
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: bottle-oob

info:
  name: Bottle - Out of Band Template Injection
  author: 0xAwali,DhiyaneshDK
  severity: high
  description: Bottle - Out of Band Template Injection
  tags: ssti,dast,oast,oob,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Akismet Anti-spam' Spam Protection Detection

Input:
Title: Akismet Anti-spam' Spam Protection Detection
Summary: Akismet Anti-spam' Spam Protection Detection. Tags: tech, wordpress, wp-plugin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-akismet

info:
  name: Akismet Anti-spam' Spam Protection Detection
  author: ricardomaia
  severity: info
  description: Akismet Anti-spam' Spam Protection Detection
  tags: tech,wordpress,wp-plugin,top-100,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/akismet/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for CVE-2020-12447

Input:
Title: Path Traversal in onkyo tx-nr585_firmware
Summary: A Local File Inclusion (LFI) issue on Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to read sensitive files via %2e%2e%2f directory traversal, as demonstrated by reading /etc/shadow.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: onkyo tx-nr585_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2020-12447

info:
  name: Onkyo TX-NR585 Web Interface - Directory Traversal
  author: 0x_Akoko
  severity: high
  description: Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to read sensitive files via %2e%2e%2f directory traversal and local file inclusion.
  tags: cve,cve2020,onkyo,lfi,traversal,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Health Check & Troubleshooting Detection

Input:
Title: Health Check & Troubleshooting Detection
Summary: Health Check & Troubleshooting Detection. Tags: tech, wordpress, wp-plugin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-health-check

info:
  name: Health Check & Troubleshooting Detection
  author: ricardomaia
  severity: info
  description: Health Check & Troubleshooting Detection
  tags: tech,wordpress,wp-plugin,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/health-check/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for CVE-2021-37580

Input:
Title: Authentication Bypass in apache shenyu
Summary: A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0
Vulnerability Type: Authentication Bypass
Severity: critical
Affected Products: apache shenyu
Indicators: error, vulnerability detected

Output:
id: CVE-2021-37580

info:
  name: Apache ShenYu Admin JWT - Authentication Bypass
  author: pdteam
  severity: critical
  description: Apache ShenYu 2.3.0 and 2.4.0 allow Admin access without proper authentication. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication.
  tags: cve2021,cve,apache,jwt,shenyu,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "query success"
          - ""userName":"admin""
          - ""code":200"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Freshbooks Access Token

Input:
Title: Freshbooks Access Token
Summary: Freshbooks Access Token. Tags: freshbooks, file, keys
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: freshbooks-access-token

info:
  name: Freshbooks Access Token
  author: DhiyaneshDK
  severity: info
  description: Freshbooks Access Token
  tags: freshbooks,file,keys

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-44427

Input:
Title: SQL Injection in rosariosis rosariosis
Summary: An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: rosariosis rosariosis
Indicators: error, vulnerability detected

Output:
id: CVE-2021-44427

info:
  name: Rosario Student Information System Unauthenticated SQL Injection
  author: furkansayim,xShuden
  severity: critical
  description: An unauthenticated SQL injection vulnerability in Rosario Student Information System (aka rosariosis) 8.1 and below allow remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.
  tags: cve,cve2021,sqli,rosariosis,vkev,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/Side.php"
    matchers:
      - type: word
        words:
          - "DB Execute Failed. ERROR:"
          - "unterminated quoted string"
        part: body
        condition: and
      - type: word
        words:
          - "RosarioSIS="
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Resource to Wrong Sphere

Input:
Title: Exposure of Resource to Wrong Sphere (CWE-668)
Summary: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. Resources such as files and directories may be inadvertently exposed through mechanisms such as insecure permissions, or when a program accidentally operates on the wrong object. For example, a program may intend that private files can only be provided to a specific user. This effectively defines a control sphere that is intended to prevent attackers from accessing t
Vulnerability Type: Exposure of Resource to Wrong Sphere
Severity: medium
Indicators: vulnerability detected, error

Output:
id: sicom-mgrng-login

info:
  name: Sicom MGRNG - Administrative Login Found
  author: sullo
  severity: info
  description: Sicom MGRNG administrative login page found.
  tags: sicom,mgrng,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/~sicom/mgrng/LoginForm.php"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<title>MGRNG Login</title>"
        part: body


Instruction: Generate a Nuclei template for: Go pprof Debug Page

Input:
Title: Go pprof Debug Page
Summary: Go pprof Debug Page. go pprof debug page was exposed.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: go-pprof-debug

info:
  name: Go pprof Debug Page
  author: w8ay
  severity: low
  description: go pprof debug page was exposed.
  tags: logs,exposure,go,pprof,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/debug/pprof/heap?debug=1"
      - "{{BaseURL}}/pprof/heap?debug=1"
    matchers:
      - type: word
        words:
          - "heap profile:"
          - "Alloc"
        condition: and
      - type: word
        words:
          - "text/plain"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-0676

Input:
Title: Cross-Site Scripting (XSS) in phpipam phpipam
Summary: Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: phpipam phpipam
Indicators: error, vulnerability detected

Output:
id: CVE-2023-0676

info:
  name: phpIPAM 1.5.1 - Cross-site Scripting
  author: ritikchaddha
  severity: medium
  description: Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.
  tags: cve,cve2023,phpipam,xss,authenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: cadvisor-exposure

info:
  name: cAdvisor - Detect
  author: DhiyaneshDk
  severity: medium
  description: cAdvisor page was detected.
  tags: exposure,misconfig,dashboard,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/containers/"
    matchers:
      - type: word
        words:
          - "<title>cAdvisor - /</title>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: WP AutoSuggest 0.24 - SQL Injection

Input:
Title: WP AutoSuggest 0.24 - SQL Injection
Summary: WP AutoSuggest 0.24 - SQL Injection. The wp-autosuggest WordPress plugin was affected by an Unauthenticated SQL Injection security vulnerability.

Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: wp-autosuggest-sql-injection

info:
  name: WP AutoSuggest 0.24 - SQL Injection
  author: theamanrawat
  severity: critical
  description: The wp-autosuggest WordPress plugin was affected by an Unauthenticated SQL Injection security vulnerability.
  tags: time-based-sqli,wp-plugin,wp,wp-autosuggest,wpscan,sqli,wordpress,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2024-0200

Input:
Title: Vulnerability (CWE-470) in github enterprise_server
Summary: An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3. This vulnerability was reported via the GitHub Bug Bounty program.

Vulnerability Type: Vulnerability (CWE-470)
Severity: high
Affected Products: github enterprise_server
Indicators: error, vulnerability detected

Output:
id: CVE-2024-0200

info:
  name: Github Enterprise Authenticated Remote Code Execution
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3.
  tags: cve,cve2024,rce,github,enterprise,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v3/user/orgs"
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
      - "{{BaseURL}}/api/v3/orgs/{{org_name}}/memberships/{{username}}"
    matchers:
      - type: word
        words:
          - ""role": "admin""
        part: body
  - method: POST
    path:
      - "{{BaseURL}}/api/v3/orgs/{{org_name}}/repos"
    matchers:
      - type: status
        status:
          - 201
  - method: GET
    path:
      - "{{BaseURL}}/login"
    matchers:
      - type: status
        status:
          - 200
  - method: POST
    path:
      - "{{BaseURL}}/session"
    matchers:
      - type: status
        status:
          - 302
      - type: word
        words:
          - "_gh_render"
        part: header
  - method: GET
    path:
      - "{{BaseURL}}/organizations/{{org_name}}/settings/actions/repository_items?page=1&rid_key=nw_fsck"
    matchers:
      - type: word
        words:
          - "ENTERPRISE_SESSION_SECRET"
        part: body
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers:
      - type: status
        status:
          - 500
      - type: word
        words:
          - "dns"
        part: interactsh_protocol


Instruction: Generate a Nuclei template for CVE-2015-6477

Input:
Title: Cross-Site Scripting (XSS) in nordex nordex_control_2_scada
Summary: Multiple cross-site scripting (XSS) vulnerabilities in the Wind Farm Portal application in Nordex Control 2 (NC2) SCADA 16 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: nordex nordex_control_2_scada
Indicators: error, vulnerability detected

Output:
id: CVE-2015-6477

info:
  name: Nordex NC2 - Cross-Site Scripting
  author: geeknik,daffainfo
  severity: medium
  description: Nordex NC2 contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: cve,cve2015,nordex,nc2,seclists,packetstorm,xss,iot,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "text/html"
        part: header
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
          - "var detailParams"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Confused Deputy

Input:
Title: Confused Deputy (CWE-441)
Summary: The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor. If an attacker cannot directly contact a target, but the produc
Vulnerability Type: Confused Deputy
Severity: medium
Indicators: unexpected

Output:
id: metadata-service-azure

info:
  name: Microsoft Azure Cloud Metadata Service Check
  author: sullo
  severity: critical
  description: The Microsoft Azure cloud host is configured as a proxy which allows access to the instance metadata service. This could allow significant access to the host/infrastructure.
  tags: exposure,config,azure,microsoft,proxy,misconfig,metadata,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "osType"
          - "ipAddress"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: Compalex Panel - Detect

Input:
Title: Compalex Panel - Detect
Summary: Compalex Panel - Detect. Tags: tech, php, compalex
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: compalex-panel-detect

info:
  name: Compalex Panel - Detect
  author: MaStErCho
  severity: medium
  description: Compalex Panel - Detect
  tags: tech,php,compalex,sql,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/{{paths}}/"
      - "{{paths}}.{{BaseURL}}/"
    matchers:
      - type: word
        words:
          - "<title>COMPALEX"
          - "<h1>Compalex"
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: WooPayments' Integrated WooCommerce Payments Detection

Input:
Title: WooPayments' Integrated WooCommerce Payments Detection
Summary: WooPayments' Integrated WooCommerce Payments Detection
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-woocommerce-payments

info:
  name: WooPayments' Integrated WooCommerce Payments Detection
  author: ricardomaia
  severity: info
  description: WooPayments' Integrated WooCommerce Payments Detection
  tags: tech,wordpress,wp-plugin,top-100,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/woocommerce-payments/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: Max-Forwards Header - Detect

Input:
Title: Max-Forwards Header - Detect
Summary: Max-Forwards Header - Detect. Max-Forwards response header is specified.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: maxforwards-headers-detect

info:
  name: Max-Forwards Header - Detect
  author: righettod
  severity: info
  description: Max-Forwards response header is specified.
  tags: miscellaneous,misc,max-forwards,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl


Instruction: Generate a Nuclei template for CVE-2017-18024

Input:
Title: Cross-Site Scripting (XSS) in avantfax avantfax
Summary: AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI, as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: avantfax avantfax
Indicators: error, vulnerability detected

Output:
id: CVE-2017-18024

info:
  name: AvantFAX 3.3.3 - Cross-Site Scripting
  author: pikpikcu
  severity: medium
  description: AvantFAX 3.3.3 contains a cross-site scripting vulnerability via an arbitrary parameter name submitted to the default URL, as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1.
  tags: cve,cve2017,avantfax,hackerone,packetstorm,xss,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<script>alert("{{randstr}}")</script>"
          - "AvantFAX"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: opencart-panel

info:
  name: OpenCart Login Panel - Detect
  author: ricardomaia
  severity: info
  description: OpenCart login panel was detected.
  tags: panel,opencart,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin"
      - "{{BaseURL}}/index.php?route=account/login"
    matchers:
      - type: regex
        condition: or


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: fanpop

info:
  name: Fanpop User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Fanpop user name information check was conducted.
  tags: osint,osint-social,fanpop,discovery

http:
  - method: GET
    path:
      - "https://www.fanpop.com/fans/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Fanpopping since"
        part: body


Instruction: Generate a Nuclei template for: Mythic C2 SSL - Detect

Input:
Title: Mythic C2 SSL - Detect
Summary: Mythic C2 SSL - Detect. Mythic is a multiplayer, command and control platform for red teaming operations

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: mythic-c2-ssl

info:
  name: Mythic C2 SSL - Detect
  author: johnk3r
  severity: info
  description: Mythic is a multiplayer, command and control platform for red teaming operations
  tags: c2,ssl,tls,ir,osint,malware,mythic,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: zatrybipl

info:
  name: Zatrybi.pl User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Zatrybi.pl user name information check was conducted.
  tags: osint,osint-tech,zatrybipl,discovery

http:
  - method: GET
    path:
      - "https://zatrybi.pl/user/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Zarejestrowany od:"
        part: body


Instruction: Generate a Nuclei template for CVE-2022-4306

Input:
Title: Unknown Vulnerability in panda_pods_repeater_field_project panda_pods_repeater_field
Summary: The Panda Pods Repeater Field WordPress plugin before 1.5.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a user having at least Contributor permission.
Vulnerability Type: Unknown Vulnerability
Severity: medium
Affected Products: panda_pods_repeater_field_project panda_pods_repeater_field
Indicators: error, vulnerability detected

Output:
id: CVE-2022-4306

info:
  name: WordPress Panda Pods Repeater Field <1.5.4 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: WordPress Panda Pods Repeater Field before 1.5.4 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. This can be leveraged against a user who has at least Contributor permission. An attacker can also steal cookie-based authentication credentials and launch other attacks.
  tags: cve,cve2022,xss,panda,pods,repeater,wordpress,wp-plugin,wpscan,authenticated,panda_pods_repeater_field_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: 3g-wireless-gateway

info:
  name: 3G Wireless Gateway Detection
  author: pussycat0x
  severity: info
  description: A 3G wireless gateway was detected.
  tags: panel,router,edb,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/htmlcode/html/indexdefault.asp"
    matchers:
      - type: word
        words:
          - "g_i3gState"
          - "g_sysinfo_sim_state"
          - "g_iUID"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Command Injection

Input:
Title: Command Injection (CWE-77)
Summary: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attac
Vulnerability Type: Command Injection
Severity: medium
Indicators: vulnerability detected, error

Output:
id: apache-flink-unauth-rce

info:
  name: Apache Flink - Remote Code Execution
  author: pikpikcu
  severity: critical
  description: Apache Flink contains an unauthenticated remote code execution vulnerability.
  tags: apache,flink,rce,intrusive,unauth,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "application/json"
        part: header
        condition: and
      - type: word
        words:
          - "success"
          - "_poc.jar"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-24947

Input:
Title: Vulnerability (CWE-863) in thinkupthemes responsive_vector_maps
Summary: The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server
Vulnerability Type: Vulnerability (CWE-863)
Severity: medium
Affected Products: thinkupthemes responsive_vector_maps
Indicators: error, vulnerability detected

Output:
id: CVE-2021-24947

info:
  name: WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read
  author: cckuailong
  severity: medium
  description: WordPress Responsive Vector Maps < 6.4.2 contains an arbitrary file read vulnerability because the plugin does not have proper authorization and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user to read arbitrary files on the web server.
  tags: cve2021,cve,authenticated,wpscan,lfi,wp,wordpress,wp-plugin,lfr,thinkupthemes,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: System Properties Exposure

Input:
Title: System Properties Exposure
Summary: System Properties Exposure. System Properties is exposed.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: system-properties-exposure

info:
  name: System Properties Exposure
  author: DhiyaneshDk
  severity: low
  description: System Properties is exposed.
  tags: misconfig,system,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "System Properties:"
          - "Environment Variables:"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: CMS Made Simple Installation Page - Exposure

Input:
Title: CMS Made Simple Installation Page - Exposure
Summary: CMS Made Simple Installation Page - Exposure. Detects exposed CMS Made Simple Installation page.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: cms-made-simple-installer

info:
  name: CMS Made Simple Installation Page - Exposure
  author: DhiyaneshDK
  severity: high
  description: Detects exposed CMS Made Simple Installation page.
  tags: misconfig,install,exposure,cms-made-simple,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/install/"
    matchers:
      - type: word
        words:
          - "CMS Made Simple Install/Upgrade"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-27163

Input:
Title: Vulnerability (CWE-918) in rbaskets request_baskets
Summary: request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.
Vulnerability Type: Vulnerability (CWE-918)
Severity: medium
Affected Products: rbaskets request_baskets
Indicators: error, vulnerability detected

Output:
id: CVE-2023-27163

info:
  name: Request-Baskets <= 1.2.1 - Server Side Request Forgery
  author: Jaenact
  severity: medium
  description: Request-Baskets <= 1.2.1 allows unauthenticated SSRF via the forward_url parameter when creating a new basket.
  tags: cve,cve2023,ssrf,request-baskets,oast,proxy,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol


Instruction: Generate a Nuclei template for: Ninja Forms – The Contact Form Builder That Grows With You Detection

Input:
Title: Ninja Forms – The Contact Form Builder That Grows With You Detection
Summary: Ninja Forms – The Contact Form Builder That Grows With You Detection
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-ninja-forms

info:
  name: Ninja Forms – The Contact Form Builder That Grows With You Detection
  author: ricardomaia
  severity: info
  description: Ninja Forms – The Contact Form Builder That Grows With You Detection
  tags: tech,wordpress,wp-plugin,top-100,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/ninja-forms/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: Khodrochi CMS - Cross Site Scripting

Input:
Title: Khodrochi CMS - Cross Site Scripting
Summary: Khodrochi CMS - Cross Site Scripting. A cross site scripting vulnerability was found in the Khodrochi.ir CMS an Iranian Car Services Platform.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: khodrochi-cms-xss

info:
  name: Khodrochi CMS - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: A cross site scripting vulnerability was found in the Khodrochi.ir CMS an Iranian Car Services Platform.
  tags: khodrochi,cms,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/specification/report.php?q=%22%3E%3Cimg%20src=x%20onerror=prompt(document.domain)%3E"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: FreeScout Panel - Detect

Input:
Title: FreeScout Panel - Detect
Summary: FreeScout Panel - Detect. FreeScout panel was discovered.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: freescout-panel

info:
  name: FreeScout Panel - Detect
  author: s4e-io
  severity: info
  description: FreeScout panel was discovered.
  tags: panel,login,freescout,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: netvibes

info:
  name: Netvibes User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Netvibes user name information check was conducted.
  tags: osint,osint-social,netvibes,discovery

http:
  - method: GET
    path:
      - "https://www.netvibes.com/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "userId"
        part: body


Instruction: Generate a Nuclei template for: Thruk Security Checks

Input:
Title: Thruk Security Checks
Summary: Thruk Security Checks. A simple workflow that runs all Thruk related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: thruk-workflow

info:
  name: Thruk Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all Thruk related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Breeze – WordPress Cache Plugin Detection

Input:
Title: Breeze – WordPress Cache Plugin Detection
Summary: Breeze – WordPress Cache Plugin Detection. Tags: tech, wordpress, wp-plugin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-breeze

info:
  name: Breeze – WordPress Cache Plugin Detection
  author: ricardomaia
  severity: info
  description: Breeze – WordPress Cache Plugin Detection
  tags: tech,wordpress,wp-plugin,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/breeze/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: hybris-default-login

info:
  name: Hybris - Default Login
  author: princechaddha
  severity: high
  description: Hybris contains a default login vulnerability. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.
  tags: default-login,hybris,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "hybris administration console"
          - "You're Administrator"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Phalcon Framework - Source Code Leakage

Input:
Title: Phalcon Framework - Source Code Leakage
Summary: Phalcon Framework - Source Code Leakage. Phalcon Framework source code was discovered.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: phalcon-framework-source

info:
  name: Phalcon Framework - Source Code Leakage
  author: philippedelteil
  severity: high
  description: Phalcon Framework source code was discovered.
  tags: exposure,debug,phalcon,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/anything_here"
    matchers:
      - type: word
        words:
          - "Phalcon Framework"
          - "AnythingHereController"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2018-11231

Input:
Title: SQL Injection in divido divido
Summary: In the Divido plugin for OpenCart, there is SQL injection. Attackers can use SQL injection to get some confidential information.
Vulnerability Type: SQL Injection
Severity: high
Affected Products: divido divido
Indicators: error, vulnerability detected

Output:
id: CVE-2018-11231

info:
  name: Opencart Divido - Sql Injection
  author: ritikchaddha
  severity: high
  description: OpenCart Divido plugin is susceptible to SQL injection
  tags: cve,cve2018,opencart,sqli,intrusive,divido,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "{{md5({{num}})}}"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Insecure Firebase Database

Input:
Title: Insecure Firebase Database
Summary: Insecure Firebase Database. If the owner of the app have set the security rules as true for both "read" & "write" an attacker can probably dump database and write his own data to firebase database.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: insecure-firebase-database

info:
  name: Insecure Firebase Database
  author: rafaelwdornelas
  severity: high
  description: If the owner of the app have set the security rules as true for both "read" & "write" an attacker can probably dump database and write his own data to firebase database.
  tags: firebase,google,misconfig,intrusive,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "{"id":"insecure-firebase-database"}"
        part: body_2
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Jira Unauthenticated Access to screens

Input:
Title: Jira Unauthenticated Access to screens
Summary: Jira Unauthenticated Access to screens. Tags: atlassian, jira, vuln
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: jira-unauthenticated-screens

info:
  name: Jira Unauthenticated Access to screens
  author: TESS
  severity: info
  description: Jira Unauthenticated Access to screens
  tags: atlassian,jira,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/rest/api/2/screens"
    matchers:
      - type: word
        words:
          - ""id":"
          - ""name":"
          - ""description":"
        condition: and
      - type: status
        status:
          - 200
      - type: word
        words:
          - "atlassian.xsrf.token"
        part: header


Instruction: Generate a Nuclei template to detect Cross-site Scripting

Input:
Title: Cross-site Scripting (CWE-79)
Summary: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. There are many variants of cross-site scripting, characterized by a variety of terms or involving different attack topologies. However, they all indicate the same fundamental weakness: improper neutralization of dangerous input between the adversary and a victim.
Vulnerability Type: Cross-site Scripting
Severity: high
Indicators: vulnerability detected, error

Output:
id: wp-nextgen-xss

info:
  name: WordPress NextGEN Gallery 1.9.10 - Cross-Site Scripting
  author: daffainfo
  severity: high
  description: WordPress NextGEN Gallery 1.9.10 plugin contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: wp-plugin,edb,wordpress,xss,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "= NextGEN Gallery"
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/nextgen-gallery/nggallery.php?test-head=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Open Redirect

Input:
Title: Open Redirect (CWE-601)
Summary: The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Vulnerability Type: Open Redirect
Severity: high
Indicators: vulnerability detected, error

Output:
id: nextjs-redirect

info:
  name: Next.js <1.2.3 - Open Redirect
  author: DhiyaneshDk
  severity: medium
  description: Next.js contains an open redirect via “_next/image” due to improper path parsing.
  tags: redirect,nextjs,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/_next/image?url=/\/\interact.sh/&q=100&w=128&h=128"
    matchers:
      - type: word
        words:
          - "Location: /\/\/interact.sh"
        part: header
      - type: status
        status:
          - 308


Instruction: Generate a Nuclei template for: Cacti Weathermap File Write

Input:
Title: Cacti Weathermap File Write
Summary: Cacti Weathermap File Write. Cacti Weathermap (a plugin for Cacti, an open-source network monitoring and graphing tool) is vulnerable to file write.
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: cacti-weathermap-file-write

info:
  name: Cacti Weathermap File Write
  author: pikpikcu
  severity: medium
  description: Cacti Weathermap (a plugin for Cacti, an open-source network monitoring and graphing tool) is vulnerable to file write.
  tags: injection,cacti,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/plugins/weathermap/editor.php?plug=0&mapname=poc.conf&action=set_map_properties&param=&param2=&debug=existing&node_name=&node_x=&node_y=&node_new_name=&node_label=&node_infourl=&node_hover=&node_iconfilename=--NONE--&link_name=&link_bandwidth_in=&link_bandwidth_out=&link_target=&link_width=&link_infourl=&link_hover=&map_title=46ea1712d4b13b55b3f680cc5b8b54e8&map_legend=Traffic+Load&map_stamp=Created:+%b+%d+%Y+%H:%M:%S&map_linkdefaultwidth=7"
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
      - "{{BaseURL}}/plugins/weathermap/configs/poc.conf"
    matchers:
      - type: word
        words:
          - "TITLE 46ea1712d4b13b55b3f680cc5b8b54e8"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2014-2321

Input:
Title: Vulnerability (CWE-264) in zte f460 and others
Summary: web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials.
Vulnerability Type: Vulnerability (CWE-264)
Severity: high
Affected Products: zte f460, zte f660
Indicators: error, vulnerability detected

Output:
id: CVE-2014-2321

info:
  name: ZTE Cable Modem Web Shell
  author: geeknik
  severity: critical
  description: ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests to web_shell_cmd.gch, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials.
  tags: cve2014,cve,iot,zte,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/web_shell_cmd.gch"
    matchers:
      - type: word
        words:
          - "please input shell command"
          - "ZTE Corporation. All rights reserved"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: tar - Privilege Escalation

Input:
Title: tar - Privilege Escalation
Summary: tar - Privilege Escalation. tar is a command-line utility used to create and manipulate archive files. It is commonly used for bundling multiple files and directories into a single archive, often used in conjunction with compression tools like gzip or bzip2.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: privesc-tar

info:
  name: tar - Privilege Escalation
  author: daffainfo
  severity: high
  description: tar is a command-line utility used to create and manipulate archive files. It is commonly used for bundling multiple files and directories into a single archive, often used in conjunction with compression tools like gzip or bzip2.
  tags: code,linux,tar,privesc,local

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Secnet Intelligent Routing System actpt_5g.data - Information Leak

Input:
Title: Secnet Intelligent Routing System actpt_5g.data - Information Leak
Summary: Secnet Intelligent Routing System actpt_5g.data - Information Leak. Secnet Intelligent Routing System is exposed.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: secnet-info-leak

info:
  name: Secnet Intelligent Routing System actpt_5g.data - Information Leak
  author: DhiyaneshDk
  severity: high
  description: Secnet Intelligent Routing System is exposed.
  tags: info-leak,secnet,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/actpt_5g.data"
    matchers:
      - type: word
        words:
          - ""http_username":"
          - ""http_passwd":"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: iotawatt-app-exposure

info:
  name: IoTaWatt Configuration App Exposure
  author: pussycat0x
  severity: high
  description: An IoTaWatt configuration app was discovered. Unauthenticated access to an IoTaWatt energy monitor could give a malicious attacker the means to upload to any of several third-party energy websites/database.
  tags: iot,exposure,vuln,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<h3>Configure IoTaWatt Device</h3>"
          - "<title>IoTaWatt Configuration app</title>"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: SevOne NMS Network Manager

Input:
Title: SevOne NMS Network Manager
Summary: SevOne NMS Network Manager. Tags: sevone, manager, login
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: sevone-nms-network-manager

info:
  name: SevOne NMS Network Manager
  author: pussycat0x
  severity: info
  description: SevOne NMS Network Manager
  tags: sevone,manager,login,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/#login"
    matchers:
      - type: word
        words:
          - "SevOne NMS - Network Manager"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2015-2794

Input:
Title: Vulnerability (CWE-264) in dotnetnuke dotnetnuke
Summary: The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
Vulnerability Type: Vulnerability (CWE-264)
Severity: critical
Affected Products: dotnetnuke dotnetnuke
Indicators: error, vulnerability detected

Output:
id: CVE-2015-2794

info:
  name: DotNetNuke 07.04.00 - Administration Authentication Bypass
  author: 0xr2r
  severity: critical
  description: The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
  tags: cve2015,cve,dotnetnuke,auth-bypass,install,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/Install/InstallWizard.aspx?__VIEWSTATE"
    matchers:
      - type: word
        words:
          - "Administrative Information"
          - "Database Information"
        part: body
        condition: and
      - type: status
        status:
          - 200