Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: whm-login-detect

info:
  name: WHM Login Panel - Detect
  author: pussycat0x
  severity: info
  description: WHM login panel was detected.
  tags: edb,whm,panel,login,cpanel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers:
      - type: word
        words:
          - "<title>WHM Login</title>"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Joomla JVTwitter - Cross-Site Scripting

Input:
Title: Joomla JVTwitter - Cross-Site Scripting
Summary: Joomla JVTwitter - Cross-Site Scripting. The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: joomla-jvtwitter-xss

info:
  name: Joomla JVTwitter - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials.
  tags: joomla,jvtwitter,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/modules/mod_jvtwitter/jvtwitter.php?id=%22%3E%3Cimg%20src=x%20onerror=prompt(document.domain);%3E"
      - "{{BaseURL}}/modules/mod_jvtwitter/jvtwitter.php?id="
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2025-55747

Input:
Title: Vulnerability (CWE-23) in xwiki xwiki
Summary: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions  6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7.
Vulnerability Type: Vulnerability (CWE-23)
Severity: critical
Affected Products: xwiki xwiki
Indicators: error, vulnerability detected

Output:
id: CVE-2025-55747

info:
  name: XWiki Platform - Information Disclosure
  author: Redmomn
  severity: high
  description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API.
  tags: cve,cve2025,xwiki,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2022-46071

Input:
Title: SQL Injection in helmet_store_showroom_site_project helmet_store_showroom_site
Summary: There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: helmet_store_showroom_site_project helmet_store_showroom_site
Indicators: error, vulnerability detected

Output:
id: CVE-2022-46071

info:
  name: Helmet Store Showroom v1.0 - SQL Injection
  author: Harsh
  severity: critical
  description: There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access.
  tags: cve,cve2022,sqli,admin-bypass,helmet,helmet_store_showroom_site_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: encompass-cm1-homepage

info:
  name: Encompass CM1 Home Page - Detect
  author: tess
  severity: info
  description: Encompass CM1 home page was detected.
  tags: misconfig,encompass,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Encompass CM1 Home Page"
          - "DIAGNOSTIC LINKS:"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-20150

Input:
Title: Vulnerability (CWE-306) in trendnet tew-827dru_firmware
Summary: Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. Authentication can be bypassed and a user may view information as Admin by manually browsing to the setup wizard and forcing it to redirect to the desired page.
Vulnerability Type: Vulnerability (CWE-306)
Severity: medium
Affected Products: trendnet tew-827dru_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2021-20150

info:
  name: Trendnet AC2600 TEW-827DRU - Credentials Disclosure
  author: gy741
  severity: medium
  description: Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. A user may view information as Admin by manually browsing to the setup wizard and forcing it to redirect to the desired page.
  tags: cve2021,cve,disclosure,router,tenable,trendnet,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "ftp_username"
          - "ftp_password"
          - "ftp_permission"
          - "TEW-827DRU"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: SAProuter - Detect

Input:
Title: SAProuter - Detect
Summary: SAProuter - Detect. The SAProuter is a proxy program that controls and secures communication between SAP systems and external networks.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: sap-router-detect

info:
  name: SAProuter - Detect
  author: pussycat0x
  severity: info
  description: The SAProuter is a proxy program that controls and secures communication between SAP systems and external networks.
  tags: network,tcp,sap,tech,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Shopify Access Token (Public App)

Input:
Title: Shopify Access Token (Public App)
Summary: Shopify Access Token (Public App). Tags: shopify, token, exposure
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: shopify-public-token

info:
  name: Shopify Access Token (Public App)
  author: DhiyaneshDK
  severity: info
  description: Shopify Access Token (Public App)
  tags: shopify,token,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-45136

Input:
Title: Cross-Site Scripting (XSS) in xwiki xwiki
Summary: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name strategy (disabled by default), XWiki starting in version 12.0-rc-1 and prior to versions 12.10.12 and 15.5-rc-1 is vulnerable to a reflected cross-site scripting attack in the page creation form. This allows an attacker to execute arbitrary actions with the rights of the user opening the malicious link. Depending on the rights of the user, this may allow remote code execution and full read and write access to the whole XWiki installation. This has been patched in XWiki 14.10.12 and 15.5-rc-1 by adding appropriate escaping. The vulnerable template file `createinline.vm` is part of XWiki's WAR and can be patched by manually applying the changes from the fix.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: critical
Affected Products: xwiki xwiki
Indicators: error, vulnerability detected

Output:
id: CVE-2023-45136

info:
  name: XWiki < 14.10.14 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name strategy (disabled by default), XWiki starting in version 12.0-rc-1 and prior to versions 12.10.12 and 15.5-rc-1 is vulnerable to a reflected cross-site scripting attack in the page creation form. This allows an attacker to execute arbitrary actions with the rights of the user opening the malicious link.
  tags: cve,cve2024,xwiki,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/bin/create/Main/%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
      - "{{BaseURL}}/xwiki/bin/create/Main/%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Gitlab SAML - Detection

Input:
Title: Gitlab SAML - Detection
Summary: Gitlab SAML - Detection. The presence of SAML-based authentication on GitLab instances. SAML is commonly used for Single Sign-On (SSO) integrations, which allows users to authenticate with GitLab using an external Identity Provider (IdP).

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: gitlab-saml

info:
  name: Gitlab SAML - Detection
  author: rootxharsh,iamnoooob,pdresearch
  severity: info
  description: The presence of SAML-based authentication on GitLab instances. SAML is commonly used for Single Sign-On (SSO) integrations, which allows users to authenticate with GitLab using an external Identity Provider (IdP).
  tags: panel,saml,gitlab,discovery

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "EntityDescriptor"
          - "SAML"
        part: body
        condition: and
      - type: word
        words:
          - "application/xml"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: blender phishing Detection

Input:
Title: blender phishing Detection
Summary: blender phishing Detection. A blender phishing website was detected

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: blender-phish

info:
  name: blender phishing Detection
  author: rxerium
  severity: info
  description: A blender phishing website was detected
  tags: phishing,blender,osint,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "blender.org - Home of the Blender project - Free and Open 3D Creation Software"
      - type: status
        status:
          - 200
      - type: dsl


Instruction: Generate a Nuclei template for: Gibbon Installer - Exposure

Input:
Title: Gibbon Installer - Exposure
Summary: Gibbon Installer - Exposure. Gibbon is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: gibbon-installer

info:
  name: Gibbon Installer - Exposure
  author: DhiyaneshDK
  severity: high
  description: Gibbon is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,gibbon,install,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/installer/install.php"
    matchers:
      - type: word
        words:
          - "<title>Gibbon Installer</title>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-0595

Input:
Title: Cross-Site Scripting (XSS) in codedropz drag_and_drop_multiple_file_upload_-_contact_form_7
Summary: The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: codedropz drag_and_drop_multiple_file_upload_-_contact_form_7
Indicators: error, vulnerability detected

Output:
id: CVE-2022-0595

info:
  name: WordPress Contact Form 7 <1.3.6.3 - Stored Cross-Site Scripting
  author: akincibor
  severity: medium
  description: WordPress Contact Form 7 before 1.3.6.3 contains an unauthenticated stored cross-site scripting vulnerability in the Drag and Drop Multiple File Upload plugin. SVG files can be uploaded by default via the dnd_codedropz_upload AJAX action.
  tags: cve,cve2022,xss,wordpress,wp-plugin,wpscan,fileupload,intrusive,unauth,codedropz,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-46805

Input:
Title: Authentication Bypass in ivanti connect_secure and others
Summary: An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
Vulnerability Type: Authentication Bypass
Severity: high
Affected Products: ivanti connect_secure, ivanti policy_secure
Indicators: error, vulnerability detected

Output:
id: CVE-2023-46805

info:
  name: Ivanti ICS - Authentication Bypass
  author: DhiyaneshDK,daffainfo,geeknik
  severity: high
  description: An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
  tags: packetstorm,cve,cve2023,kev,auth-bypass,ivanti,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-6360

Input:
Title: SQL Injection in joedolson my_calendar
Summary: The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route.
Vulnerability Type: SQL Injection
Severity: high
Affected Products: joedolson my_calendar
Indicators: error, vulnerability detected

Output:
id: CVE-2023-6360

info:
  name: WordPress My Calendar <3.4.22 - SQL Injection
  author: xxcdd
  severity: critical
  description: WordPress My Calendar plugin versions before 3.4.22 are vulnerable to an unauthenticated SQL injection within the 'from' and 'to' parameters of the '/my-calendar/v1/events' REST route.
  tags: cve,cve2023,sqli,wp,wordpress,wpscan,wp-plugin,my-calendar,joedolson,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "My Calendar"
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: gladinet-centrestack-panel

info:
  name: CentreStack Login Panel - Detect
  author: rxerium
  severity: info
  description: Gladinet CentreStack login panel was detected.
  tags: panel,centrestack,login,gladinet,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/portal/loginpage.aspx"
    matchers:
      - type: word
        words:
          - "CentreStack - Login"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: seats-login

info:
  name: Seats Login Panel - Detect
  author: dhiyaneshDK
  severity: info
  description: Seats login panel was detected.
  tags: panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"
    matchers:
      - type: word
        words:
          - "<title>seats.io  | login</title>"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Kubernetes Version Exposure

Input:
Title: Kubernetes Version Exposure
Summary: Kubernetes Version Exposure. Searches for exposed Kubernetes API servers which return version information unauthenticated. For Google Kubernetes Engine (GKE) and Amazon Elastic Kubernetes Service (EKS) this template will extract default patch version for you.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: kubernetes-version

info:
  name: Kubernetes Version Exposure
  author: raesene,idealphase
  severity: info
  description: Searches for exposed Kubernetes API servers which return version information unauthenticated. For Google Kubernetes Engine (GKE) and Amazon Elastic Kubernetes Service (EKS) this template will extract default patch version for you.
  tags: tech,k8s,kubernetes,devops,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/version"
    matchers:
      - type: word
        words:
          - "gitVersion"
          - "goVersion"
          - "platform"
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-45671

Input:
Title: Cross-Site Scripting (XSS) in frigate frigate
Summary: Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the `/<camera_name>` base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. As the reflected values included in the URL are not sanitized or escaped, this permits execution arbitrary Javascript payloads. Version 0.13.0 Beta 3 contains a patch for this issue.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: frigate frigate
Indicators: error, vulnerability detected

Output:
id: CVE-2023-45671

info:
  name: Frigate < 0.13.0 Beta 3 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: Frigate is an open source network video recorder. Before version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the `/<camera_name>` base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. As the reflected values included in the URL are not sanitized or escaped, this permits execution arbitrary Javascript payloads. Version 0.13.0 Beta 3 contains a patch for this issue.
  tags: cve,cve2023,frigate,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/%3Cimg%20src=%22%22%20onerror=alert(document.domain)%3E"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-1893

Input:
Title: Cross-Site Scripting (XSS) in login_configurator_project login_configurator
Summary: The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a reflected cross-site scripting vulnerability targeting site administrators.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: login_configurator_project login_configurator
Indicators: error, vulnerability detected

Output:
id: CVE-2023-1893

info:
  name: Login Configurator <=2.1 - Cross-Site Scripting
  author: 0xr2r
  severity: medium
  description: Login Configurator WordPress plugin <= 2.1 contains a reflected cross-site scripting caused by improper escaping of URL parameter before outputting it to the page, letting attackers execute scripts in the context of site administrators, exploit requires victim to visit a malicious URL.
  tags: cve,cve2023,wp,wp-plugin,wordpress,xss,login_configurator,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "login-configurator"
        part: body
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/options-general.php?page=login-configurator-options&tab=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E#top"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2024-30570

Input:
Title: Information Disclosure in netgear r6850_firmware
Summary: An information leak in debuginfo.htm of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any authentication required.
Vulnerability Type: Information Disclosure
Severity: medium
Affected Products: netgear r6850_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2024-30570

info:
  name: Netgear R6850 - Information Disclosure
  author: ritikchaddha
  severity: medium
  description: Netgear R6850 router firmware version V1.1.0.88 contains an information leakage vulnerability in the debuginfo.htm page. This hidden interface is not protected by authentication, allowing unauthenticated attackers to access sensitive informationsuch as product model name, WAN connection type, and potentially other system details.
  tags: cve,cve2024,netgear,router,exposure,unauth,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/debuginfo.htm"
    matchers:
      - type: word
        words:
          - "<br>WAN connection type"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-52488

Input:
Title: Information Disclosure in dnnsoftware dotnetnuke
Summary: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.
Vulnerability Type: Information Disclosure
Severity: high
Affected Products: dnnsoftware dotnetnuke
Indicators: error, vulnerability detected

Output:
id: CVE-2025-52488

info:
  name: DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure
  author: assetnote,DhiyaneshDk,iamnoooob,pdresearch
  severity: high
  description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.
  tags: cve,cve2025,file-upload,dotnetnuke,oast,oob,dnnsoftware,oss,ntlm,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "dns"
        part: interactsh_protocol
      - type: dsl
        condition: or


Instruction: Generate a Nuclei template for CVE-2022-41840

Input:
Title: Path Traversal in welcart welcart_e-commerce
Summary: Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: welcart welcart_e-commerce
Indicators: error, vulnerability detected

Output:
id: CVE-2022-41840

info:
  name: Welcart eCommerce <=2.7.7 - Local File Inclusion
  author: theamanrawat
  severity: critical
  description: Welcart eCommerce 2.7.7 and before are vulnerable to unauthenticated local file inclusion.
  tags: cve2022,cve,wp-plugin,wordpress,wp,lfi,unauth,usc-e-shop,collne,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/usc-e-shop/functions/progress-check.php?progressfile=../../../../../../../../../../../../../etc/passwd"
    matchers:
      - type: word
        words:
          - "application/json"
        part: header
      - type: regex
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: ws_ftp-ssh-detect

info:
  name: WS_FTP-SSH Service - Detect
  author: johnk3r
  severity: info
  description: WS_FTP-SSH service was detected.
  tags: network,ssh,ws_ftp,detect,progress,detection,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2016-10940

Input:
Title: SQL Injection in zm-gallery_project zm-gallery
Summary: The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.
Vulnerability Type: SQL Injection
Severity: high
Affected Products: zm-gallery_project zm-gallery
Indicators: error, vulnerability detected

Output:
id: CVE-2016-10940

info:
  name: WordPress zm-gallery plugin 1.0 SQL Injection
  author: cckuailong,daffainfo
  severity: high
  description: zm-gallery plugin 1.0 for WordPress is susceptible to SQL injection via the order parameter.
  tags: cve,cve2016,wpscan,sqli,wp,wordpress,wp-plugin,authenticated,zm-gallery_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Metabase Security Checks

Input:
Title: Metabase Security Checks
Summary: Metabase Security Checks. A simple workflow that runs all Metabase Pipeline related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: metabase-workflow

info:
  name: Metabase Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all Metabase Pipeline related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Flarum Installation Page - Exposure

Input:
Title: Flarum Installation Page - Exposure
Summary: Flarum Installation Page - Exposure. Detects exposed Flarum installation pages which could allow unauthorized access or information disclosure.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: flarum-installer

info:
  name: Flarum Installation Page - Exposure
  author: DhiyaneshDK
  severity: high
  description: Detects exposed Flarum installation pages which could allow unauthorized access or information disclosure.
  tags: misconfig,install,exposure,flarum,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Install Flarum</title>"
          - "Admin Password"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: PRTG Traffic Grapher - Unauthenticated Access

Input:
Title: PRTG Traffic Grapher - Unauthenticated Access
Summary: PRTG Traffic Grapher - Unauthenticated Access. PRTG Traffic Grapher was able to be accessed with no authentication requirements in place.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: unauthenticated-prtg

info:
  name: PRTG Traffic Grapher - Unauthenticated Access
  author: dhiyaneshDK
  severity: high
  description: PRTG Traffic Grapher was able to be accessed with no authentication requirements in place.
  tags: config,unauth,prtg,edb,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/sensorlist.htm"
    matchers:
      - type: word
        words:
          - "PRTG Traffic Grapher"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-33544

Input:
Title: OS Command Injection in geutebrueck g-cam_ebc-2110_firmware and others
Summary: Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
Vulnerability Type: OS Command Injection
Severity: high
Affected Products: geutebrueck g-cam_ebc-2110_firmware, geutebrueck g-cam_ebc-2111_firmware, geutebrueck g-cam_efd-2241_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2021-33544

info:
  name: Geutebruck - Remote Command Injection
  author: gy741
  severity: high
  description: Geutebruck is susceptible to multiple vulnerabilities its web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.
  tags: cve2021,cve,geutebruck,rce,oast,geutebrueck,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol


Instruction: Generate a Nuclei template for CVE-2021-41432

Input:
Title: Cross-Site Scripting (XSS) in flatpress flatpress
Summary: A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaScript commands through blog content.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: flatpress flatpress
Indicators: error, vulnerability detected

Output:
id: CVE-2021-41432

info:
  name: FlatPress 1.2.1 - Stored Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: FlatPress 1.2.1 contains a stored cross-site scripting vulnerability that allows for arbitrary execution of JavaScript commands through blog content. An attacker can possibly steal cookie-based authentication credentials and launch other attacks.
  tags: cve2021,cve,flatpress,xss,authenticated,oss,intrusive,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: cal

info:
  name: Cal User Name Information - Detect
  author: olearycrew
  severity: info
  description: Cal user name information check was conducted.
  tags: osint,osint-social,cal,caldotcom,discovery

http:
  - method: GET
    path:
      - "https://cal.com/{{user}}"
    matchers:
      - type: word
        words:
          - "username":"{{user}}""
          - ""email":"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-35847

Input:
Title: SQL Injection in agentejo cockpit
Summary: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: agentejo cockpit
Indicators: error, vulnerability detected

Output:
id: cockpit-workflow

info:
  name: Agentejo Cockpit Security Checks
  author: dwisiswant0
  severity: info
  description: A simple workflow that runs all Agentejo Cockpit related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: DarkComet Trojan - Detect

Input:
Title: DarkComet Trojan - Detect
Summary: DarkComet Trojan - Detect. DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur (known as DarkCoderSc[2]), an independent programmer and computer security coder from France. Although the RAT was developed back in 2008, it began to proliferate at the start of 2012.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: darkcomet-trojan

info:
  name: DarkComet Trojan - Detect
  author: pussycat0x
  severity: info
  description: DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur (known as DarkCoderSc[2]), an independent programmer and computer security coder from France. Although the RAT was developed back in 2008, it began to proliferate at the start of 2012.
  tags: network,c2,ir,osint,cti,darkcomet,tcp,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Enable AuditEvent Logging for Azure Key Vaults

Input:
Title: Enable AuditEvent Logging for Azure Key Vaults
Summary: Enable AuditEvent Logging for Azure Key Vaults. Ensure that AuditEvent logging is enabled for all Azure Key Vault instances in order to record any interactions with your vaults for enhancing data protection and compliance within your Azure cloud account. With Azure Key Vault, you can safeguard encryption keys and application secrets like passwords using keys stored in Hardware Security Modules (HSMs).

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: azure-keyvault-audit-not-enabled

info:
  name: Enable AuditEvent Logging for Azure Key Vaults
  author: princechaddha
  severity: medium
  description: Ensure that AuditEvent logging is enabled for all Azure Key Vault instances in order to record any interactions with your vaults for enhancing data protection and compliance within your Azure cloud account. With Azure Key Vault, you can safeguard encryption keys and application secrets like passwords using keys stored in Hardware Security Modules (HSMs).
  tags: cloud,devops,azure,microsoft,keyvault,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-32682

Input:
Title: Path Traversal in std42 elfinder
Summary: elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.
Vulnerability Type: Path Traversal
Severity: critical
Affected Products: std42 elfinder
Indicators: error, vulnerability detected

Output:
id: CVE-2021-32682

info:
  name: elFinder 2.1.58 - Remote Code Execution
  author: smaranchand
  severity: critical
  description: elFinder 2.1.58 is impacted by multiple remote code execution vulnerabilities that could allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration.
  tags: cve2021,cve,elfinder,misconfig,rce,oss,std42,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin/elfinder/elfinder-cke.html"
      - "{{BaseURL}}/assets/backend/elfinder/elfinder-cke.html"
      - "{{BaseURL}}/assets/elFinder-2.1.9/elfinder.html"
      - "{{BaseURL}}/assets/elFinder/elfinder.html"
      - "{{BaseURL}}/backend/elfinder/elfinder-cke.html"
      - "{{BaseURL}}/elfinder/elfinder-cke.html"
      - "{{BaseURL}}/uploads/assets/backend/elfinder/elfinder-cke.html"
      - "{{BaseURL}}/uploads/assets/backend/elfinder/elfinder.html"
      - "{{BaseURL}}/uploads/elfinder/elfinder-cke.html"
    matchers:
      - type: word
        words:
          - "elfinder"
          - "php/connector"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-53558

Input:
Title: Vulnerability (CWE-1391) in CVE-2025-53558
Summary: ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.
Vulnerability Type: Vulnerability (CWE-1391)
Severity: high
Indicators: error, vulnerability detected

Output:
id: CVE-2025-53558

info:
  name: ZTE ZXHN-F660T/F660A - Default Credentials
  author: DhiyaneshDK
  severity: high
  description: ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.
  tags: cve,cve2025,default-login,zte,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "/start.ghtml"
        part: location
      - type: status
        status:
          - 302
      - type: word
        words:
          - "wrong username"
          - "User information is error"
        part: body


Instruction: Generate a Nuclei template for: Apache2 Default Test Page

Input:
Title: Apache2 Default Test Page
Summary: Apache2 Default Test Page. Tags: tech, apache, discovery
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: default-apache2-page

info:
  name: Apache2 Default Test Page
  author: dhiyaneshDk
  severity: info
  description: Apache2 Default Test Page
  tags: tech,apache,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Apache2 Debian Default Page: It works</title>"
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: noescape-login

info:
  name: NoEscape Login Panel - Detect
  author: DhiyaneshDK
  severity: info
  description: NoEscape login panel was detected.
  tags: panel,noescape,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "NoEscape - Login"
        part: body


Instruction: Generate a Nuclei template for CVE-2020-26876

Input:
Title: Vulnerability (CWE-306) in wpcoursesplugin wp-courses
Summary: The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because show_in_rest is enabled for custom post types (e.g., /wp-json/wp/v2/course and /wp-json/wp/v2/lesson exist).
Vulnerability Type: Vulnerability (CWE-306)
Severity: high
Affected Products: wpcoursesplugin wp-courses
Indicators: error, vulnerability detected

Output:
id: CVE-2020-26876

info:
  name: WordPress WP Courses Plugin Information Disclosure
  author: dwisiswant0
  severity: high
  description: WordPress WP Courses Plugin < 2.0.29 contains a critical information disclosure which exposes private course videos and materials.
  tags: cve,cve2020,wordpress,wp-plugin,exposure,edb,wpcoursesplugin,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/wp/v2/lesson/1"
    matchers:
      - type: word
        words:
          - "application/json"
        part: header
      - type: regex
        part: body
        condition: or
      - type: status
        status:
          - 200
        condition: or


Instruction: Generate a Nuclei template for CVE-2021-39411

Input:
Title: Cross-Site Scripting (XSS) in phpgurukul hospital_management_system
Summary: Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the (1) searchdata parameter in (a) doctor/search.php and (b) admin/patient-search.php, and the (2) fromdate and (3) todate parameters in admin/betweendates-detailsreports.php.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: phpgurukul hospital_management_system
Indicators: error, vulnerability detected

Output:
id: CVE-2021-39411

info:
  name: Hospital Management System 1.0 - Cross-Site Scripting
  author: arafatansari
  severity: high
  description: Hospital Management System 1.0 contains a cross-site scripting vulnerability via the searchdata parameter in doctor/search.php and patient-search.php.
  tags: cve,cve2021,hms,hospital,cms,xss,authenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2018-7662

Input:
Title: Information Disclosure in couchcms couch
Summary: Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php.
Vulnerability Type: Information Disclosure
Severity: medium
Affected Products: couchcms couch
Indicators: error, vulnerability detected

Output:
id: CVE-2018-7662

info:
  name: CouchCMS <= 2.0 - Path Disclosure
  author: ritikchaddha
  severity: medium
  description: CouchCMS <= 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php.
  tags: cve2018,cve,couchcms,fpd,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/includes/mysql2i/mysql2i.func.php"
      - "{{BaseURL}}/addons/phpmailer/phpmailer.php"
    matchers:
      - type: word
        words:
          - "mysql2i.func.php on line 10"
          - "Fatal error: Cannot redeclare mysql_affected_rows() in"
        part: body
        condition: and
      - type: word
        words:
          - "phpmailer.php on line 10"
          - "Fatal error: Call to a menber function add_event_listener() on a non-object in"
        part: body
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: muck-rack

info:
  name: Muck Rack User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Muck Rack user name information check was conducted.
  tags: osint,osint-news,muck-rack,discovery

http:
  - method: GET
    path:
      - "https://muckrack.com/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "on Muck Rack"
        part: body


Instruction: Generate a Nuclei template for CVE-2024-43917

Input:
Title: SQL Injection in templateinvaders ti_woocommerce_wishlist
Summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TemplateInvaders TI WooCommerce Wishlist allows SQL Injection.This issue affects TI WooCommerce Wishlist: from n/a through 2.8.2.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: templateinvaders ti_woocommerce_wishlist
Indicators: error, vulnerability detected

Output:
id: CVE-2024-43917

info:
  name: WordPress TI WooCommerce Wishlist Plugin <= 2.8.2 - SQL Injection
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: In the latest version (2.8.2 as of writing the article) and below, the plugin is vulnerable to a SQL injection vulnerability that allows any users to execute arbitrary SQL queries in the database of the WordPress site. No privileges are required to exploit the issue. The vulnerability is unpatched on the latest version and is tracked as the CVE-2024-43917.
  tags: time-based-sqli,cve,cve2024,wp,wordpress,ti-woocommerce-wishlist,wp-plugin,sqli,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "data-tinvwl_product_id=""
        part: body
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Strapi Admin - Installer

Input:
Title: Strapi Admin - Installer
Summary: Strapi Admin - Installer. Strapi Admin Registration enabled was detected.

Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: strapi-admin-installer

info:
  name: Strapi Admin - Installer
  author: dhiyaneshDk
  severity: critical
  description: Strapi Admin Registration enabled was detected.
  tags: misconfig,exposure,strapi,install,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Welcome to your Strapi app"
          - "Click to create the first administration"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: surge takeover detection

Input:
Title: surge takeover detection
Summary: surge takeover detection. surge takeover was detected.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: surge-takeover

info:
  name: surge takeover detection
  author: pdteam
  severity: high
  description: surge takeover was detected.
  tags: takeover,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
      - type: word
        words:
          - "project not found"
      - type: status
        status:
          - 404


Instruction: Generate a Nuclei template for: NetMizer LogManagement System cmd.php - Remote Code Execution

Input:
Title: NetMizer LogManagement System cmd.php - Remote Code Execution
Summary: NetMizer LogManagement System cmd.php - Remote Code Execution. Remote Command Execution vulnerability in the NetMizer log management system cmd.php, and the attacker can execute the command by passing in the cmd parameter.

Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: netmizer-cmd-rce

info:
  name: NetMizer LogManagement System cmd.php - Remote Code Execution
  author: DhiyaneshDk
  severity: critical
  description: Remote Command Execution vulnerability in the NetMizer log management system cmd.php, and the attacker can execute the command by passing in the cmd parameter.
  tags: netmizer,cmd,rce,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/data/manage/cmd.php?cmd=id"
    matchers:
      - type: regex
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: streamlabs

info:
  name: StreamLabs User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: StreamLabs user name information check was conducted.
  tags: osint,osint-finance,streamlabs,discovery

http:
  - method: GET
    path:
      - "https://streamlabs.com/api/v6/user/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "display_name"
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: musiciansocial-mastodon-instance

info:
  name: Musician.social (Mastodon Instance) User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Musician.social (Mastodon Instance) user name information check was conducted.
  tags: osint,osint-social,musiciansocial-mastodon-instance,discovery

http:
  - method: GET
    path:
      - "https://musician.social/api/v1/accounts/lookup?acct={{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "display_name"
        part: body


Instruction: Generate a Nuclei template for: Dependency Track API Key

Input:
Title: Dependency Track API Key
Summary: Dependency Track API Key. Tags: dependency, exposure, tokens
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: dependency-track-api

info:
  name: Dependency Track API Key
  author: DhiyaneshDK
  severity: info
  description: Dependency Track API Key
  tags: dependency,exposure,tokens,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-24328

Input:
Title: OS Command Injection in totolink a3300r_firmware
Summary: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFilterRules function.
Vulnerability Type: OS Command Injection
Severity: critical
Affected Products: totolink a3300r_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2024-24328

info:
  name: TotoLink Router setMacFilterRules - Command Injection
  author: pussycat0x
  severity: critical
  description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFilterRules function.
  tags: cve,cve2024,totolink,routers,unauth,intrusive,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Firebase Cloud Messaging Token

Input:
Title: Firebase Cloud Messaging Token
Summary: Firebase Cloud Messaging Token. Tags: file, keys, token
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: fcm-api-key

info:
  name: Firebase Cloud Messaging Token
  author: Devang-Solanki
  severity: medium
  description: Firebase Cloud Messaging Token
  tags: file,keys,token,fcm,firebase,google

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Local Infile Enabled in MySQL Database Instances

Input:
Title: Local Infile Enabled in MySQL Database Instances
Summary: Local Infile Enabled in MySQL Database Instances. Ensure that the local_infile database flag is disabled for your Google Cloud MySQL database instances in order to follow data security best practices. The local_infile flag allows loading data from a local file to a database table, which could pose a security risk if misused.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gcloud-mysql-local-infile-enabled

info:
  name: Local Infile Enabled in MySQL Database Instances
  author: princechaddha
  severity: medium
  description: Ensure that the local_infile database flag is disabled for your Google Cloud MySQL database instances in order to follow data security best practices. The local_infile flag allows loading data from a local file to a database table, which could pose a security risk if misused.
  tags: cloud,devops,gcp,gcloud,google-cloud-sql,mysql,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: HCM Cloud - Arbitrary File Read

Input:
Title: HCM Cloud - Arbitrary File Read
Summary: HCM Cloud - Arbitrary File Read. HCM-Cloud professional human resources platform in the cloud download Arbitrary file read vulnerability.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: hcm-cloud-lfi

info:
  name: HCM Cloud - Arbitrary File Read
  author: s4e-io
  severity: high
  description: HCM-Cloud professional human resources platform in the cloud download Arbitrary file read vulnerability.
  tags: hcm-cloud,lfi,hcm,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/model_report/file/download?index=/&ext=/etc/passwd"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: ESPEasy Installation Exposure

Input:
Title: ESPEasy Installation Exposure
Summary: ESPEasy Installation Exposure. ESPEasy is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: espeasy-installer

info:
  name: ESPEasy Installation Exposure
  author: ritikchaddha
  severity: medium
  description: ESPEasy is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,espeasy,install,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/ESPEasy"
    matchers:
      - type: word
        words:
          - "Install ESPEasy"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2010-1601

Input:
Title: Path Traversal in joomlamart com_jacomment
Summary: Directory traversal vulnerability in the JA Comment (com_jacomment) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: joomlamart com_jacomment
Indicators: error, vulnerability detected

Output:
id: CVE-2010-1601

info:
  name: Joomla! Component JA Comment - Local File Inclusion
  author: daffainfo
  severity: medium
  description: A directory traversal vulnerability in the JA Comment (com_jacomment) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.
  tags: cve,cve2010,joomla,lfi,edb,packetstorm,joomlamart,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_jacomment&view=../../../../../../../../../../etc/passwd%00"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Smash Balloon Social Photo Feed – Easy Social Feeds Plugin Detection

Input:
Title: Smash Balloon Social Photo Feed – Easy Social Feeds Plugin Detection
Summary: Smash Balloon Social Photo Feed – Easy Social Feeds Plugin Detection
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-instagram-feed

info:
  name: Smash Balloon Social Photo Feed – Easy Social Feeds Plugin Detection
  author: ricardomaia
  severity: info
  description: Smash Balloon Social Photo Feed – Easy Social Feeds Plugin Detection
  tags: tech,wordpress,wp-plugin,top-100,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/instagram-feed/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for CVE-2024-1071

Input:
Title: SQL Injection in ultimatemember ultimate_member
Summary: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: ultimatemember ultimate_member
Indicators: error, vulnerability detected

Output:
id: CVE-2024-1071

info:
  name: WordPress Ultimate Member 2.1.3 - 2.8.2 – SQL Injection
  author: DhiyaneshDK,iamnooob
  severity: critical
  description: The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘sorting’ parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
  tags: time-based-sqli,cve,cve2024,ultimate-member,wpscan,wordpress,wp-plugin,sqli,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Command Injection

Input:
Title: Command Injection (CWE-77)
Summary: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attac
Vulnerability Type: Command Injection
Severity: medium
Indicators: vulnerability detected, error

Output:
id: CNVD-2020-46552

info:
  name: Sangfor EDR - Remote Code Execution
  author: ritikchaddha
  severity: critical
  description: Sangfor Endpoint Monitoring and Response Platform (EDR) contains a remote code execution vulnerability. An attacker could exploit this vulnerability by constructing an HTTP request which could execute arbitrary commands on the target host.
  tags: cnvd,cnvd2020,sangfor,rce,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/tool/log/c.php?strip_slashes=printf&host=nl+c.php"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Microsoft FTP Service Detect

Input:
Title: Microsoft FTP Service Detect
Summary: Microsoft FTP Service Detect. The File Transfer Protocol (FTP) is a standard network protocol used to transfer computer files between a client and server on a computer network.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: microsoft-ftp-service

info:
  name: Microsoft FTP Service Detect
  author: pussycat0x
  severity: info
  description: The File Transfer Protocol (FTP) is a standard network protocol used to transfer computer files between a client and server on a computer network.
  tags: network,ftp,microsoft,detect,detection,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2019-3403

Input:
Title: Vulnerability (CWE-863) in atlassian jira and others
Summary: The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.
Vulnerability Type: Vulnerability (CWE-863)
Severity: medium
Affected Products: atlassian jira, atlassian jira_server
Indicators: error, vulnerability detected

Output:
id: CVE-2019-3403

info:
  name: Jira - Incorrect Authorization
  author: Ganofins
  severity: medium
  description: Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 is susceptible to an incorrect authorization check in the /rest/api/2/user/picker rest resource, enabling an attacker to enumerate usernames and gain improper access.
  tags: cve,cve2019,atlassian,jira,enumeration,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/rest/api/2/user/picker?query="
    matchers:
      - type: dsl
        condition: and
      - type: word
        words:
          - "total":0"
        part: body


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - VK API

Input:
Title: Content-Security-Policy Bypass - VK API
Summary: Content-Security-Policy Bypass - VK API. Tags: xss, csp-bypass, vk-api
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: vk-api-csp-bypass

info:
  name: Content-Security-Policy Bypass - VK API
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - VK API
  tags: xss,csp-bypass,vk-api,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "vk.com"
        part: header
        condition: and


Instruction: Generate a Nuclei template for CVE-2024-40422

Input:
Title: Path Traversal in stitionai devika
Summary: The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized access to critical system files and compromise the confidentiality and integrity of the system.
Vulnerability Type: Path Traversal
Severity: critical
Affected Products: stitionai devika
Indicators: unauthorized

Output:
id: CVE-2024-40422

info:
  name: Devika v1 - Path Traversal
  author: s4e-io,alpernae
  severity: critical
  description: The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized access to critical system files and compromise the confidentiality and integrity of the system.
  tags: cve,cve2024,devika,lfi,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: regex
        part: body
      - type: word
        words:
          - "application/octet-stream"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-8963

Input:
Title: Path Traversal in ivanti endpoint_manager_cloud_services_appliance
Summary: Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
Vulnerability Type: Path Traversal
Severity: critical
Affected Products: ivanti endpoint_manager_cloud_services_appliance
Indicators: error, vulnerability detected

Output:
id: CVE-2024-8963

info:
  name: Ivanti Cloud Services Appliance - Path Traversal
  author: johnk3r
  severity: critical
  description: Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
  tags: cve,cve2024,ivanti,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/client/index.php%3F.php/gsb/users.php"
    matchers:
      - type: word
        words:
          - "Ivanti Cloud Services Appliance"
          - "User name"
          - "Set Password"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: configuration-listing

info:
  name: Sensitive Configuration Files Listing - Detect
  author: j33n1k4
  severity: medium
  description: Listing of sensitive configuration files containing items such as usernames, passwords, and IP addresses was detected.
  tags: config,listing,exposure,edb,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/config/"
    matchers:
      - type: word
        words:
          - "Index of /config"
          - "Parent Directory"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: trassir-default-login

info:
  name: Trassir WebView Default Login - Detect
  author: gtrrnr,metascan
  severity: high
  description: Trassir WebView contains a default login vulnerability. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations.
  tags: default-login,trassir,webview,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""success" :"
          - ""sid" :"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-36347

Input:
Title: Vulnerability (CWE-306) in codekop codekop
Summary: A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data.
Vulnerability Type: Vulnerability (CWE-306)
Severity: high
Affected Products: codekop codekop
Indicators: error, vulnerability detected

Output:
id: CVE-2023-36347

info:
  name: POS Codekop v2.0 - Broken Authentication
  author: princechaddha
  severity: high
  description: A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data.
  tags: cve,cve2023,codekop,pos,auth-bypass,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/excel.php"
      - "{{BaseURL}}/pos-kasir-php/excel.php"
    matchers:
      - type: word
        words:
          - "<title>Document"
        part: body
      - type: word
        words:
          - "application/vnd.ms-excel"
        part: header


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: gradle-cache-node-detect

info:
  name: Gradle Enterprise Build Cache Node Login Panel - Detect
  author: Adam Crosser,righettod
  severity: info
  description: Gradle Enterprise Build Cache Node login panel was detected.
  tags: panel,gradle,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2024-33575

Input:
Title: Information Disclosure in CVE-2024-33575
Summary: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in User Meta user-meta.This issue affects User Meta: from n/a through 3.0.

Vulnerability Type: Information Disclosure
Severity: medium
Indicators: unauthorized

Output:
id: CVE-2024-33575

info:
  name: User Meta WP Plugin < 3.1 - Sensitive Information Exposure
  author: s4e-io
  severity: medium
  description: The User Meta is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0 via the /views/debug.php file. This makes it possible for unauthenticated attackers, with to extract sensitive configuration data.
  tags: wpscan,cve,cve2024,user-meta,wordpress,wp-plugin,info-leak,User Meta,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/user-meta/views/debug.php"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2014-9608

Input:
Title: Cross-Site Scripting (XSS) in netsweeper netsweeper
Summary: Cross-site scripting (XSS) vulnerability in webadmin/policy/group_table_ajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: netsweeper netsweeper
Indicators: error, vulnerability detected

Output:
id: CVE-2014-9608

info:
  name: Netsweeper 4.0.3 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in webadmin/policy/group_table_ajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
  tags: cve2014,cve,netsweeper,xss,packetstorm,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/webadmin/policy/group_table_ajax.php/%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "webadminU="
          - "webadmin="
        part: header
        condition: or
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: claris-filemaker-webdirect

info:
  name: Claris FileMaker WebDirect Panel - Detect
  author: DhiyaneshDK
  severity: info
  description: Claris FileMaker WebDirect panel was detected.
  tags: panel,edb,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/fmi/webd/"
    matchers:
      - type: word
        words:
          - "<title>Claris FileMaker WebDirect</title>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: lftp - Privilege Escalation

Input:
Title: lftp - Privilege Escalation
Summary: lftp - Privilege Escalation. lftp is a command-line file transfer program for Unix-like systems. It supports various protocols such as FTP, HTTP, SFTP, and FISH, and provides a range of features for file transfer and mirroring. lftp is known for its reliability and scriptability, making it a popular choice for automated file transfer tasks.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: privesc-lftp

info:
  name: lftp - Privilege Escalation
  author: daffainfo
  severity: high
  description: lftp is a command-line file transfer program for Unix-like systems. It supports various protocols such as FTP, HTTP, SFTP, and FISH, and provides a range of features for file transfer and mirroring. lftp is known for its reliability and scriptability, making it a popular choice for automated file transfer tasks.
  tags: code,linux,lftp,privesc,local

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: magento-admin-panel

info:
  name: Magento Admin Login Panel - Detect
  author: TechbrunchFR,ritikchaddha
  severity: info
  description: Magento admin login panel was detected.
  tags: magento,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin"
    matchers:
      - type: word
        words:
          - "Magento"
          - "Admin Panel"
        part: body
        condition: and


Instruction: Generate a Nuclei template to detect Server-Side Request Forgery

Input:
Title: Server-Side Request Forgery (CWE-918)
Summary: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Vulnerability Type: Server-Side Request Forgery
Severity: high
Indicators: vulnerability detected, error

Output:
id: gradio-image-ssrf

info:
  name: Gradio Image Component - Server-Side Request Forgery
  author: ritikchaddha
  severity: high
  description: A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio image component allows an attacker to exploit SSRF using the path value in the `/queue/join` endpoint, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.
  tags: cve,cve2024,gradio,ssrf,oast,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: fandalism

info:
  name: Fandalism User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Fandalism user name information check was conducted.
  tags: osint,osint-hobby,fandalism,discovery

http:
  - method: GET
    path:
      - "https://fandalism.com/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "fandalism_:user"
        part: body


Instruction: Generate a Nuclei template for: Besu JSON-RPC HTTP Server - Detect

Input:
Title: Besu JSON-RPC HTTP Server - Detect
Summary: Besu JSON-RPC HTTP Server - Detect. Besu is an open source Ethereum client developed under the Apache 2.0 license and written in Java. By default Besu runs a JSON-RPC HTTP server on port 8545/TCP

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: besu-server-detect

info:
  name: Besu JSON-RPC HTTP Server - Detect
  author: Nullfuzz
  severity: info
  description: Besu is an open source Ethereum client developed under the Apache 2.0 license and written in Java. By default Besu runs a JSON-RPC HTTP server on port 8545/TCP
  tags: tech,besu,ethereum,web3,blockchain,discovery

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Gozi Malware C2 - Detect

Input:
Title: Gozi Malware C2 - Detect
Summary: Gozi Malware C2 - Detect. Gozi is a banking Trojan that has been modified to include new obfuscation techniques, to evade detection. Previous breaches involving Gozi in the healthcare sector led to the compromise of data associated with 3.7 million patients costing $5.55 million.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: gozi-malware-c2

info:
  name: Gozi Malware C2 - Detect
  author: pussycat0x
  severity: info
  description: Gozi is a banking Trojan that has been modified to include new obfuscation techniques, to evade detection. Previous breaches involving Gozi in the healthcare sector led to the compromise of data associated with 3.7 million patients costing $5.55 million.
  tags: ssl,tls,c2,ir,osint,malware,gozi,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Pa11y Dashboard Exposure

Input:
Title: Pa11y Dashboard Exposure
Summary: Pa11y Dashboard Exposure. Pa11y Dashboard is exposed.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: pa11y-dashboard

info:
  name: Pa11y Dashboard Exposure
  author: tess
  severity: low
  description: Pa11y Dashboard is exposed.
  tags: misconfig,exposure,pa11y,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Pa11y Dashboard"
          - "Add new URL"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Zabbix Installation Exposure

Input:
Title: Zabbix Installation Exposure
Summary: Zabbix Installation Exposure. Zabbix is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: zabbix-installer

info:
  name: Zabbix Installation Exposure
  author: DhiyaneshDK
  severity: high
  description: Zabbix is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,zabbix,install,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/setup.php"
    matchers:
      - type: word
        words:
          - "<title>Installation</title>"
          - "zabbix"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Meta pixel for WordPress Detection

Input:
Title: Meta pixel for WordPress Detection
Summary: Meta pixel for WordPress Detection. Tags: tech, wordpress, wp-plugin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-official-facebook-pixel

info:
  name: Meta pixel for WordPress Detection
  author: ricardomaia
  severity: info
  description: Meta pixel for WordPress Detection
  tags: tech,wordpress,wp-plugin,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/official-facebook-pixel/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: Shopware Installer

Input:
Title: Shopware Installer
Summary: Shopware Installer. Shopware is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: shopware-installer

info:
  name: Shopware Installer
  author: DhiyaneshDk
  severity: high
  description: Shopware is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,shopware,install,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/public/recovery/install/index.php"
    matchers:
      - type: word
        words:
          - "Setup | Shopware"
          - "install"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: OA E-Cology LoginSSO.jsp - SQL Injection

Input:
Title: OA E-Cology LoginSSO.jsp - SQL Injection
Summary: OA E-Cology LoginSSO.jsp - SQL Injection. e-cology is an OA office system specially produced for large and medium-sized enterprises. It supports simultaneous office work on PC, mobile and WeChat terminals. There is a SQL injection vulnerability in Panwei e-cology. An attacker could exploit this vulnerability to obtain sensitive information.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: CNVD-2021-33202

info:
  name: OA E-Cology LoginSSO.jsp - SQL Injection
  author: SleepingBag945
  severity: high
  description: e-cology is an OA office system specially produced for large and medium-sized enterprises. It supports simultaneous office work on PC, mobile and WeChat terminals. There is a SQL injection vulnerability in Panwei e-cology. An attacker could exploit this vulnerability to obtain sensitive information.
  tags: cnvd2021,cnvd,e-cology,sqli,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "{{md5(num)}}"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Fastjson Version Detection

Input:
Title: Fastjson Version Detection
Summary: Fastjson Version Detection. If the server returns an exception to the client,The fastjson version will be retrieved,Fastjson versions greater than 1.2.41,Contains the latest version(1.2.76).
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: fastjson-version

info:
  name: Fastjson Version Detection
  author: yuansec
  severity: info
  description: If the server returns an exception to the client,The fastjson version will be retrieved,Fastjson versions greater than 1.2.41,Contains the latest version(1.2.76).
  tags: fastjson,tech,discovery

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "fastjson-version"


Instruction: Generate a Nuclei template for CVE-2017-18494

Input:
Title: Cross-Site Scripting (XSS) in bestwebsoft custom_search
Summary: The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: bestwebsoft custom_search
Indicators: error, vulnerability detected

Output:
id: CVE-2017-18494

info:
  name: Custom Search by BestWebSoft < 1.36 - Cross-Site Scripting
  author: luisfelipe146
  severity: medium
  description: The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.
  tags: cve,cve2017,wordpress,bws-custom-search,wpscan,wp-plugin,xss,authenticated,bestwebsoft,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - Fastly StoreMapper

Input:
Title: Content-Security-Policy Bypass - Fastly StoreMapper
Summary: Content-Security-Policy Bypass - Fastly StoreMapper
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: fastly-storemapper-csp-bypass

info:
  name: Content-Security-Policy Bypass - Fastly StoreMapper
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - Fastly StoreMapper
  tags: xss,csp-bypass,fastly-storemapper,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "fastly.net"
        part: header
        condition: and


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - GitHub Gist

Input:
Title: Content-Security-Policy Bypass - GitHub Gist
Summary: Content-Security-Policy Bypass - GitHub Gist. Tags: xss, csp-bypass, github-gist
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: github-gist-csp-bypass

info:
  name: Content-Security-Policy Bypass - GitHub Gist
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - GitHub Gist
  tags: xss,csp-bypass,github-gist,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "github.com"
        part: header
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: yahoo-japan-auction

info:
  name: Yahoo! JAPAN Auction User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Yahoo! JAPAN Auction user name information check was conducted.
  tags: osint,osint-shopping,yahoo-japan-auction,discovery

http:
  - method: GET
    path:
      - "https://auctions.yahoo.co.jp/follow/list/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "出品者"
        part: body


Instruction: Generate a Nuclei template for CVE-2022-2373

Input:
Title: Missing Authorization in nsqua simply_schedule_appointments
Summary: The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email address
Vulnerability Type: Missing Authorization
Severity: medium
Affected Products: nsqua simply_schedule_appointments
Indicators: error, vulnerability detected

Output:
id: CVE-2022-2373

info:
  name: WordPress Simply Schedule Appointments <1.5.7.7 - Information Disclosure
  author: theamanrawat,theabhinavgaur
  severity: medium
  description: WordPress Simply Schedule Appointments plugin before 1.5.7.7 is susceptible to information disclosure. The plugin is missing authorization in a REST endpoint, which can allow an attacker to retrieve user details such as name and email address.
  tags: cve,cve2022,simply-schedule-appointments,unauth,wpscan,wordpress,wp-plugin,wp,nsqua,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/ssa/v1/users"
    matchers:
      - type: word
        words:
          - "application/json"
        part: header
      - type: regex
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: WS-FTP Ad Hoc Transfer Panel - Detect

Input:
Title: WS-FTP Ad Hoc Transfer Panel - Detect
Summary: WS-FTP Ad Hoc Transfer Panel - Detect. WS_FTP Ad Hoc panel was detected.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: adhoc-transfer-panel

info:
  name: WS-FTP Ad Hoc Transfer Panel - Detect
  author: johnk3r
  severity: info
  description: WS_FTP Ad Hoc panel was detected.
  tags: panel,wsftp,ad-hoc,detect,login,progress,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/AHT/"
    matchers:
      - type: word
        words:
          - "Ad Hoc Transfer"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: lowcygierpl

info:
  name: Lowcygier.pl User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Lowcygier.pl user name information check was conducted.
  tags: osint,osint-gaming,lowcygierpl,discovery

http:
  - method: GET
    path:
      - "https://bazar.lowcygier.pl/user/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Zarejestrowany"
        part: body


Instruction: Generate a Nuclei template for: Grav CMS Detect

Input:
Title: Grav CMS Detect
Summary: Grav CMS Detect. Detects Grav CMS. Tags: tech, grav, cms
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: grav-cms-detect

info:
  name: Grav CMS Detect
  author: cyllective
  severity: info
  description: Detects Grav CMS
  tags: tech,grav,cms,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Set-Cookie: grav-site-"
        part: header
      - type: word
        words:
          - "<meta name="generator" content="GravCMS" />"
        part: body