Instruction: Generate a Nuclei template for: FTP Security Checks

Input:
Title: FTP Security Checks
Summary: FTP Security Checks. A simple workflow that runs all FTP related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: ftp-workflow

info:
  name: FTP Security Checks
  author: Mys7ic
  severity: info
  description: A simple workflow that runs all FTP related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-1392

Input:
Title: Path Traversal in commoninja videos_sync_pdf
Summary: The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues
Vulnerability Type: Path Traversal
Severity: high
Affected Products: commoninja videos_sync_pdf
Indicators: error, vulnerability detected

Output:
id: CVE-2022-1392

info:
  name: WordPress Videos sync PDF <=1.7.4 - Local File Inclusion
  author: Veshraj
  severity: high
  description: WordPress Videos sync PDF 1.7.4 and prior does not validate the p parameter before using it in an include statement, which could lead to local file inclusion.
  tags: cve,cve2022,lfi,wp-plugin,unauth,wpscan,packetstorm,wp,wordpress,commoninja,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/video-synchro-pdf/reglages/Menu_Plugins/tout.php?p=tout"
    matchers:
      - type: word
        words:
          - "failed to open stream: No such file or directory"
          - "REPERTOIRE_VIDEOSYNCPDFreglages/Menu_Plugins/tout.php"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: promodj

info:
  name: Promodj User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Promodj user name information check was conducted.
  tags: osint,osint-music,promodj,discovery

http:
  - method: GET
    path:
      - "https://promodj.com/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Favorite styles"
        part: body


Instruction: Generate a Nuclei template for CVE-2022-0776

Input:
Title: Cross-Site Scripting (XSS) in revealjs reveal.js
Summary: Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: revealjs reveal.js
Indicators: error, vulnerability detected

Output:
id: CVE-2022-0776

info:
  name: RevealJS postMessage <4.3.0 - Cross-Site Scripting
  author: LogicalHunter
  severity: medium
  description: RevealJS postMessage before 4.3.0 contains a cross-site scripting vulnerability via the document object model.
  tags: cve,cve2022,hackerone,huntr,headless,postmessage,revealjs,node.js,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-39143

Input:
Title: Path Traversal in papercut papercut_mf and others
Summary: PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled (a very common configuration).
Vulnerability Type: Path Traversal
Severity: critical
Affected Products: papercut papercut_mf, papercut papercut_ng
Indicators: error, vulnerability detected

Output:
id: CVE-2023-39143

info:
  name: PaperCut < 22.1.3 - Path Traversal
  author: pdteam
  severity: critical
  description: PaperCut NG and PaperCut MF before 22.1.3 are vulnerable to path traversal which enables attackers to read, delete, and upload arbitrary files.
  tags: cve2023,cve,lfi,papercut,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/custom-report-example/..\..\..\deployment\sharp\icons\home-app.png"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Reflected XSS

Input:
Title: Reflected XSS
Summary: Reflected XSS. Reflected cross-site scripting vulnerability was discovered via generic testing. Manual testing is needed to verify exploitation.

Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: xss-uri-reflected

info:
  name: Reflected XSS
  author: nadino,geeknik,matejsmycka
  severity: low
  description: Reflected cross-site scripting vulnerability was discovered via generic testing. Manual testing is needed to verify exploitation.
  tags: xss,generic,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/a%22%3E%3Cinjectable%3E"
      - "{{BaseURL}}/a%27%3E%3Cinjectable%3E"
    matchers:
      - type: word
        words:
          - ""><injectable>"
          - "'><injectable>"
        part: body
        condition: or
      - type: word
        words:
          - "text/html"
        part: content_type
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<title>Access Denied</title>"
          - "You don't have permission to access"
        part: body
        condition: or


Instruction: Generate a Nuclei template for CVE-2016-3510

Input:
Title: Unknown Vulnerability in oracle weblogic_server
Summary: Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability than CVE-2016-3586.
Vulnerability Type: Unknown Vulnerability
Severity: critical
Affected Products: oracle weblogic_server
Indicators: error, vulnerability detected

Output:
id: CVE-2016-3510

info:
  name: Oracle WebLogic Server Java Object Deserialization - Remote Code Execution
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability than CVE-2016-3586.
  tags: packetstorm,cve,cve2016,oracle,weblogic,t3,rce,oast,deserialization,network,tcp,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Server Monitor Installer

Input:
Title: Server Monitor Installer
Summary: Server Monitor Installer. Server Monitor is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: server-monitor-installer

info:
  name: Server Monitor Installer
  author: tess
  severity: high
  description: Server Monitor is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,monitor,exposure,install,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/install.php"
    matchers:
      - type: word
        words:
          - "<title>SERVER MONITOR - Install</title>"
          - "PHP Server Monitor - Install"
          - "install.php?action=config"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2018-11138

Input:
Title: OS Command Injection in quest kace_system_management_appliance
Summary: The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
Vulnerability Type: OS Command Injection
Severity: critical
Affected Products: quest kace_system_management_appliance
Indicators: error, vulnerability detected

Output:
id: CVE-2018-11138

info:
  name: Quest KACE System Management Appliance 8.0.318 - Remote Code Execution
  author: ritikchaddha
  severity: critical
  description: The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
  tags: cve,cve2018,quest,kace,rce,kev,passive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2021-43287

Input:
Title: Information Disclosure in thoughtworks gocd
Summary: An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers.
Vulnerability Type: Information Disclosure
Severity: high
Affected Products: thoughtworks gocd
Indicators: error, vulnerability detected

Output:
id: CVE-2021-43287

info:
  name: Pre-Auth Takeover of Build Pipelines in GoCD
  author: dhiyaneshDk
  severity: high
  description: GoCD contains a critical information disclosure vulnerability whose exploitation allows unauthenticated attackers to leak configuration information including build secrets and encryption keys.
  tags: cve2021,cve,go,lfi,gocd,thoughtworks,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/go/add-on/business-continuity/api/plugin?folderName=&pluginName=../../../etc/passwd"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Hashicorp API Token

Input:
Title: Hashicorp API Token
Summary: Hashicorp API Token. Tags: hashicorp, exposure, tokens
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: hashicorp-token

info:
  name: Hashicorp API Token
  author: DhiyaneshDK
  severity: info
  description: Hashicorp API Token
  tags: hashicorp,exposure,tokens,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Azure AKS Kubernetes API Version Not Latest

Input:
Title: Azure AKS Kubernetes API Version Not Latest
Summary: Azure AKS Kubernetes API Version Not Latest. To maximize the benefits of your Azure Kubernetes Service (AKS) clusters, it is important to ensure they are running on the latest Kubernetes version. By doing so, you gain access to new and improved features, as well as the latest security patches. The Kubernetes API upgrade becomes fully available only after it is approved by Microsoft Azure.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: azure-aks-api-version-not-latest

info:
  name: Azure AKS Kubernetes API Version Not Latest
  author: princechaddha
  severity: high
  description: To maximize the benefits of your Azure Kubernetes Service (AKS) clusters, it is important to ensure they are running on the latest Kubernetes version. By doing so, you gain access to new and improved features, as well as the latest security patches. The Kubernetes API upgrade becomes fully available only after it is approved by Microsoft Azure.
  tags: cloud,devops,azure,microsoft,kubernetes,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: nameserver-fingerprint

info:
  name: NS Record Detection
  author: pdteam
  severity: info
  description: An NS record was detected. An NS record delegates a subdomain to a set of name servers.
  tags: dns,ns,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Detects Springboot Jolokia Actuator

Input:
Title: Detects Springboot Jolokia Actuator
Summary: Detects Springboot Jolokia Actuator. Springboot Jolokia Actuator is exposed.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: springboot-jolokia

info:
  name: Detects Springboot Jolokia Actuator
  author: DhiyaneshDK
  severity: low
  description: Springboot Jolokia Actuator is exposed.
  tags: misconfig,springboot,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/jolokia"
      - "{{BaseURL}}/actuator/jolokia"
    matchers:
      - type: word
        words:
          - ""config":{"
          - ""agentId":""
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
          - "application/vnd.spring-boot.actuator"
          - "application/vnd.spring-boot.actuator.v1+json"
          - "application/vnd.spring-boot.actuator.v2+json"
          - "application/vnd.spring-boot.actuator.v3+json"
          - "text/plain"
        part: header
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: JsAPI Ticket Json

Input:
Title: JsAPI Ticket Json
Summary: JsAPI Ticket Json. JsAPI Ticket internal file is exposed.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: jsapi-ticket-json

info:
  name: JsAPI Ticket Json
  author: DhiyaneshDK
  severity: low
  description: JsAPI Ticket internal file is exposed.
  tags: exposure,jsapi,files,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/jsapi_ticket.json"
    matchers:
      - type: word
        words:
          - ""expire_time":"
          - ""jsapi_ticket":"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: OpenAM Security Checks

Input:
Title: OpenAM Security Checks
Summary: OpenAM Security Checks. A simple workflow that runs all OpenAM related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: openam-workflow

info:
  name: OpenAM Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all OpenAM related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-34599

Input:
Title: Cross-Site Scripting (XSS) in gibbonedu gibbon
Summary: Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: gibbonedu gibbon
Indicators: error, vulnerability detected

Output:
id: CVE-2023-34599

info:
  name: Gibbon v25.0.0 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.
  tags: cve2023,cve,gibbon,xss,authenticated,intrusive,gibbonedu,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "><script>alert(document.domain)</script>"
          - "gibbon"
        part: body_2
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: lastfm

info:
  name: Last.fm User Name Information - Detect
  author: princechaddha,rxerium
  severity: info
  description: Last.fm user name information check was conducted.
  tags: osint,osint-social,lastfm,discovery

http:
  - method: GET
    path:
      - "https://last.fm/user/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Music Profile | Last.fm"
        part: body


Instruction: Generate a Nuclei template for CVE-2023-33405

Input:
Title: Vulnerability (CWE-601) in blogengine blogengine.net
Summary: Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect.
Vulnerability Type: Vulnerability (CWE-601)
Severity: medium
Affected Products: blogengine blogengine.net
Indicators: error, vulnerability detected

Output:
id: CVE-2023-33405

info:
  name: BlogEngine CMS - Open Redirect
  author: Shankar Acharya
  severity: medium
  description: Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect
  tags: cve2023,cve,Blogengine,cms,redirect,blogengine,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/default.aspx?years=http://oast.pro"
    matchers:
      - type: regex
        part: header


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: dynamic-registered-broadcast-receiver

info:
  name: Android Dynamic Broadcast Receiver Register - Detect
  author: gaurang
  severity: info
  description: Android dynamic broadcast receiver register functionality was detected.
  tags: android,file

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Symfony _fragment - Detect

Input:
Title: Symfony _fragment - Detect
Summary: Symfony _fragment - Detect. Symfony servers support a "/_fragment" command that allows clients to provide custom PHP commands and return the HTML output.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: symfony-fragment

info:
  name: Symfony _fragment - Detect
  author: Palanichamy_perumal,TechbrunchFR
  severity: info
  description: Symfony servers support a "/_fragment" command that allows clients to provide custom PHP commands and return the HTML output.
  tags: config,exposure,symfony,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/_fragment"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2025-49825

Input:
Title: Vulnerability (CWE-863) in CVE-2025-49825
Summary: Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.
Vulnerability Type: Vulnerability (CWE-863)
Severity: critical
Indicators: error, vulnerability detected

Output:
id: CVE-2025-49825

info:
  name: Teleport - Authentication Bypass
  author: pdteam
  severity: critical
  description: Teleport versions prior to 17.5.2 are vulnerable to a remote authentication bypass vulnerability. This issue allows attackers to gain unauthorized access to affected systems.
  tags: cve,cve2025,teleport,passive,auth-bypass,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/webapi/ping"
    matchers:
      - type: dsl
        condition: or
      - type: dsl


Instruction: Generate a Nuclei template for: Sliver C2 - Detect

Input:
Title: Sliver C2 - Detect
Summary: Sliver C2 - Detect. Sliver is a Command and Control (C2) system made for penetration testers, red teams, and advanced persistent threats. It generates implants (slivers) that can run on virtually every architecture out there, and securely manage these connections through a central server

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: sliver-c2

info:
  name: Sliver C2 - Detect
  author: johnk3r
  severity: info
  description: Sliver is a Command and Control (C2) system made for penetration testers, red teams, and advanced persistent threats. It generates implants (slivers) that can run on virtually every architecture out there, and securely manage these connections through a central server
  tags: c2,ssl,ir,osint,malware,sliver,tls,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2017-15944

Input:
Title: Vulnerability (CWE-20) in paloaltonetworks pan-os
Summary: Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.
Vulnerability Type: Vulnerability (CWE-20)
Severity: critical
Affected Products: paloaltonetworks pan-os
Indicators: error, vulnerability detected

Output:
id: CVE-2017-15944

info:
  name: Palo Alto Network PAN-OS - Remote Code Execution
  author: emadshanab,milo2012
  severity: critical
  description: Palo Alto Network PAN-OS and Panorama before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.
  tags: cve2017,cve,kev,edb,rce,vpn,panos,globalprotect,paloaltonetworks,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "@start@Success@end@"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: PocketBase Panel - Detect

Input:
Title: PocketBase Panel - Detect
Summary: PocketBase Panel - Detect. PocketBase Login panel was discovered.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: pocketbase-panel

info:
  name: PocketBase Panel - Detect
  author: userdehghani
  severity: info
  description: PocketBase Login panel was discovered.
  tags: panel,pocketbase,login,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/_/#/login"
    matchers:
      - type: word
        words:
          - "<title>PocketBase"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-46381

Input:
Title: Path Traversal in dlink dap-1620_firmware
Summary: Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow].
Vulnerability Type: Path Traversal
Severity: high
Affected Products: dlink dap-1620_firmware
Indicators: unauthorized

Output:
id: CVE-2021-46381

info:
  name: D-Link DAP-1620 - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: D-Link DAP-1620 is susceptible to local file Inclusion due to path traversal that can  lead to unauthorized internal files reading [/etc/passwd] and [/etc/shadow].
  tags: cve2021,cve,lfi,router,packetstorm,dlink,vkev,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/apply.cgi"
    matchers:
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: S3 Bucket with Public WRITE Access

Input:
Title: S3 Bucket with Public WRITE Access
Summary: S3 Bucket with Public WRITE Access. Checks if Amazon S3 buckets are secured against public WRITE access, preventing unauthorized modifications to access control permissions.

Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: s3-public-write

info:
  name: S3 Bucket with Public WRITE Access
  author: princechaddha
  severity: critical
  description: Checks if Amazon S3 buckets are secured against public WRITE access, preventing unauthorized modifications to access control permissions.
  tags: cloud,devops,aws,amazon,s3,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Cloudlog System - SQL Injection

Input:
Title: Cloudlog System - SQL Injection
Summary: Cloudlog System - SQL Injection. Unauthorised SQL injection vulnerability in the Cloudlog system interface request_form. In addition to being able to exploit the SQL injection vulnerability to obtain information from the database, unauthenticated remote attackers can also.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: cloudlog-system-sqli

info:
  name: Cloudlog System - SQL Injection
  author: s4e-io
  severity: high
  description: Unauthorised SQL injection vulnerability in the Cloudlog system interface request_form. In addition to being able to exploit the SQL injection vulnerability to obtain information from the database, unauthenticated remote attackers can also.
  tags: cloudlog,sqli,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Improper Neutralization of Script-Related HTML Tags in a Web Page

Input:
Title: Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80)
Summary: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Vulnerability Type: Improper Neutralization of Script-Related HTML Tags in a Web Page
Severity: medium
Indicators: vulnerability detected, error

Output:
id: new-user-approve-xss

info:
  name: WordPress New User Approve <2.4.1 - Cross-Site Scripting
  author: Akincibor
  severity: medium
  description: WordPress New User Approve 2.4.1 does not escape some URLs before outputting them back in attributes, leading to reflected cross-site scripting.
  tags: wordpress,xss,authenticated,wp-plugin,wpscan,wp,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "?a"><script>alert(1)</script>&new-user-approve-settings"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Etcd Server - Unauthenticated Access

Input:
Title: Etcd Server - Unauthenticated Access
Summary: Etcd Server - Unauthenticated Access. A Kubernetes etcd server stores the cluster secrets and configurations files. Anonymous access on etcd allows unauthenticated access the data without providing any authentication credentials.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: unauth-etcd-server

info:
  name: Etcd Server - Unauthenticated Access
  author: sharath,pussycat0x
  severity: high
  description: A Kubernetes etcd server stores the cluster secrets and configurations files. Anonymous access on etcd allows unauthenticated access the data without providing any authentication credentials.
  tags: tech,k8s,kubernetes,devops,etcd,unauth,anonymous,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/v2/keys/"
    matchers:
      - type: word
        words:
          - ""node":"
          - ""key":"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-32640

Input:
Title: SQL Injection in CVE-2024-32640
Summary: MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.6, 7.3.13, and 7.2.8 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.6, 7.3.13, and 7.2.8 contain a fix for the issue.
Vulnerability Type: SQL Injection
Severity: critical
Indicators: error, vulnerability detected

Output:
id: CVE-2024-32640

info:
  name: Mura/Masa CMS - SQL Injection
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: The Mura/Masa CMS is vulnerable to SQL Injection.
  tags: cve,cve2024,sqli,cms,masa,masacms,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: GCP Firebase Apps - Cloud Enumeration

Input:
Title: GCP Firebase Apps - Cloud Enumeration
Summary: GCP Firebase Apps - Cloud Enumeration. Searches for Firebase Apps in GCP.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: gcp-firebase-app-enum

info:
  name: GCP Firebase Apps - Cloud Enumeration
  author: initstring
  severity: info
  description: Searches for Firebase Apps in GCP.
  tags: enum,cloud,cloud-enum,gcp,discovery

http:
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: MFA not enabled on AWS Root Account

Input:
Title: MFA not enabled on AWS Root Account
Summary: MFA not enabled on AWS Root Account. Checks if Multi-Factor Authentication (MFA) is enabled for the AWS root account

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: iam-root-mfa

info:
  name: MFA not enabled on AWS Root Account
  author: princechaddha
  severity: high
  description: Checks if Multi-Factor Authentication (MFA) is enabled for the AWS root account
  tags: cloud,devops,aws,amazon,iam,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-4116

Input:
Title: Cross-Site Scripting (XSS) in phpjabbers taxi_booking_script
Summary: A vulnerability classified as problematic was found in PHP Jabbers Taxi Booking 2.0. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-235963. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: phpjabbers taxi_booking_script
Indicators: error, vulnerability detected

Output:
id: CVE-2023-4116

info:
  name: PHPJabbers Taxi Booking 2.0 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: A vulnerability classified as problematic was found in PHP Jabbers Taxi Booking 2.0. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be launched remotely.
  tags: cve,cve2023,packetstorm,xss,phpjabbers,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?controller=pjFrontPublic&action=pjActionSearch&locale=1&index=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: airnotifier-panel

info:
  name: AirNotifier Login Panel - Detect
  author: tess
  severity: info
  description: AirNotifier login panel was detected.
  tags: panel,airnotifier,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/auth/login"
    matchers:
      - type: word
        words:
          - "AirNotifier"
          - "Stats"
          - "Server Info"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-24300

Input:
Title: Cross-Site Scripting (XSS) in pickplugins product_slider_for_woocommerce
Summary: The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: pickplugins product_slider_for_woocommerce
Indicators: error, vulnerability detected

Output:
id: CVE-2021-24300

info:
  name: WordPress WooCommerce <1.13.22 - Cross-Site Scripting
  author: cckuailong
  severity: medium
  description: WordPress WooCommerce before 1.13.22 contains a reflected cross-site scripting vulnerability via the slider import search feature because it does not properly sanitize the keyword GET parameter.
  tags: cve2021,cve,xss,wp,wordpress,wp-plugin,authenticated,wpscan,pickplugins,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "value="\"onmouseover=alert(document.domain);//">"
          - "PickPlugins Product Slider"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: xibocms-login

info:
  name: Xibo CMS Login Panel - Detect
  author: ritikchaddha,daffainfo
  severity: info
  description: Xibo CMS login panel was detected.
  tags: panel,xibocms,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"
    matchers:
      - type: word
        words:
          - "xibo-cms"
          - "class="XiboFormButton"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: rsyncd-service-detect

info:
  name: Rsyncd Service - Detect
  author: vsh00t,geeknik
  severity: info
  description: Rsyncd service was detected.
  tags: network,rsyncd,detect,detection,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: GKE Clusters Without Binary Authorization Enabled

Input:
Title: GKE Clusters Without Binary Authorization Enabled
Summary: GKE Clusters Without Binary Authorization Enabled. Ensure that Binary Authorization is enabled for your Google Kubernetes Engine (GKE) clusters to enforce container image security policies. Binary Authorization enhances security by ensuring only trusted container images can be deployed, reducing the risk of deploying vulnerable or unauthorized software.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: gcloud-gke-binary-authorization-disabled

info:
  name: GKE Clusters Without Binary Authorization Enabled
  author: princechaddha
  severity: medium
  description: Ensure that Binary Authorization is enabled for your Google Kubernetes Engine (GKE) clusters to enforce container image security policies. Binary Authorization enhances security by ensuring only trusted container images can be deployed, reducing the risk of deploying vulnerable or unauthorized software.
  tags: cloud,devops,gcp,gcloud,gke,kubernetes,security,container,authorization,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Android Exported Providers - Detect

Input:
Title: Android Exported Providers - Detect
Summary: Android Exported Providers - Detect. Detects exported content providers declared in the app’s AndroidManifest.xml, excluding those added by dependency libraries.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: exported-providers

info:
  name: Android Exported Providers - Detect
  author: 7h3b4dger
  severity: info
  description: Detects exported content providers declared in the app’s AndroidManifest.xml, excluding those added by dependency libraries.
  tags: android,file,exportedcomponents

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Seeyon OA A6 createMysql.jsp Database - Information Disclosure

Input:
Title: Seeyon OA A6 createMysql.jsp Database - Information Disclosure
Summary: Seeyon OA A6 createMysql.jsp Database - Information Disclosure. Seeyon OA A6 has leaked sensitive database information. An attacker can obtain the database account and password MD5 by accessing a specific URL.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: seeyon-createmysql-exposure

info:
  name: Seeyon OA A6 createMysql.jsp Database - Information Disclosure
  author: SleepingBag945
  severity: medium
  description: Seeyon OA A6 has leaked sensitive database information. An attacker can obtain the database account and password MD5 by accessing a specific URL.
  tags: seeyon,oa,info-leak,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/yyoa/createMysql.jsp"
      - "{{BaseURL}}/yyoa/ext/createMysql.jsp"
    matchers:
      - type: word
        words:
          - "root</br>"
        part: body
      - type: regex
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Jira Unauthenticated Admin Projects

Input:
Title: Jira Unauthenticated Admin Projects
Summary: Jira Unauthenticated Admin Projects. Tags: atlassian, jira, vuln
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: jira-unauthenticated-adminprojects

info:
  name: Jira Unauthenticated Admin Projects
  author: TESS
  severity: info
  description: Jira Unauthenticated Admin Projects
  tags: atlassian,jira,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/rest/menu/latest/admin"
    matchers:
      - type: word
        words:
          - "key"
          - "link"
          - "label"
          - "self"
        condition: and
      - type: status
        status:
          - 200
      - type: word
        words:
          - "atlassian.xsrf.token"
        part: header


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: symfony-profiler

info:
  name: Symfony Profiler - Detect
  author: pdteam
  severity: high
  description: Symfony profiler was detected.
  tags: config,exposure,symfony,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/_profiler/empty/search/results?limit=10"
      - "{{BaseURL}}/app_dev.php/_profiler/empty/search/results?limit=10"
      - "{{BaseURL}}/index.php/_profiler/empty/search/results?limit=10"
      - "{{BaseURL}}/index_dev.php/_profiler/empty/search/results?limit=10"
      - "{{BaseURL}}/dev.php/_profiler/empty/search/results?limit=10"
      - "{{BaseURL}}/debug.php/_profiler/empty/search/results?limit=10"
      - "{{BaseURL}}/_debug/_profiler/empty/search/results?limit=10"
      - "{{BaseURL}}/web/_profiler/empty/search/results?limit=10"
      - "{{BaseURL}}/public/_profiler/empty/search/results?limit=10"
      - "{{BaseURL}}/frontend_dev.php/_profiler/empty/search/results?limit=10"
      - "{{BaseURL}}/backend_dev.php/_profiler/empty/search/results?limit=10"
      - "{{BaseURL}}/api_dev.php/_profiler/empty/search/results?limit=10"
      - "{{BaseURL}}/app.php/_profiler/empty/search/results?limit=10"
      - "{{BaseURL}}/app_test.php/_profiler/empty/search/results?limit=10"
      - "{{BaseURL}}/test.php/_profiler/empty/search/results?limit=10"
      - "{{BaseURL}}/symfony/_profiler/empty/search/results?limit=10"
      - "{{BaseURL}}/debug/_profiler/empty/search/results?limit=10"
      - "{{BaseURL}}/dev/_profiler/empty/search/results?limit=10"
      - "{{BaseURL}}/profiler/empty/search/results?limit=10"
    matchers:
      - type: word
        words:
          - "Symfony Profiler"
          - "<title>Profiler</title>"
          - "Symfony-Debug-Toolbar"
        part: body


Instruction: Generate a Nuclei template to detect Improper Neutralization of Script-Related HTML Tags in a Web Page

Input:
Title: Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80)
Summary: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Vulnerability Type: Improper Neutralization of Script-Related HTML Tags in a Web Page
Severity: medium
Indicators: vulnerability detected, error

Output:
id: wptouch-xss

info:
  name: WordPress WPtouch <4.3.44 - Cross-Site Scripting
  author: akincibor
  severity: medium
  description: WordPress WPtouch plugin prior to 4.3.44 contains a cross-site scripting vulnerability. The plugin does not escape some URLs before outputting them back in attributes. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: wp-plugin,wp,wordpress,xss,authenticated,wptouch,wpscan,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "WPtouchCustom"
          - "WPtouchAjax"
          - "toplevel_page_wptouch-admin"
        part: body
        condition: or
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2018-10823

Input:
Title: OS Command Injection in dlink dwr-116_firmware and others
Summary: An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals.
Vulnerability Type: OS Command Injection
Severity: high
Affected Products: dlink dwr-116_firmware, dlink dwr-512_firmware, dlink dwr-912_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2018-10823

info:
  name: D-Link Routers - Remote Command Injection
  author: wisnupramoedya
  severity: high
  description: D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 device may allow an authenticated attacker to execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for full control over the device internals.
  tags: cve,cve2018,rce,iot,dlink,router,edb,seclists,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/chkisg.htm%3FSip%3D1.1.1.1%20%7C%20cat%20%2Fetc%2Fpasswd"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-0968

Input:
Title: Vulnerability (CWE-190) in microweber microweber
Summary: The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12.
Vulnerability Type: Vulnerability (CWE-190)
Severity: medium
Affected Products: microweber microweber
Indicators: error, vulnerability detected

Output:
id: CVE-2022-0968

info:
  name: Microweber <1.2.12 - Integer Overflow
  author: amit-jd
  severity: medium
  description: Microweber before 1.2.12 is susceptible to integer overflow. The application allows large characters to insert in the input field 'first & last name,' which can allow an attacker to cause a denial of service via a crafted HTTP request.
  tags: cve,cve2022,overflow,microweber,cms,huntr,dos,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2010-0972

Input:
Title: Path Traversal in g4j.laoneo com_gcalendar
Summary: Directory traversal vulnerability in the GCalendar (com_gcalendar) component 2.1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: g4j.laoneo com_gcalendar
Indicators: error, vulnerability detected

Output:
id: CVE-2010-0972

info:
  name: Joomla! Component com_gcalendar Suite 2.1.5 - Local File Inclusion
  author: daffainfo
  severity: high
  description: A directory traversal vulnerability in the GCalendar (com_gcalendar) component 2.1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
  tags: cve2010,cve,edb,joomla,lfi,g4j.laoneo,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_gcalendar&controller=../../../../../etc/passwd%00"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: PHPUnit Result Cache File Exposure

Input:
Title: PHPUnit Result Cache File Exposure
Summary: PHPUnit Result Cache File Exposure. PHPUnit cache file is exposed.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: phpunit-result-cache-exposure

info:
  name: PHPUnit Result Cache File Exposure
  author: DhiyaneshDk
  severity: low
  description: PHPUnit cache file is exposed.
  tags: config,exposure,devops,files,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.phpunit.result.cache"
    matchers:
      - type: word
        words:
          - ""defects""
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-29214

Input:
Title: SQL Injection in alumni_management_system_project alumni_management_system
Summary: SQL injection vulnerability in SourceCodester Alumni Management System 1.0 allows the user to inject SQL payload to bypass the authentication via admin/login.php.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: alumni_management_system_project alumni_management_system
Indicators: error, vulnerability detected

Output:
id: CVE-2020-29214

info:
  name: Alumni Management System 1.0 - SQL Injection
  author: arafatansari
  severity: critical
  description: SourceCodester Alumni Management System 1.0 contains a sql_injection caused by unsanitized input in admin/login.php, letting attackers bypass authentication, exploit requires injection of malicious SQL payload.
  tags: cve,cve2020,sqli,auth-bypass,cms,edb,alumni,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Welcome back Admin!"
          - "Alumni List"
        part: body
        condition: and
      - type: word
        words:
          - "#login-form"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2012-4273

Input:
Title: Cross-Site Scripting (XSS) in ppfeufer 2-click-social-media-buttons
Summary: Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: ppfeufer 2-click-social-media-buttons
Indicators: error, vulnerability detected

Output:
id: CVE-2012-4273

info:
  name: 2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter.
  tags: cve,cve2012,wordpress,xss,wp-plugin,packetstorm,ppfeufer,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "2 Click Social Media Buttons"
          - "Tags:"
        condition: and
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/2-click-socialmedia-buttons/libs/xing.php?xing-url=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: MantisBT Installation Exposure

Input:
Title: MantisBT Installation Exposure
Summary: MantisBT Installation Exposure. MantisBT is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: mantisbt-installer

info:
  name: MantisBT Installation Exposure
  author: DhiyaneshDK
  severity: high
  description: MantisBT is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,mantisbt,install,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin/install.php"
    matchers:
      - type: word
        words:
          - "Administration - Installation - MantisBT"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2015-2996

Input:
Title: Path Traversal in sysaid sysaid
Summary: Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the fileName parameter to getGfiUpgradeFile or (2) cause a denial of service (CPU and memory consumption) via a .. (dot dot) in the fileName parameter to calculateRdsFileChecksum.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: sysaid sysaid
Indicators: error, vulnerability detected

Output:
id: CVE-2015-2996

info:
  name: SysAid Help Desk <15.2 - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: SysAid Help Desk before 15.2 contains multiple local file inclusion vulnerabilities which can allow remote attackers to read arbitrary files via .. (dot dot) in the fileName parameter of getGfiUpgradeFile or cause a denial of service (CPU and memory consumption) via .. (dot dot) in the fileName parameter of calculateRdsFileChecksum.
  tags: cve2015,cve,sysaid,lfi,seclists,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/sysaid/getGfiUpgradeFile?fileName=../../../../../../../etc/passwd"
      - "{{BaseURL}}/getGfiUpgradeFile?fileName=../../../../../../../etc/passwd"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-28000

Input:
Title: Vulnerability (CWE-266) in litespeedtech litespeed_cache
Summary: Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from 1.9 through 6.3.0.1.
Vulnerability Type: Vulnerability (CWE-266)
Severity: critical
Affected Products: litespeedtech litespeed_cache
Indicators: error, vulnerability detected

Output:
id: CVE-2024-28000

info:
  name: WordPress LiteSpeed Cache - Unauthenticated Privilege Escalation to Admin
  author: melmathari
  severity: critical
  description: Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from 1.9 through 6.3.0.1.
  tags: cve,cve2024,wordpress,wp,wp-plugin,litespeed-cache,priv-esc,intrusive,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: ICO Malware Hash - Detect

Input:
Title: ICO Malware Hash - Detect
Summary: ICO Malware Hash - Detect. Detection of malicious ICO files used in 3CX compromise
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: ico-malware-hash

info:
  name: ICO Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: Detection of malicious ICO files used in 3CX compromise
  tags: malware,uta0040

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Cross-site Scripting

Input:
Title: Cross-site Scripting (CWE-79)
Summary: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. There are many variants of cross-site scripting, characterized by a variety of terms or involving different attack topologies. However, they all indicate the same fundamental weakness: improper neutralization of dangerous input between the adversary and a victim.
Vulnerability Type: Cross-site Scripting
Severity: high
Indicators: vulnerability detected, error

Output:
id: wildcard-postmessage

info:
  name: postMessage - Cross-Site Scripting
  author: pdteam
  severity: info
  description: postMessage contains a cross-site scripting vulnerability. An attacker can execute arbitrary script and therefore steal cookie-based authentication credentials and launch other attacks.
  tags: xss,postmessage,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: regex


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: garmin-connect

info:
  name: Garmin connect User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Garmin connect user name information check was conducted.
  tags: osint,osint-health,garmin-connect,discovery

http:
  - method: GET
    path:
      - "https://connect.garmin.com/modern/profile/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "window.ERROR_VIEW = null"
        part: body


Instruction: Generate a Nuclei template for CVE-2025-54125

Input:
Title: Vulnerability (CWE-359) in xwiki xwiki
Summary: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 1.1 through 16.4.6, 16.5.0-rc-1 through 16.10.4 and 17.0.0-rc-1 through 17.1.0, the XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending ?xpage=xml to the URL includes password and email properties stored on a document that aren't named password or email. This is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1. To work around this issue, the file templates/xml.vm in the deployed WAR can be deleted if the XML isn't needed. There isn't any feature in XWiki itself that depends on the XML export.
Vulnerability Type: Vulnerability (CWE-359)
Severity: medium
Affected Products: xwiki xwiki
Indicators: error, vulnerability detected

Output:
id: CVE-2025-54125

info:
  name: XWiki XML View - Sensitive Information Exposure
  author: ritikchaddha
  severity: high
  description: A vulnerability in XWiki's XML view functionality exposes sensitive information such as passwords and email addresses that are stored in custom fields not explicitly named as password or email. This information disclosure occurs when accessing user profiles with the xml.vm template.
  tags: cve,cve2025,xwiki,exposure,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}{{path}}"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-2227

Input:
Title: Vulnerability (CWE-285) in modoboa modoboa
Summary: Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0.
Vulnerability Type: Vulnerability (CWE-285)
Severity: critical
Affected Products: modoboa modoboa
Indicators: error, vulnerability detected

Output:
id: CVE-2023-2227

info:
  name: Modoboa < 2.1.0 - Improper Authorization
  author: ritikchaddha,princechaddha
  severity: critical
  description: Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0.
  tags: cve,cve2023,modoboa,exposure,disclosure,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "label":"
          - "default_password":"
          - "authentication_type":"local"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Atlantis Dashboard - Exposure

Input:
Title: Atlantis Dashboard - Exposure
Summary: Atlantis Dashboard - Exposure. Atlantis Dashboard was discovered.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: atlantis-dashboard

info:
  name: Atlantis Dashboard - Exposure
  author: DhiyaneshDK
  severity: medium
  description: Atlantis Dashboard was discovered.
  tags: misconfig,atlantis,runatlantis,exposure,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Repository"
          - "Project"
          - "Workspace"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Path Traversal

Input:
Title: Path Traversal (CWE-22)
Summary: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escap
Vulnerability Type: Path Traversal
Severity: high
Indicators: unexpected

Output:
id: erp-nc-directory-traversal

info:
  name: ERP-NC - Local File Inclusion
  author: pikpikcu
  severity: high
  description: ERP-NC is vulnerable to local file inclusion.
  tags: lfi,erp-nc,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/NCFindWeb?service=IPreAlertConfigService&filename="
    matchers:
      - type: word
        words:
          - "Client"
          - "ncwslogin.jsp"
          - "admin.jsp"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: ACM Certificates Pre-expiration Renewal

Input:
Title: ACM Certificates Pre-expiration Renewal
Summary: ACM Certificates Pre-expiration Renewal. Ensure AWS ACM SSL/TLS certificates are renewed at least 30 days before expiration to prevent service disruptions.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: acm-cert-renewal-30days

info:
  name: ACM Certificates Pre-expiration Renewal
  author: princechaddha
  severity: medium
  description: Ensure AWS ACM SSL/TLS certificates are renewed at least 30 days before expiration to prevent service disruptions.
  tags: cloud,devops,aws,amazon,acm,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-3094

Input:
Title: Vulnerability (CWE-506) in tukaani xz
Summary: Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
Vulnerability Type: Vulnerability (CWE-506)
Severity: critical
Affected Products: tukaani xz
Indicators: error, vulnerability detected

Output:
id: CVE-2024-3094

info:
  name: XZ - Embedded Malicious Code
  author: pdteam
  severity: critical
  description: Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
  tags: cve,cve2024,local,code,xz,backdoor,tukaani,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Poste.io Admin Panel - Detect

Input:
Title: Poste.io Admin Panel - Detect
Summary: Poste.io Admin Panel - Detect. Poste.io login panel was detected.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: posteio-admin-panel

info:
  name: Poste.io Admin Panel - Detect
  author: ritikchaddha
  severity: info
  description: Poste.io login panel was detected.
  tags: panel,poste,login,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin/login"
    matchers:
      - type: word
        words:
          - "poste<span"
          - "Administration login"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-0012

Input:
Title: Vulnerability (CWE-306) in paloaltonetworks pan-os
Summary: An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like  CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 .

The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software.

Cloud NGFW and Prisma Access are not impacted by this vulnerability.
Vulnerability Type: Vulnerability (CWE-306)
Severity: critical
Affected Products: paloaltonetworks pan-os
Indicators: error, vulnerability detected

Output:
id: CVE-2024-0012

info:
  name: PAN-OS Management Web Interface - Authentication Bypass
  author: johnk3r,watchtowr
  severity: critical
  description: An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities
  tags: cve,cve2024,paloalto,globalprotect,kev,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Weaver E-Cology BeanShell - Remote Command Execution

Input:
Title: Weaver E-Cology BeanShell - Remote Command Execution
Summary: Weaver E-Cology BeanShell - Remote Command Execution. Weaver BeanShell contains a remote command execution vulnerability in the bsh.servlet.BshServlet program.

Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: weaver-ecology-bshservlet-rce

info:
  name: Weaver E-Cology BeanShell - Remote Command Execution
  author: SleepingBag945
  severity: critical
  description: Weaver BeanShell contains a remote command execution vulnerability in the bsh.servlet.BshServlet program.
  tags: beanshell,rce,weaver,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Netsparker Enterprise Installer

Input:
Title: Netsparker Enterprise Installer
Summary: Netsparker Enterprise Installer. Netsparker Enterprise is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: netsparker-enterprise-installer

info:
  name: Netsparker Enterprise Installer
  author: pussycat0x
  severity: info
  description: Netsparker Enterprise is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,exposure,install,netsparker,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wizard/database/"
    matchers:
      - type: word
        words:
          - "Netsparker Enterprise - Installation Wizard"
          - "Netsparker Ltd"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Rails Debug Mode

Input:
Title: Rails Debug Mode
Summary: Rails Debug Mode. Rails debug mode is enabled.. Tags: debug, rails, exposure
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: rails-debug-mode

info:
  name: Rails Debug Mode
  author: pdteam
  severity: medium
  description: Rails debug mode is enabled.
  tags: debug,rails,exposure,intrusive,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/{{randstr}}"
    matchers:
      - type: word
        words:
          - "Rails.root:"
          - "Action Controller: Exception caught"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: Pipeline Configuration Exposure

Input:
Title: Pipeline Configuration Exposure
Summary: Pipeline Configuration Exposure. Tags: devops, exposure, cicd
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: pipeline-configuration

info:
  name: Pipeline Configuration Exposure
  author: DhiyaneshDK
  severity: info
  description: Pipeline Configuration Exposure
  tags: devops,exposure,cicd,files,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/pipeline.yaml"
    matchers:
      - type: word
        words:
          - "system:"
          - "project_name:"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: HiveQueue Agent

Input:
Title: HiveQueue Agent
Summary: HiveQueue Agent. HiveQueue Agent is exposed.. Tags: misconfig, hivequeue, vuln
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: hivequeue-agent

info:
  name: HiveQueue Agent
  author: DhiyaneshDk
  severity: low
  description: HiveQueue Agent is exposed.
  tags: misconfig,hivequeue,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/monitoring"
    matchers:
      - type: word
        words:
          - "<title>HiveQueue Agent</title>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Google Static Maps API Test

Input:
Title: Google Static Maps API Test
Summary: Google Static Maps API Test. Tags: token-spray, google, maps
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-googlestaticmaps

info:
  name: Google Static Maps API Test
  author: zzeitlin
  severity: info
  description: Google Static Maps API Test
  tags: token-spray,google,maps

http:
  - method: GET
    path:
      - "https://maps.googleapis.com/maps/api/staticmap?center=45%2C10&zoom=7&size=400x400&key={{token}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: New Relic NerdGraph API Test

Input:
Title: New Relic NerdGraph API Test
Summary: New Relic NerdGraph API Test. Tags: token-spray, newrelic, nerdgraph
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-nerdgraph

info:
  name: New Relic NerdGraph API Test
  author: zzeitlin
  severity: info
  description: New Relic NerdGraph API Test
  tags: token-spray,newrelic,nerdgraph

http:
  - method: POST
    path:
      - "https://api.newrelic.com/graphql"
    matchers:
      - type: word
        words:
          - "errors"
        part: body


Instruction: Generate a Nuclei template for CVE-2023-46818

Input:
Title: Code Injection in ispconfig ispconfig
Summary: An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled.
Vulnerability Type: Code Injection
Severity: high
Affected Products: ispconfig ispconfig
Indicators: error, vulnerability detected

Output:
id: CVE-2023-46818

info:
  name: ISPConfig - PHP Code Injection
  author: non-things
  severity: high
  description: An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled.
  tags: cve,cve2023,ispconfig,php,rce,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: dsl
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "{{echo-cmd-hash}}"
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-39226

Input:
Title: Authentication Bypass in grafana grafana and others
Summary: Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.
Vulnerability Type: Authentication Bypass
Severity: critical
Affected Products: grafana grafana, fedoraproject fedora
Indicators: error, vulnerability detected

Output:
id: CVE-2021-39226

info:
  name: Grafana Snapshot - Authentication Bypass
  author: Evan Rubinstein
  severity: high
  description: Grafana instances up to 7.5.11 and 8.1.5 allow remote unauthenticated users to view the snapshot associated with the lowest database key by accessing the literal paths /api/snapshot/:key or /dashboard/snapshot/:key. If the snapshot is in public mode, unauthenticated users can delete snapshots by accessing the endpoint /api/snapshots-delete/:deleteKey. Authenticated users can also delete snapshots by accessing the endpoints /api/snapshots-delete/:deleteKey, or sending a delete request to /api/snapshot/:key, regardless of whether or not the snapshot is set to public mode (disabled by default).
  tags: cve2021,cve,grafana,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/snapshots/:key"
    matchers:
      - type: word
        words:
          - ""isSnapshot":true"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-46422

Input:
Title: OS Command Injection in telesquare sdt-cs3b1_firmware
Summary: Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.
Vulnerability Type: OS Command Injection
Severity: critical
Affected Products: telesquare sdt-cs3b1_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2021-46422

info:
  name: SDT-CW3B1 1.1.0 - OS Command Injection
  author: badboycxcc,prajiteshsingh
  severity: critical
  description: Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.
  tags: cve2021,cve,packetstorm,telesquare,rce,router,injection,edb,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/admin.cgi?Command=sysCommand&Cmd={{cmd}}"
    matchers:
      - type: word
        words:
          - "<CmdResult>"
        part: body
      - type: word
        words:
          - "dns"
        part: interactsh_protocol


Instruction: Generate a Nuclei template for: Ncast HD Intelligent Recording - Arbitrary File Reading

Input:
Title: Ncast HD Intelligent Recording - Arbitrary File Reading
Summary: Ncast HD Intelligent Recording - Arbitrary File Reading. Ncast HD intelligent recording and broadcasting system has an arbitrary file reading vulnerability.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: ncast-lfi

info:
  name: Ncast HD Intelligent Recording - Arbitrary File Reading
  author: pussycat0x
  severity: high
  description: Ncast HD intelligent recording and broadcasting system has an arbitrary file reading vulnerability.
  tags: ncast,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/developLog/downloadLog.php?name=../../../../etc/passwd"
    matchers:
      - type: regex
        part: body
      - type: word
        words:
          - "application/force-download"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: apollo-adminservice-unauth

info:
  name: Apollo Admin Service - Unauthenticated Access
  author: j4vaovo
  severity: medium
  description: ApolloAdminservice was able to be accessed without authentication.
  tags: misconfig,unauth,apollo,apolloadminservice,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/apps"
    matchers:
      - type: word
        words:
          - "appId"
          - "orgName"
          - "ownerName"
          - "dataChangeCreatedBy"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: keycloak-openid-config

info:
  name: Keycloak OpenID Configuration - Detect
  author: rodnt
  severity: info
  description: Keycloak Openid configuration information was detected.
  tags: keycloak,config,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.well-known/openid-configuration"
      - "{{BaseURL}}/auth/realms/master/.well-known/openid-configuration"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "issuer"
          - "authorization_endpoint"
          - "token_endpoint"
          - "userinfo_endpoint"
          - "jwks_uri"
        condition: and


Instruction: Generate a Nuclei template for: Meilisearch - Detect

Input:
Title: Meilisearch - Detect
Summary: Meilisearch - Detect. An open-source, blazingly fast, and hyper-relevant search engine that will improve your search experience.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: meilisearch-detect

info:
  name: Meilisearch - Detect
  author: userdehghani
  severity: info
  description: An open-source, blazingly fast, and hyper-relevant search engine that will improve your search experience.
  tags: meilisearch,detect,tech,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-29204

Input:
Title: Vulnerability (CWE-601) in xwiki xwiki
Summary: XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.

Vulnerability Type: Vulnerability (CWE-601)
Severity: medium
Affected Products: xwiki xwiki
Indicators: error, vulnerability detected

Output:
id: CVE-2023-29204

info:
  name: XWiki - Open Redirect
  author: ritikchaddha
  severity: medium
  description: XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.
  tags: cve,cve2023,xwiki,redirect,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/bin/login/XWiki/XWikiLogin?xredirect=//www.oast.me"
      - "{{BaseURL}}/bin/login/XWiki/XWikiLogin?xredirect=http:/www.oast.me"
    matchers:
      - type: regex
        part: header


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: parallels-html-client

info:
  name: Parallels HTML5 Client Login Panel - Detect
  author: pdteam
  severity: info
  description: Parallels HTML5 Client login panel was detected.
  tags: panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/RASHTML5Gateway/"
    matchers:
      - type: word
        words:
          - "<title>Parallels HTML5 Client</title>"
        part: body


Instruction: Generate a Nuclei template for: DigitalOcean Personal Access Token

Input:
Title: DigitalOcean Personal Access Token
Summary: DigitalOcean Personal Access Token. Tags: digitalocean, exposure, token
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: digital-ocean-personal-token

info:
  name: DigitalOcean Personal Access Token
  author: DhiyaneshDK
  severity: info
  description: DigitalOcean Personal Access Token
  tags: digitalocean,exposure,token,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Pantheon upstream.yml Disclosure

Input:
Title: Pantheon upstream.yml Disclosure
Summary: Pantheon upstream.yml Disclosure. Public Pantheon YAML Configuration Files might include sensitive info
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: pantheon-upstream

info:
  name: Pantheon upstream.yml Disclosure
  author: DhiyaneshDK
  severity: low
  description: Public Pantheon YAML Configuration Files might include sensitive info
  tags: exposure,devops,patheon,config,files,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/pantheon.upstream.yml"
    matchers:
      - type: word
        words:
          - "database:"
          - "protected_web_paths:"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-36284

Input:
Title: SQL Injection in webkul qloapps
Summary: An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web application's authentication and authorization mechanisms and retrieve the contents of an entire database.
Vulnerability Type: SQL Injection
Severity: high
Affected Products: webkul qloapps
Indicators: error, vulnerability detected

Output:
id: CVE-2023-36284

info:
  name: QloApps 1.6.0 - SQL Injection
  author: ritikchaddha
  severity: high
  description: An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameters date_from, date_to, and id_product allows a remote attacker to retrieve the contents of an entire database.
  tags: time-based-sqli,cve,cve2023,qloapps,sqli,webkul,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "QloApps"
        part: body
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: vertex-tax-panel

info:
  name: Vertex Tax Installer Panel - Detect
  author: ritikchaddha
  severity: info
  description: Vertex Tax Installer panel was detected.
  tags: panel,vertex,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Vertex Tax Installer"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-6421

Input:
Title: Vulnerability (CWE-522) in w3eden download_manager
Summary: The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one.
Vulnerability Type: Vulnerability (CWE-522)
Severity: high
Affected Products: w3eden download_manager
Indicators: error, vulnerability detected

Output:
id: CVE-2023-6421

info:
  name: WordPress Download Manager - File Password Exposure
  author: ritikchaddha
  severity: medium
  description: The WordPress Download Manager plugin contains a vulnerability that allows attackers to obtain passwords for password-protected downloads by sending a specially crafted request to the validate-password API endpoint.
  tags: cve,cve2023,wp,wordpress,wp-plugin,exposure,download-manager,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""success""
          - "op":""
          - "Wrong Password"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-5191

Input:
Title: Cross-Site Scripting (XSS) in phpgurukul hospital_management_system
Summary: PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple Persistent XSS vulnerabilities.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: phpgurukul hospital_management_system
Indicators: error, vulnerability detected

Output:
id: CVE-2020-5191

info:
  name: PHPGurukul Hospital Management System - Cross-Site Scripting
  author: TenBird
  severity: medium
  description: PHPGurukul Hospital Management System in PHP 4.0 contains multiple cross-site scripting vulnerabilities. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.
  tags: cve2020,cve,hms,cms,xss,authenticated,edb,phpgurukul,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<td class="hidden-xs"></td><script>alert(document.domain);</script><td>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-37190

Input:
Title: Unknown Vulnerability in cuppacms cuppacms
Summary: CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An authenticated user can control both parameters (action and function) from "/api/index.php.
Vulnerability Type: Unknown Vulnerability
Severity: high
Affected Products: cuppacms cuppacms
Indicators: error, vulnerability detected

Output:
id: CVE-2022-37190

info:
  name: Cuppa CMS v1.0 - Remote Code Execution
  author: theamanrawat
  severity: high
  description: CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An authenticated user can control both parameters (action and function) from "/api/index.php.
  tags: cve2022,cve,rce,cuppa,authenticated,cuppacms,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "text/html"
        part: header_3
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-30525

Input:
Title: OS Command Injection in zyxel usg_flex_100w_firmware and others
Summary: A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
Vulnerability Type: OS Command Injection
Severity: critical
Affected Products: zyxel usg_flex_100w_firmware, zyxel usg_flex_200_firmware, zyxel usg_flex_500_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2022-30525

info:
  name: Zyxel Firewall - OS Command Injection
  author: h1ei1,prajiteshsingh
  severity: critical
  description: An OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, are susceptible to a command injection vulnerability which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
  tags: cve2022,cve,packetstorm,zyxel,firewall,unauth,kev,msf,rce,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol
      - type: status
        status:
          - 500


Instruction: Generate a Nuclei template to detect Open Redirect

Input:
Title: Open Redirect (CWE-601)
Summary: The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Vulnerability Type: Open Redirect
Severity: high
Indicators: vulnerability detected, error

Output:
id: shibboleth-open-redirect

info:
  name: Shibboleth SSO - Open Redirect
  author: aushack
  severity: medium
  description: Shibboleth SSO contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: redirect,shibboleth,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/Shibboleth.sso/Logout?return=https://{{randstr}}.interact.sh"
    matchers:
      - type: regex
        part: header
      - type: status
        status:
          - 302


Instruction: Generate a Nuclei template for: Kiteworks PCN Panel - Detect

Input:
Title: Kiteworks PCN Panel - Detect
Summary: Kiteworks PCN Panel - Detect. Kiteworks PCN Login Panel was detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: kiteworks-pcn-panel

info:
  name: Kiteworks PCN Panel - Detect
  author: righettod
  severity: info
  description: Kiteworks PCN Login Panel was detected.
  tags: panel,kiteworks,login,detect,accellion,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login/locales/login_en.json"
    matchers:
      - type: word
        words:
          - "Secured by Kiteworks"
          - "Return to sign in"
        part: body
        condition: and
      - type: word
        words:
          - "application/octet-stream"
        part: header
      - type: status
        status:
          - 200