Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - AngularJS Code

Input:
Title: Content-Security-Policy Bypass - AngularJS Code
Summary: Content-Security-Policy Bypass - AngularJS Code. Tags: xss, csp-bypass, angularjs-code
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: angularjs-code-csp-bypass

info:
  name: Content-Security-Policy Bypass - AngularJS Code
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - AngularJS Code
  tags: xss,csp-bypass,angularjs-code,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "angularjs.org"
        part: header
        condition: and


Instruction: Generate a Nuclei template for: Detect Basic uPNP Device

Input:
Title: Detect Basic uPNP Device
Summary: Detect Basic uPNP Device. uPNP Device was detected.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: upnp-device-detect

info:
  name: Detect Basic uPNP Device
  author: geeknik
  severity: info
  description: uPNP Device was detected.
  tags: upnp,iot,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "urn:schemas-upnp-org:device-1-0"
          - "<deviceType>"
          - "<modelName>"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: dropbox phishing Detection

Input:
Title: dropbox phishing Detection
Summary: dropbox phishing Detection. A dropbox phishing website was detected

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: dropbox-phish

info:
  name: dropbox phishing Detection
  author: rxerium
  severity: info
  description: A dropbox phishing website was detected
  tags: phishing,dropbox,osint,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Dropbox is a home for all of your work. You can store and share files, collaborate on projects and bring your best ideas to life, whether you’re working alone or as part of a team."
      - type: status
        status:
          - 200
      - type: dsl


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: soundcloud

info:
  name: SoundCloud User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: SoundCloud user name information check was conducted.
  tags: osint,osint-music,soundcloud,discovery

http:
  - method: GET
    path:
      - "https://soundcloud.com/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "SoundCloud</title>"
        part: body


Instruction: Generate a Nuclei template for: Docker Hub Login Check

Input:
Title: Docker Hub Login Check
Summary: Docker Hub Login Check. Checks for a valid Docker Hub account.
Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: docker-hub-login-check

info:
  name: Docker Hub Login Check
  author: parthmalhotra,pdresearch
  severity: critical
  description: Checks for a valid Docker Hub account.
  tags: creds-stuffing,login-check,cloud,docker,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "token"
        part: body
      - type: word
        words:
          - "Set-Cookie: token="
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: SendBird Access ID

Input:
Title: SendBird Access ID
Summary: SendBird Access ID. Tags: exposure, token, sendbird
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: sendbird-access-id

info:
  name: SendBird Access ID
  author: DhiyaneshDK
  severity: info
  description: SendBird Access ID
  tags: exposure,token,sendbird,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Tinyproxy - Detect

Input:
Title: Tinyproxy - Detect
Summary: Tinyproxy - Detect. Lightweight HTTP/HTTPS proxy daemon for POSIX operating systems

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: tinyproxy-detect

info:
  name: Tinyproxy - Detect
  author: bhutch
  severity: info
  description: Lightweight HTTP/HTTPS proxy daemon for POSIX operating systems
  tags: tech,proxy,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "server: tinyproxy"
        part: header


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: pillowfort

info:
  name: Pillowfort User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Pillowfort user name information check was conducted.
  tags: osint,osint-social,pillowfort,discovery

http:
  - method: GET
    path:
      - "https://www.pillowfort.social/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<meta property="og:site_name" content="Pillowfort">"
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: eol-magento

info:
  name: Magento End-of-life Detect
  author: dogancanbakir
  severity: info
  description: Magento end of life detection.
  tags: magento,tech,cms,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for CVE-2021-25299

Input:
Title: Cross-Site Scripting (XSS) in nagios nagios_xi
Summary: Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: nagios nagios_xi
Indicators: error, vulnerability detected

Output:
id: CVE-2021-25299

info:
  name: Nagios XI 5.7.5 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: Nagios XI 5.7.5 contains a cross-site scripting vulnerability in the file /usr/local/nagiosxi/html/admin/sshterm.php, due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal session cookies, or it can be chained with the previous bugs to get one-click remote command execution on the Nagios XI server.
  tags: cve2021,cve,nagios,nagiosxi,xss,authenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Atlassian Bamboo Setup Wizard

Input:
Title: Atlassian Bamboo Setup Wizard
Summary: Atlassian Bamboo Setup Wizard. Atlassian Bamboo is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: atlassian-bamboo-setup

info:
  name: Atlassian Bamboo Setup Wizard
  author: pussycat0x
  severity: info
  description: Atlassian Bamboo is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,atlassian,bamboo,setup,installer,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/setup/setupLicense.action"
    matchers:
      - type: word
        words:
          - "Bamboo setup wizard - Atlassian Bamboo"
          - "Bamboo evaluation license"
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - AliExpress ACS

Input:
Title: Content-Security-Policy Bypass - AliExpress ACS
Summary: Content-Security-Policy Bypass - AliExpress ACS. Tags: xss, csp-bypass, aliexpress-acs
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: aliexpress-acs-csp-bypass

info:
  name: Content-Security-Policy Bypass - AliExpress ACS
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - AliExpress ACS
  tags: xss,csp-bypass,aliexpress-acs,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "aliexpress.com"
        part: header
        condition: and


Instruction: Generate a Nuclei template for: OS Patches - Outdated

Input:
Title: OS Patches - Outdated
Summary: OS Patches - Outdated. Ensure that the latest OS patches for ECS virtual machines (VM) instances are applied in order to mitigate security vulnerabilities and ensure optimal performance and stability.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: os-patches-outdated

info:
  name: OS Patches - Outdated
  author: DhiyaneshDK
  severity: medium
  description: Ensure that the latest OS patches for ECS virtual machines (VM) instances are applied in order to mitigate security vulnerabilities and ensure optimal performance and stability.
  tags: cloud,devops,aliyun,alibaba,alibaba-cloud-config,ecs

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-10915

Input:
Title: Vulnerability (CWE-74) in dlink dns-320_firmware and others
Summary: A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation of the argument group leads to os command injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
Vulnerability Type: Vulnerability (CWE-74)
Severity: high
Affected Products: dlink dns-320_firmware, dlink dns-320lw_firmware, dlink dns-325_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2024-10915

info:
  name: D-Link NAS - Command Injection via Group Parameter
  author: s4e-io
  severity: critical
  description: A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation of the argument group leads to os command injection.
  tags: cve,cve2024,dlink,sharecenter,rce,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: or
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2021-24220

Input:
Title: Unrestricted File Upload in thrivethemes focusblog and others
Summary: Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.
Vulnerability Type: Unrestricted File Upload
Severity: critical
Affected Products: thrivethemes focusblog, thrivethemes ignition, thrivethemes luxe
Indicators: error, vulnerability detected

Output:
id: CVE-2021-24220

info:
  name: Multiple Thrive Themes < 2.0.0 -  Arbitrary File Upload
  author: pussycat0x
  severity: critical
  description: Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.
  tags: cve,cve2021,wordpress,wp,wpscan,wp-theme,thrive,passive,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/themes/{{theme}}/style.css"
    matchers:
      - type: dsl
        condition: and
      - type: word
        words:
          - "rise"
          - "luxe"
          - "minus"
          - "ignition"
          - "focusblog"
          - "squared"
          - "voice"
          - "performag"
          - "pressive"
          - "storied"
        part: body
        condition: or


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: wykop

info:
  name: Wykop User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Wykop user name information check was conducted.
  tags: osint,osint-social,wykop,discovery

http:
  - method: GET
    path:
      - "https://www.wykop.pl/ludzie/{{user}}/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Aktywność użytkownika"
        part: body


Instruction: Generate a Nuclei template for: Unnecessary Service Removal Check

Input:
Title: Unnecessary Service Removal Check
Summary: Unnecessary Service Removal Check. Ensure that unnecessary services such as Alerter, Clipbook, Messenger, and Simple TCP/IP Services are not running. If enabled, these services can expose the system to security vulnerabilities.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: unnecessary-service-check

info:
  name: Unnecessary Service Removal Check
  author: nukunga[SungHyunJeon]
  severity: medium
  description: Ensure that unnecessary services such as Alerter, Clipbook, Messenger, and Simple TCP/IP Services are not running. If enabled, these services can expose the system to security vulnerabilities.
  tags: service-management,code,windows-audit,kisa

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2018-7193

Input:
Title: Cross-Site Scripting (XSS) in osticket osticket
Summary: Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: osticket osticket
Indicators: error, vulnerability detected

Output:
id: CVE-2018-7193

info:
  name: osTicket < 1.10.2 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter.
  tags: cve,cve2018,osticket,xss,authenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Cyber Chef Panel - Detect

Input:
Title: Cyber Chef Panel - Detect
Summary: Cyber Chef Panel - Detect. A Cyber Chef Panel was detected

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: cyberchef-panel

info:
  name: Cyber Chef Panel - Detect
  author: rxerium
  severity: info
  description: A Cyber Chef Panel was detected
  tags: panel,cyberchef,login,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>CyberChef</title>"
          - "The Cyber Swiss Army Knife"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Path Traversal

Input:
Title: Path Traversal (CWE-22)
Summary: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escap
Vulnerability Type: Path Traversal
Severity: high
Indicators: unexpected

Output:
id: opencti-lfi

info:
  name: OpenCTI 3.3.1 - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: OpenCTI 3.3.1 is vulnerable to local file inclusion.
  tags: opencti,lfi,oss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/static/css//../../../../../../../../etc/passwd"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-42551

Input:
Title: Cross-Site Scripting (XSS) in alcoda netbiblio
Summary: Cross-site Scripting (XSS) vulnerability in the search functionality of AlCoda NetBiblio WebOPAC allows an unauthenticated user to craft a reflected Cross-Site Scripting attack. This issue affects: AlCoda NetBiblio WebOPAC versions prior to 4.0.0.320; versions later than 4.0.0.328. This issue does not affect: AlCoda NetBiblio WebOPAC version 4.0.0.335 and later versions.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: alcoda netbiblio
Indicators: error, vulnerability detected

Output:
id: CVE-2021-42551

info:
  name: NetBiblio WebOPAC - Cross-Site Scripting
  author: compr00t
  severity: medium
  description: NetBiblio WebOPAC before 4.0.0.320 is affected by a reflected cross-site scripting vulnerability in its Wikipedia module through /NetBiblio/search/shortview via the searchTerm parameter.
  tags: cve2021,cve,xss,netbiblio,alcoda,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/NetBiblio/search/shortview?searchField=W&searchType=Simple&searchTerm=x%27%2Balert%281%29%2B%27x"
      - "{{BaseURL}}/NetBiblio/search/shortview?searchField=W&searchType=Simple&searchTerm=x%5C%27%2Balert%281%29%2C%2F%2F"
    matchers:
      - type: word
        words:
          - "SearchTerm: 'x'+alert(1)+'x',"
          - "SearchTerm: 'x\\'+alert(1),//',"
        part: body
        condition: or
      - type: word
        words:
          - "text/html"
        part: header
      - type: word
        words:
          - "NetBiblio"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: SMB2 Server Time - Detection

Input:
Title: SMB2 Server Time - Detection
Summary: SMB2 Server Time - Detection. Trying to retrieve the present date of the system along with the initiation date of an SMB2 server.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: smb2-server-time

info:
  name: SMB2 Server Time - Detection
  author: DhiyaneshDK
  severity: info
  description: Trying to retrieve the present date of the system along with the initiation date of an SMB2 server.
  tags: js,network,smb,enum,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2014-7169

Input:
Title: OS Command Injection in gnu bash and others
Summary: GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
Vulnerability Type: OS Command Injection
Severity: critical
Affected Products: gnu bash, arista eos, oracle linux
Indicators: error, vulnerability detected

Output:
id: CVE-2014-6271

info:
  name: ShellShock - Remote Code Execution
  author: pentest_swissky,0xelkomy
  severity: critical
  description: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka ShellShock.
  tags: cve2014,cve,rce,shellshock,kev,gnu,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}{{paths}}"
    matchers:
      - type: regex
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: E-Cology V9 - SQL Injection

Input:
Title: E-Cology V9 - SQL Injection
Summary: E-Cology V9 - SQL Injection. Ecology9 is a new and efficient collaborative office system created by Panmicro for medium and large organizations. There is a SQL injection vulnerability in Panmicro ecology9, which can be exploited by attackers to obtain sensitive database information.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: CNVD-2023-12632

info:
  name: E-Cology V9 - SQL Injection
  author: daffainfo
  severity: high
  description: Ecology9 is a new and efficient collaborative office system created by Panmicro for medium and large organizations. There is a SQL injection vulnerability in Panmicro ecology9, which can be exploited by attackers to obtain sensitive database information.
  tags: cnvd,cnvd2023,ecology,sqli,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "283f42764da6dba2522412916b031080"
          - ""autoCount""
          - ""autoGet""
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2009-1872

Input:
Title: Cross-Site Scripting (XSS) in adobe coldfusion
Summary: Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to (2) wizards/common/_logintowizard.cfm, (3) wizards/common/_authenticatewizarduser.cfm, or (4) administrator/enter.cfm.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: adobe coldfusion
Indicators: error, vulnerability detected

Output:
id: CVE-2009-1872

info:
  name: Adobe Coldfusion <=8.0.1 - Cross-Site Scripting
  author: princechaddha
  severity: medium
  description: Adobe ColdFusion Server 8.0.1 and earlier contain multiple cross-site scripting vulnerabilities which allow remote attackers to inject arbitrary web script or HTML via (1) the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to (2) wizards/common/_logintowizard.cfm, (3) wizards/common/_authenticatewizarduser.cfm, or (4) administrator/enter.cfm.
  tags: cve2009,cve,adobe,xss,coldfusion,tenable,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/CFIDE/wizards/common/_logintowizard.cfm?%22%3E%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-4115

Input:
Title: Cross-Site Scripting (XSS) in phpjabbers cleaning_business_software
Summary: A vulnerability classified as problematic has been found in PHP Jabbers Cleaning Business 1.0. Affected is an unknown function of the file /index.php. The manipulation of the argument index leads to cross site scripting. It is possible to launch the attack remotely. VDB-235962 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: phpjabbers cleaning_business_software
Indicators: error, vulnerability detected

Output:
id: CVE-2023-4115

info:
  name: PHPJabbers Cleaning Business 1.0 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials.
  tags: cve2023,cve,xss,phpjabber,jabber,phpjabbers,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?controller=pjFront&action=pjActionServices&locale=1&index=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Cross-site Scripting

Input:
Title: Cross-site Scripting (CWE-79)
Summary: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. There are many variants of cross-site scripting, characterized by a variety of terms or involving different attack topologies. However, they all indicate the same fundamental weakness: improper neutralization of dangerous input between the adversary and a victim.
Vulnerability Type: Cross-site Scripting
Severity: high
Indicators: vulnerability detected, error

Output:
id: kafdrop-xss

info:
  name: KafDrop - Cross-Site Scripting
  author: dhiyaneshDk
  severity: high
  description: KafDrop contains a cross-site scripting vulnerability. It allows remote unauthenticated attackers to inject arbitrary HTML and/or JavaScript into the response returned by the server.
  tags: kafdrop,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/topic/e'%22%3E%3Cimg%20src=x%20onerror=alert(2)%3E"
    matchers:
      - type: word
        words:
          - "Kafdrop"
          - "<img src=x onerror=alert(2)>"
        part: body
        condition: and
      - type: status
        status:
          - 500


Instruction: Generate a Nuclei template to detect Use of Default Credentials

Input:
Title: Use of Default Credentials (CWE-1392)
Summary: The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality. It is common practice for products to be designed to use
	default keys, passwords, or other mechanisms for
	authentication.  The rationale is to simplify the
	manufacturing process or the system administrator's task of
	installation and deployment into an enterprise. However, if
	admins do not change the defaults, it is easier for attackers
	to bypass authentication quickly acro
Vulnerability Type: Use of Default Credentials
Severity: high
Indicators: vulnerability detected, error

Output:
id: lucee-default-login

info:
  name: Lucee - Default Login
  author: jpg0mez
  severity: high
  description: Lucee admin panel using the default login password was discovered.
  tags: lucee,default-login,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Unrestricted Oracle DB Access

Input:
Title: Unrestricted Oracle DB Access
Summary: Unrestricted Oracle DB Access. Identifies unrestricted inbound access to Oracle databases in Amazon EC2 instances, which increases the risk of unauthorized access and attacks.

Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: ec2-unrestricted-oracle

info:
  name: Unrestricted Oracle DB Access
  author: princechaddha
  severity: critical
  description: Identifies unrestricted inbound access to Oracle databases in Amazon EC2 instances, which increases the risk of unauthorized access and attacks.
  tags: cloud,devops,aws,amazon,ec2,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Cross-site Scripting

Input:
Title: Cross-site Scripting (CWE-79)
Summary: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. There are many variants of cross-site scripting, characterized by a variety of terms or involving different attack topologies. However, they all indicate the same fundamental weakness: improper neutralization of dangerous input between the adversary and a victim.
Vulnerability Type: Cross-site Scripting
Severity: high
Indicators: vulnerability detected, error

Output:
id: wp-real-estate-xss

info:
  name: WordPress Real Estate 7 Theme <= 3.3.4 - Cross-Site Scripting
  author: Harsh
  severity: medium
  description: The Real Estate 7 premium theme for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) attack vector in versions up to, and including, v3.3.4 via the 'ct_additional_features' option due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject malicious JavaScript payload in the search page that execute if they can trick a user into performing an action such as clicking on a link.
  tags: packetstorm,wordpress,wp-theme,wp,xss,realestate,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?ct_keyword=%22%3E%3Cimg%20src%3Dx%20onerror%3Dprompt%28document.domain%29%3E&ct_city=0&ct_state=0&ct_zipcode=0&search-listings=true&ct_property_type=0&ct_beds=0&ct_baths=0&ct_price_from&ct_price_to"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2020-11991

Input:
Title: Vulnerability (CWE-611) in apache cocoon
Summary: When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any file on the server system.
Vulnerability Type: Vulnerability (CWE-611)
Severity: high
Affected Products: apache cocoon
Indicators: error, vulnerability detected

Output:
id: CVE-2020-11991

info:
  name: Apache Cocoon 2.1.12 - XML Injection
  author: pikpikcu
  severity: high
  description: Apache Cocoon 2.1.12 is susceptible to  XML injection. When using the StreamGenerator, the code parses a user-provided XML. A specially crafted XML, including external system entities, can be used to access any file on the server system.
  tags: cve,cve2020,apache,xml,cocoon,xxe,vkev,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/v2/api/product/manger/getInfo"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2019-25152

Input:
Title: Unknown Vulnerability in tychesoftwares abandoned_cart_lite_for_woocommerce and others
Summary: The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard.
Vulnerability Type: Unknown Vulnerability
Severity: high
Affected Products: tychesoftwares abandoned_cart_lite_for_woocommerce, tychesoftwares abandoned_cart_pro_for_woocommerce
Indicators: error, vulnerability detected

Output:
id: CVE-2019-25152

info:
  name: Abandoned Cart Lite for WooCommerce < 5.2.0 - Cross-Site Scripting
  author: DhiyaneshDK
  severity: high
  description: The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping.
  tags: cve,cve2019,wpscan,wordpress,wp,wp-plugin,woocommerce-abandoned-cart,xss,passive,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: CraftMyPDF API Test

Input:
Title: CraftMyPDF API Test
Summary: CraftMyPDF API Test. Generate PDF documents from templates with a drop-and-drop editor and a simple API
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-craftmypdf

info:
  name: CraftMyPDF API Test
  author: daffainfo
  severity: info
  description: Generate PDF documents from templates with a drop-and-drop editor and a simple API
  tags: token-spray,craftmypdf

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""template_id":"
          - ""name":"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: jshERP - Information Disclosure

Input:
Title: jshERP - Information Disclosure
Summary: jshERP - Information Disclosure. jshERP that can reveal sensitive information including system credentials without credentials.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: CNVD-2020-63964

info:
  name: jshERP - Information Disclosure
  author: brucelsone
  severity: high
  description: jshERP that can reveal sensitive information including system credentials without credentials.
  tags: cnvd,cnvd2020,jsherp,disclosure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/jshERP-boot/user/getAllList;.ico"
    matchers:
      - type: word
        words:
          - ""username":"
          - ""loginName":"
          - ""password":"
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Bitrix24 Installation Exposure

Input:
Title: Bitrix24 Installation Exposure
Summary: Bitrix24 Installation Exposure. Bitrix24 is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: bitrix24-installer

info:
  name: Bitrix24 Installation Exposure
  author: DhiyaneshDK
  severity: high
  description: Bitrix24 is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,bitrix24,install,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Start installation"
          - "Bitrix24"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: box phishing Detection

Input:
Title: box phishing Detection
Summary: box phishing Detection. A box phishing website was detected

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: box-phish

info:
  name: box phishing Detection
  author: rxerium
  severity: info
  description: A box phishing website was detected
  tags: phishing,box-storage,osint,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Secure File Sharing, Storage, and Collaboration | Box"
      - type: status
        status:
          - 200
      - type: dsl


Instruction: Generate a Nuclei template for: Disable Apache2 HTTP TRACE Method

Input:
Title: Disable Apache2 HTTP TRACE Method
Summary: Disable Apache2 HTTP TRACE Method. The HTTP TRACE method should be disabled to prevent Cross-Site Tracing (XST) attacks.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: file-disable-http-trace-method

info:
  name: Disable Apache2 HTTP TRACE Method
  author: pussycat0x
  severity: high
  description: The HTTP TRACE method should be disabled to prevent Cross-Site Tracing (XST) attacks.
  tags: audit,config,file,apache,hardening

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: WordPress Gutenberg Blocks Plugin <= 3.1.10 - Arbitrary File Upload

Input:
Title: WordPress Gutenberg Blocks Plugin <= 3.1.10 - Arbitrary File Upload
Summary: WordPress Gutenberg Blocks Plugin <= 3.1.10 - Arbitrary File Upload. The Kadence Blocks for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_fields function in versions up to, and including, 3.1.10. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: wp-kadence-blocks-rce

info:
  name: WordPress Gutenberg Blocks Plugin <= 3.1.10 - Arbitrary File Upload
  author: theamanrawat
  severity: critical
  description: The Kadence Blocks for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_fields function in versions up to, and including, 3.1.10. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
  tags: rce,wpscan,wordpress,wp-plugin,wp,kadence-blocks,fileupload,intrusive,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2000-0760

Input:
Title: Unknown Vulnerability in apache tomcat
Summary: The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.
Vulnerability Type: Unknown Vulnerability
Severity: medium
Affected Products: apache tomcat
Indicators: error, vulnerability detected

Output:
id: CVE-2000-0760

info:
  name: Jakarta Tomcat 3.1 and 3.0 - Information Disclosure
  author: Thabisocn,0x_Akoko
  severity: medium
  description: Jakarta Tomcat 3.1 and 3.0 under Apache contain a vulnerability in the Snoop servlet that reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension, exploit requires remote access.
  tags: cve,cve2000,jakarta,tomcat,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/examples/jsp/snp/anything.snp"
    matchers:
      - type: word
        words:
          - "Request Information"
          - "Path info"
          - "Server name"
          - "Remote address"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: extreme-netconfig-ui

info:
  name: Extreme NetConfig UI Panel - Detect
  author: pussycat0x
  severity: info
  description: Extreme NetConfig UI panel was detected.
  tags: panel,tech,hiveos,extreme,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php5"
    matchers:
      - type: word
        words:
          - "<title>Extreme NetConfig UI</title>"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: httpbin-panel

info:
  name: HTTPBin Login Panel - Detect
  author: Adam Crosser
  severity: info
  description: HTTPBin login panel was detected.
  tags: panel,httpbin,oss,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>httpbin.org</title>"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Harvard Art Museums API Test

Input:
Title: Harvard Art Museums API Test
Summary: Harvard Art Museums API Test. Harvard Art. Tags: token-spray, harvardart
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-harvardart

info:
  name: Harvard Art Museums API Test
  author: daffainfo
  severity: info
  description: Harvard Art
  tags: token-spray,harvardart

http:
  - method: GET
    path:
      - "https://api.harvardartmuseums.org/color/34838442?apikey={{token}}"
    matchers:
      - type: word
        words:
          - ""colorid""
          - ""name""
          - ""hex""
        part: body
        condition: and


Instruction: Generate a Nuclei template for: BlackEnergy VBS Agent Malware Hash - Detect

Input:
Title: BlackEnergy VBS Agent Malware Hash - Detect
Summary: BlackEnergy VBS Agent Malware Hash - Detect. Detects VBS Agent from BlackEnergy Report - file Dropbearrun.vbs
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: blackenergy-vbs-malware-hash

info:
  name: BlackEnergy VBS Agent Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: Detects VBS Agent from BlackEnergy Report - file Dropbearrun.vbs
  tags: malware,blackenergy

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Yonyou U8 bx_historyDataCheck - SQL Injection

Input:
Title: Yonyou U8 bx_historyDataCheck - SQL Injection
Summary: Yonyou U8 bx_historyDataCheck - SQL Injection. Yonyou U8 Grp contains a SQL injection vulnerability.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: yonyou-u8-sqli

info:
  name: Yonyou U8 bx_historyDataCheck - SQL Injection
  author: xianke
  severity: high
  description: Yonyou U8 Grp contains a SQL injection vulnerability.
  tags: time-based-sqli,yonyou,grp,sqli,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "GRP-U8"
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-2023

Input:
Title: Cross-Site Scripting (XSS) in kunalnagar custom_404_pro
Summary: The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: kunalnagar custom_404_pro
Indicators: error, vulnerability detected

Output:
id: CVE-2023-2023

info:
  name: Custom 404 Pro < 3.7.3 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: Custom 404 Pro before 3.7.3 is susceptible to cross-site scripting via the search parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  tags: cve2023,cve,wpscan,xss,wordpress,wp-plugin,authenticated,custom-404-pro,intrusive,kunalnagar,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: ilch-admin-panel

info:
  name: Ilch CMS Admin Login Panel - Detect
  author: ritikchaddha
  severity: info
  description: Ilch CMS admin login panel was detected.
  tags: panel,ilch,cms,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php/admin/admin/login/index/"
    matchers:
      - type: word
        words:
          - "ilch_token"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-34040

Input:
Title: Path Traversal in CVE-2025-34040
Summary: An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.
Vulnerability Type: Path Traversal
Severity: medium
Indicators: error, vulnerability detected

Output:
id: CVE-2025-34040

info:
  name: Zhiyuan OA Platform - Arbitrary File Upload
  author: iamnoooob,pdresearch
  severity: critical
  description: An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.
  tags: cve,cve2025,file-upload,intrusive,zhiyuan,lfi,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "officeTransResultFlag"
          - ""success":true"
        part: body
        condition: and
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "{{marker}}"
        part: body


Instruction: Generate a Nuclei template for CVE-2023-2825

Input:
Title: Path Traversal in gitlab gitlab
Summary: An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.
Vulnerability Type: Path Traversal
Severity: critical
Affected Products: gitlab gitlab
Indicators: error, vulnerability detected

Output:
id: CVE-2023-2825

info:
  name: GitLab 16.0.0 - Path Traversal
  author: DhiyaneshDk,rootxharsh,iamnoooob,pdresearch
  severity: high
  description: An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups
  tags: cve2023,cve,gitlab,lfi,authenticated,intrusive,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "726f6f743a78"
      - type: word
        words:
          - "application/octet-stream"
          - "etc%2Fpasswd"
        part: header
        condition: and


Instruction: Generate a Nuclei template for CVE-2019-7254

Input:
Title: Path Traversal in nortekcontrol linear_emerge_essential_firmware and others
Summary: Linear eMerge E3-Series devices allow File Inclusion.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: nortekcontrol linear_emerge_essential_firmware, nortekcontrol linear_emerge_elite_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2019-7254

info:
  name: eMerge E3 1.00-06 - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: Linear eMerge E3-Series devices are vulnerable to local file inclusion.
  tags: cve,cve2019,emerge,lfi,edb,packetstorm,nortekcontrol,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?c=../../../../../../etc/passwd%00"
      - "{{BaseURL}}/badging/badge_print_v0.php?tpl=../../../../../etc/passwd"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: fish - Privilege Escalation

Input:
Title: fish - Privilege Escalation
Summary: fish - Privilege Escalation. fish is a user-friendly command-line shell for Unix-like operating systems. It provides features such as syntax highlighting, autosuggestions, and a built-in scripting language. Fish aims to be easy to use and learn, making it a popular choice for both interactive shell usage and scripting.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: privesc-fish

info:
  name: fish - Privilege Escalation
  author: daffainfo
  severity: high
  description: fish is a user-friendly command-line shell for Unix-like operating systems. It provides features such as syntax highlighting, autosuggestions, and a built-in scripting language. Fish aims to be easy to use and learn, making it a popular choice for both interactive shell usage and scripting.
  tags: code,linux,fish,privesc,local

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Smartsheet API Test

Input:
Title: Smartsheet API Test
Summary: Smartsheet API Test. Allows you to programmatically access and Smartsheet data and account information
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-smartsheet

info:
  name: Smartsheet API Test
  author: daffainfo
  severity: info
  description: Allows you to programmatically access and Smartsheet data and account information
  tags: token-spray,smartsheet

http:
  - method: GET
    path:
      - "https://api.smartsheet.com/2.0/home?include=source"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - ""sheets":"
          - ""folders":"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: D-Link DAP-1325 - Information Disclosure

Input:
Title: D-Link DAP-1325 - Information Disclosure
Summary: D-Link DAP-1325 - Information Disclosure. Security vulnerability known as Unauthenticated access to settings or Unauthenticated configuration download. This vulnerability occurs when a device, such as a repeater, allows the download of user settings without requiring proper authentication.

Vulnerability Type: Security Check
Severity: critical
Indicators: vulnerability detected

Output:
id: dlink-config-dump

info:
  name: D-Link DAP-1325 - Information Disclosure
  author: gy741
  severity: critical
  description: Security vulnerability known as Unauthenticated access to settings or Unauthenticated configuration download. This vulnerability occurs when a device, such as a repeater, allows the download of user settings without requiring proper authentication.
  tags: misconfig,config,dump,dlink,auth-bypass,disclosure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/ExportSettings.sh"
    matchers:
      - type: word
        words:
          - "Password"
        part: body
      - type: regex
        part: header
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Permissions Installer Exposure

Input:
Title: Permissions Installer Exposure
Summary: Permissions Installer Exposure. Permissions Installer is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: permissions-installer

info:
  name: Permissions Installer Exposure
  author: pussycat0x
  severity: high
  description: Permissions Installer is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,permissions,install,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title> Permissions | Installer"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Define Index Page Suffix and Error Page for Bucket Website Configuration

Input:
Title: Define Index Page Suffix and Error Page for Bucket Website Configuration
Summary: Define Index Page Suffix and Error Page for Bucket Website Configuration. Ensure that website index (main) page suffix and error (404 not found) page are defined for your Google Cloud Storage buckets with static website configuration. Specifying these configurations ensures proper functionality and user experience for websites hosted on Cloud Storage buckets.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: gcloud-bucket-website-config-not-defined

info:
  name: Define Index Page Suffix and Error Page for Bucket Website Configuration
  author: princechaddha
  severity: high
  description: Ensure that website index (main) page suffix and error (404 not found) page are defined for your Google Cloud Storage buckets with static website configuration. Specifying these configurations ensures proper functionality and user experience for websites hosted on Cloud Storage buckets.
  tags: cloud,devops,gcp,gcloud,google-cloud-storage,website-config,static-website,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: airflow-default-login

info:
  name: Apache Airflow Default Login
  author: pdteam
  severity: high
  description: Apache Airflow default login credentials were discovered.
  tags: airflow,default-login,apache,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
      - type: word
        words:
          - "You should be redirected automatically to target URL: <a href="/">"


Instruction: Generate a Nuclei template for CVE-2021-40868

Input:
Title: Cross-Site Scripting (XSS) in cloudron cloudron
Summary: In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: cloudron cloudron
Indicators: error, vulnerability detected

Output:
id: CVE-2021-40868

info:
  name: Cloudron 6.2 Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to cross-site scripting.
  tags: cve2021,cve,xss,cloudron,packetstorm,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/login.html?returnTo=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "text/html"
        part: header
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2018-1273

Input:
Title: Code Injection in pivotal_software spring_data_commons and others
Summary: Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
Vulnerability Type: Code Injection
Severity: critical
Affected Products: pivotal_software spring_data_commons, pivotal_software spring_data_rest, apache ignite
Indicators: error, vulnerability detected

Output:
id: CVE-2018-1273

info:
  name: Spring Data Commons - Remote Code Execution
  author: dwisiswant0
  severity: critical
  description: Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5,
and older unsupported versions, contain a property binder vulnerability
caused by improper neutralization of special elements.
An unauthenticated remote malicious user (or attacker) can supply
specially crafted request parameters against Spring Data REST backed HTTP resources
or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
  tags: cve,cve2018,vmware,rce,spring,kev,pivotal_software,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: body
        condition: or


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: web-file-manager

info:
  name: Web File Manager Login Panel - Detect
  author: DhiyaneshDK
  severity: info
  description: Web File Manager login panel was detected.
  tags: panel,filemanager,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/Login"
    matchers:
      - type: word
        words:
          - "Web File Manager"
          - "Login"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-47812

Input:
Title: Vulnerability (CWE-158) in wftpserver wing_ftp_server
Summary: In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
Vulnerability Type: Vulnerability (CWE-158)
Severity: critical
Affected Products: wftpserver wing_ftp_server
Indicators: error, vulnerability detected

Output:
id: CVE-2025-47812

info:
  name: Wing FTP Server <= 7.4.3 - Remote Code Execution
  author: rcesecurity,4m3rr0r
  severity: critical
  description: Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution (RCE) flaw (CVE-2025-47812).
The vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection
into session files. These injected session files are executed when accessing authenticated endpoints such as /dir.html, resulting
in arbitrary command execution with elevated privileges. This attack is possible only when anonymous login is enabled on the server.
  tags: cve,cve2025,rce,wingftp,ftp,unauth,kev,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2019-3402

Input:
Title: Cross-Site Scripting (XSS) in atlassian jira and others
Summary: The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: atlassian jira, atlassian jira_server
Indicators: error, vulnerability detected

Output:
id: CVE-2019-3402

info:
  name: Jira < 8.1.1 - Cross-Site Scripting
  author: pdteam
  severity: medium
  description: Jira before 8.1.1 contains a cross-site scripting vulnerability via ConfigurePortalPages.jspa resource in the searchOwnerUserName parameter.
  tags: cve,cve2019,atlassian,jira,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search"
    matchers:
      - type: word
        words:
          - "'<script>alert(1)</script>' does not exist"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Hunter API Test

Input:
Title: Hunter API Test
Summary: Hunter API Test. API for domain search, professional email finder, author finder and email verifier
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-hunter

info:
  name: Hunter API Test
  author: daffainfo
  severity: info
  description: API for domain search, professional email finder, author finder and email verifier
  tags: token-spray,hunter

http:
  - method: GET
    path:
      - "https://api.hunter.io/v2/domain-search?domain=stripe.com&api_key={{token}}"
    matchers:
      - type: word
        words:
          - ""domain""
          - ""disposable""
          - ""webmail""
        part: body
        condition: and


Instruction: Generate a Nuclei template for: CubeBackup Setup Page - Exposure

Input:
Title: CubeBackup Setup Page - Exposure
Summary: CubeBackup Setup Page - Exposure. Detects exposed CubeBackup Setup page.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: cubebackup-setup-installer

info:
  name: CubeBackup Setup Page - Exposure
  author: DhiyaneshDK
  severity: high
  description: Detects exposed CubeBackup Setup page.
  tags: misconfig,install,exposure,cubebackup,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "CubeBackup setup"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Teamwork Takeover Detection

Input:
Title: Teamwork Takeover Detection
Summary: Teamwork Takeover Detection. Teamwork takeover was detected.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: teamwork-takeover

info:
  name: Teamwork Takeover Detection
  author: pdteam
  severity: high
  description: Teamwork takeover was detected.
  tags: takeover,teamwork,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
      - type: word
        words:
          - "Oops - We didn't find your site."


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: pypicloud-panel

info:
  name: PyPICloud Login Panel - Detect
  author: Supras
  severity: info
  description: PyPLCloud login panel was detected.
  tags: panel,pypicloud,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"
    matchers:
      - type: word
        words:
          - "<title>Pypicloud</title>"
          - "<html ng-app="pypicloud">"
        part: body
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Passbolt Login Panel

Input:
Title: Passbolt Login Panel
Summary: Passbolt Login Panel. Passbolt login panel was detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: passbolt-panel

info:
  name: Passbolt Login Panel
  author: righettod
  severity: info
  description: Passbolt login panel was detected.
  tags: panel,passbolt,login,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/auth/login"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2010-0985

Input:
Title: Path Traversal in chris_simon com_abbrev
Summary: Directory traversal vulnerability in the Abbreviations Manager (com_abbrev) component 1.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: chris_simon com_abbrev
Indicators: error, vulnerability detected

Output:
id: CVE-2010-0985

info:
  name: Joomla! Component com_abbrev - Local File Inclusion
  author: daffainfo
  severity: high
  description: A directory traversal vulnerability in the Abbreviations Manager (com_abbrev) component 1.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
  tags: cve,cve2010,joomla,lfi,edb,chris_simon,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_abbrev&controller=../../../../../../../../../../etc/passwd%00"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2019-9879

Input:
Title: Vulnerability (CWE-306) in wpengine wpgraphql
Summary: The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.
Vulnerability Type: Vulnerability (CWE-306)
Severity: critical
Affected Products: wpengine wpgraphql
Indicators: error, vulnerability detected

Output:
id: CVE-2019-9879

info:
  name: WPGraphQL 0.2.3 - User Creation
  author: DhiyaneshDk
  severity: critical
  description: The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.
  tags: cve,cve2019,wp-graphql,wpengine,wordpress,wp-plugin,intrusive,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: DigitalOcean Personal Access Token

Input:
Title: DigitalOcean Personal Access Token
Summary: DigitalOcean Personal Access Token. Tags: file, keys, digitalocean
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: digitalocean-personal-access

info:
  name: DigitalOcean Personal Access Token
  author: DhiyaneshDK
  severity: info
  description: DigitalOcean Personal Access Token
  tags: file,keys,digitalocean,token

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: slurm-hpc-dashboard

info:
  name: Slurm HPC Dashboard - Detect
  author: ritikchaddha
  severity: medium
  description: Slurm HPC Dashboard was detected.
  tags: misconfig,slurm,dashboard,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/slurm/"
    matchers:
      - type: word
        words:
          - "<title>Slurm HPC Dashboard</title>"
          - "content="Slurm HPC dashboard"
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2017-18566

Input:
Title: Cross-Site Scripting (XSS) in bestwebsoft user_role
Summary: The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: bestwebsoft user_role
Indicators: error, vulnerability detected

Output:
id: CVE-2017-18566

info:
  name: User Role by BestWebSoft < 1.5.6 - Cross-Site Scripting
  author: luisfelipe146
  severity: medium
  description: The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.
  tags: cve,cve2017,wordpress,wp-plugin,xss,bws-user-role,wpscan,authenticated,bestwebsoft,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Graylog Login Panel - Detect

Input:
Title: Graylog Login Panel - Detect
Summary: Graylog Login Panel - Detect. Graylog login panel was detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: graylog-panel

info:
  name: Graylog Login Panel - Detect
  author: righettod
  severity: info
  description: Graylog login panel was detected.
  tags: panel,graylog,login,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: meet-me

info:
  name: Meet me User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Meet me user name information check was conducted.
  tags: osint,osint-dating,meet-me,discovery

http:
  - method: GET
    path:
      - "https://www.meetme.com/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<title>Meet people like "
        part: body


Instruction: Generate a Nuclei template for CVE-2022-4050

Input:
Title: Unknown Vulnerability in beardev joomsport
Summary: The JoomSport WordPress plugin before 5.2.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users
Vulnerability Type: Unknown Vulnerability
Severity: critical
Affected Products: beardev joomsport
Indicators: error, vulnerability detected

Output:
id: CVE-2022-4050

info:
  name: WordPress JoomSport <5.2.8 - SQL Injection
  author: theamanrawat
  severity: critical
  description: WordPress JoomSport plugin before 5.2.8 contains a SQL injection vulnerability. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations.
  tags: time-based-sqli,cve,cve2022,wpscan,wp-plugin,wp,joomsport-sports-league-results-management,wordpress,sqli,unauth,beardev,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Redirection Detection

Input:
Title: Redirection Detection
Summary: Redirection Detection. Tags: tech, wordpress, wp-plugin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-redirection

info:
  name: Redirection Detection
  author: ricardomaia
  severity: info
  description: Redirection Detection
  tags: tech,wordpress,wp-plugin,top-100,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/redirection/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for CVE-2024-5334

Input:
Title: Vulnerability (CWE-73) in stitionai devika
Summary: A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with a malicious 'snapshot_path' parameter, leading to arbitrary file read from the system. This issue impacts the security of the application by allowing unauthorized access to sensitive files on the server.
Vulnerability Type: Vulnerability (CWE-73)
Severity: high
Affected Products: stitionai devika
Indicators: unauthorized

Output:
id: CVE-2024-5334

info:
  name: Devika - Local File Inclusion
  author: nechyo,nukunga,harksu,olfloralo,gy741
  severity: high
  description: A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with a malicious 'snapshot_path' parameter, leading to arbitrary file read from the system. This issue impacts the security of the application by allowing unauthorized access to sensitive files on the server.
  tags: cve,cve2024,devika-ai,lfi,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: body
      - type: word
        words:
          - "attachment; filename=passwd"
          - "application/octet-stream"
        part: header
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-54330

Input:
Title: Vulnerability (CWE-918) in CVE-2024-54330
Summary: Server-Side Request Forgery (SSRF) vulnerability in Hep Hep Hurra (HHH) Hurrakify allows Server Side Request Forgery.This issue affects Hurrakify: from n/a through 2.4.
Vulnerability Type: Vulnerability (CWE-918)
Severity: high
Indicators: error, vulnerability detected

Output:
id: CVE-2024-54330

info:
  name: Hurrakify <= 2.4 - Server-Side Request Forgery
  author: s4e-io
  severity: high
  description: The Hurrakify plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
  tags: cve,cve2024,wordpress,wp-plugin,hurrakify,ssrf,oob,oast,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol
      - type: word
        words:
          - "text/html"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-9043

Input:
Title: Information Disclosure in wpcentral wpcentral
Summary: The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key.
Vulnerability Type: Information Disclosure
Severity: high
Affected Products: wpcentral wpcentral
Indicators: error, vulnerability detected

Output:
id: CVE-2020-9043

info:
  name: WordPress wpCentral <1.5.1 - Information Disclosure
  author: scent2d
  severity: high
  description: WordPress wpCentral plugin before 1.5.1 is susceptible to information disclosure. An attacker can access the  connection key for WordPress Admin account and thus potentially obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: cve,cve2020,wordpress,wp-plugin,wpcentral,authenticated,wp,wpscan,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2021-41291

Input:
Title: Path Traversal in ecoa ecs_router_controller-ecs_firmware and others
Summary: ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directory content on the affected device.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: ecoa ecs_router_controller-ecs_firmware, ecoa riskbuster_firmware, ecoa riskterminator
Indicators: error, vulnerability detected

Output:
id: CVE-2021-41291

info:
  name: ECOA Building Automation System - Directory Traversal Content Disclosure
  author: gy741
  severity: high
  description: The ECOA BAS controller suffers from a directory traversal content disclosure vulnerability. Using the GET parameter cpath in File Manager (fmangersub), attackers can disclose directory content on the affected device
  tags: cve2021,cve,ecoa,lfi,traversal,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex


Instruction: Generate a Nuclei template for CVE-2013-2621

Input:
Title: Vulnerability (CWE-601) in telaen_project telaen
Summary: Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URL.
Vulnerability Type: Vulnerability (CWE-601)
Severity: medium
Affected Products: telaen_project telaen
Indicators: error, vulnerability detected

Output:
id: CVE-2013-2621

info:
  name: Telaen => v1.3.1 - Open Redirect
  author: ctflearner
  severity: medium
  description: Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URL.
  tags: cve2013,cve,telaen,redirect,telaen_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/telaen/redir.php?https://interact.sh"
      - "{{BaseURL}}/redir.php?https://interact.sh"
    matchers:
      - type: regex
        part: header


Instruction: Generate a Nuclei template for CVE-2023-47253

Input:
Title: Vulnerability (CWE-77) in qualitor qualitor
Summary: Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHidden parameter.
Vulnerability Type: Vulnerability (CWE-77)
Severity: critical
Affected Products: qualitor qualitor
Indicators: error, vulnerability detected

Output:
id: CVE-2023-47253

info:
  name: Qualitor <= 8.20 - Remote Code Execution
  author: s4e-io
  severity: critical
  description: Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHidden parameter.
  tags: cve,cve2023,rce,qualitor,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-47643

Input:
Title: Information Disclosure in salesagility suitecrm
Summary: SuiteCRM is a Customer Relationship Management (CRM) software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire attack surface of the API, including sensitive fields such as UserHash. This issue is patched in version 8.4.2. There are no known workarounds.
Vulnerability Type: Information Disclosure
Severity: low
Affected Products: salesagility suitecrm
Indicators: error, vulnerability detected

Output:
id: CVE-2023-47643

info:
  name: SuiteCRM Unauthenticated Graphql Introspection
  author: isacaya
  severity: medium
  description: Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions.
  tags: cve,cve2023,graphql,suitecrm,introspection,salesagility,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "userHash"
          - "authenticateId"
          - "systemGeneratedPassword"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: PageCDN API Test

Input:
Title: PageCDN API Test
Summary: PageCDN API Test. Public API for javascript, css and font libraries on PageCDN
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-pagecdn

info:
  name: PageCDN API Test
  author: daffainfo
  severity: info
  description: Public API for javascript, css and font libraries on PageCDN
  tags: token-spray,pagecdn

http:
  - method: GET
    path:
      - "https://pagecdn.com/api/v2/private/account/info?apikey={{token}}"
    matchers:
      - type: word
        words:
          - ""username""
          - ""email""
        part: body
        condition: and


Instruction: Generate a Nuclei template for CVE-2022-30512

Input:
Title: SQL Injection in school_dormitory_management_system_project school_dormitory_management_system
Summary: School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/payment_history.php:31.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: school_dormitory_management_system_project school_dormitory_management_system
Indicators: error, vulnerability detected

Output:
id: CVE-2022-30512

info:
  name: School Dormitory Management System 1.0 - SQL Injection
  author: tess
  severity: critical
  description: School Dormitory Management System 1.0 contains a SQL injection vulnerability via accounts/payment_history.php:31. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  tags: cve,cve2022,sqli,school_dormitory_management_system_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/dms/admin/accounts/payment_history.php?account_id=2%27"
    matchers:
      - type: word
        words:
          - "Fatal error"
          - "Uncaught Error: Call to a member function fetch_assoc()"
          - "Month of	"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: RDS Automated Backup Check

Input:
Title: RDS Automated Backup Check
Summary: RDS Automated Backup Check. Ensure that your Amazon RDS database instances have automated backups enabled for point-in-time recovery.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: rds-backup-enable

info:
  name: RDS Automated Backup Check
  author: princechaddha
  severity: high
  description: Ensure that your Amazon RDS database instances have automated backups enabled for point-in-time recovery.
  tags: cloud,devops,aws,amazon,rds,aws-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Resource to Wrong Sphere

Input:
Title: Exposure of Resource to Wrong Sphere (CWE-668)
Summary: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. Resources such as files and directories may be inadvertently exposed through mechanisms such as insecure permissions, or when a program accidentally operates on the wrong object. For example, a program may intend that private files can only be provided to a specific user. This effectively defines a control sphere that is intended to prevent attackers from accessing t
Vulnerability Type: Exposure of Resource to Wrong Sphere
Severity: medium
Indicators: vulnerability detected, error

Output:
id: office-webapps-panel

info:
  name: Office Web Apps Server Panel - Detect
  author: DhiyaneshDK
  severity: info
  description: Microsoft Office Web App Login Panel was discovered.
  tags: panel,office-webapps,login,microsoft,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/op/generate.aspx"
      - "{{BaseURL}}/op/wrongfiletype.htm"
    matchers:
      - type: word
        words:
          - "Provide a link that opens Word"
          - "PowerPoint files in a web browser"
        part: body
        condition: and
      - type: word
        words:
          - "_OFUError"
          - "Wrong file type"
        part: body
        condition: and


Instruction: Generate a Nuclei template for CVE-2021-39327

Input:
Title: Information Disclosure in ait-pro bulletproof_security
Summary: The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.
Vulnerability Type: Information Disclosure
Severity: medium
Affected Products: ait-pro bulletproof_security
Indicators: error, vulnerability detected

Output:
id: CVE-2021-39327

info:
  name: WordPress BulletProof Security 5.1 Information Disclosure
  author: geeknik
  severity: medium
  description: The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.
  tags: cve2021,cve,exposure,packetstorm,wordpress,ait-pro,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/bps-backup/logs/db_backup_log.txt"
      - "{{BaseURL}}/wp-content/plugins/bulletproof-security/admin/htaccess/db_backup_log.txt"
    matchers:
      - type: word
        words:
          - "BPS DB BACKUP LOG"
          - "=================="
        part: body
        condition: and
      - type: regex
        part: body
      - type: word
        words:
          - "text/plain"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-6933

Input:
Title: Deserialization of Untrusted Data in wpengine better_search_replace
Summary: The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Vulnerability Type: Deserialization of Untrusted Data
Severity: critical
Affected Products: wpengine better_search_replace
Indicators: error, vulnerability detected

Output:
id: CVE-2023-6933

info:
  name: Better Search Replace < 1.4.5 - PHP Object Injection
  author: pussycat0x
  severity: critical
  description: The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
  tags: cve,cve2023,wordpress,wp-plugin,wp,wpscan,better-search-replace,passive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/better-search-replace/README.txt"
      - "{{BaseURL}}/wp-content/plugins/better-search-replace/readme.txt"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2022-32025

Input:
Title: SQL Injection in car_rental_management_system_project car_rental_management_system
Summary: Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/view_car.php?id=.
Vulnerability Type: SQL Injection
Severity: high
Affected Products: car_rental_management_system_project car_rental_management_system
Indicators: error, vulnerability detected

Output:
id: CVE-2022-32025

info:
  name: Car Rental Management System 1.0 - SQL Injection
  author: arafatansari
  severity: high
  description: Car Rental Management System 1.0 contains an SQL injection vulnerability via /admin/view_car.php?id=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
  tags: cve,cve2022,carrental,cms,sqli,authenticated,car_rental_management_system_project,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "{{md5({{num}})}}"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Insufficiently Protected Credentials

Input:
Title: Insufficiently Protected Credentials (CWE-522)
Summary: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Vulnerability Type: Insufficiently Protected Credentials
Severity: medium
Indicators: unauthorized

Output:
id: dolphinscheduler-default-login

info:
  name: Apache DolphinScheduler Default Login
  author: For3stCo1d
  severity: high
  description: Apache DolphinScheduler default admin credentials were discovered.
  tags: apache,dolphinscheduler,default-login,oss,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - ""msg":"login success""
          - ""sessionId":"
        part: body
        condition: and
      - type: status
        status:
          - 200