deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Sybase Easerver 6.3 Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/sybase_easerver_traversal.rb
Disclosure date: 2011-05-25
References: CVE-2011-2474, OSVDB-72498, URL-http://www.sybase.com/detail?id=1093216, URL-https://labs.idefense.com/verisign/intelligence/2009/vulnerabilities/display.php?id=912

Description:
This module exploits a directory traversal vulnerability found in Sybase
          EAserver's Jetty webserver on port 8000. Code execution seems unlikely with
          EAserver's default configuration unless the web server allows WRITE permission.
Metasploit Module: Outlook Web App (OWA) / Client Access Server (CAS) IIS HTTP Internal IP Disclosure
Type: auxiliary
Path: modules/auxiliary/scanner/http/owa_iis_internal_ip.rb
Disclosure date: Dec 17 2012

Description:
This module tests vulnerable IIS HTTP header file paths on Microsoft
        Exchange OWA 2003 and CAS 2007, 2010, and 2013 servers.
Metasploit Module: Joomla Bruteforce Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/joomla_bruteforce_login.rb
Authors: luisco100[at]gmail.com
References: CVE-1999-0502

Description:
This module attempts to authenticate to Joomla 2.5. or 3.0 through bruteforce attacks
Metasploit Module: Ruby On Rails Attributes Mass Assignment Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/rails_mass_assignment.rb
References: URL-https://guides.rubyonrails.org/security.html#mass-assignment

Description:
This module scans Ruby On Rails sites for
          models with attributes not protected by attr_protected or attr_accessible.
          After attempting to assign a non-existent field, the default rails with
          active_record setup will raise an ActiveRecord::UnknownAttributeError
          exception, and reply with HTTP code 500.
Metasploit Module: Microsoft Exchange Privilege Escalation Exploit
Type: auxiliary
Path: modules/auxiliary/scanner/http/exchange_web_server_pushsubscription.rb
Disclosure date: 2019-01-21
References: CVE-2019-0724, URL-https://dirkjanm.io/abusing-exchange-one-api-call-away-from-domain-admin/

Description:
This module exploits a privilege escalation vulnerability found in Microsoft Exchange - CVE-2019-0724
        Execution of the module will force Exchange to authenticate to an arbitrary URL over HTTP via the Exchange PushSubscription feature.
        This allows us to relay the NTLM authentication to a Domain Controller and authenticate with the privileges that Exchange is configured.
        The module is based on the work by @_dirkjan,
Metasploit Module: Elasticsearch Memory Disclosure
Type: auxiliary
Path: modules/auxiliary/scanner/http/elasticsearch_memory_disclosure.rb
Disclosure date: 2021-07-21
References: EDB-50149, CVE-2021-22145, URL-https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177

Description:
This module exploits a memory disclosure vulnerability in Elasticsearch
          7.10.0 to 7.13.3 (inclusive). A user with the ability to submit arbitrary
          queries to Elasticsearch can generate an error message containing previously
          used portions of a data buffer.
          This buffer could contain sensitive information such as Elasticsearch
          documents or authentication details. This vulnerability's output is similar
          to heartbleed.
Metasploit Module: HTTP File Same Name Directory Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/file_same_name_dir.rb

Description:
This module identifies the existence of files
          in a given directory path named as the same name of the
          directory.

          Only works if PATH is different than '/'.
Metasploit Module: Oracle Demantra Arbitrary File Retrieval with Authentication Bypass
Type: auxiliary
Path: modules/auxiliary/scanner/http/oracle_demantra_file_retrieval.rb
Disclosure date: 2014-02-28
References: CVE-2013-5877, CVE-2013-5880, URL-https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2013-5877/, URL-https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2013-5880/

Description:
This module exploits a file download vulnerability found in Oracle
          Demantra 12.2.1 in combination with an authentication bypass. By
          combining these exposures, an unauthenticated user can retrieve any file
          on the system by referencing the full file path to any file a vulnerable
          machine.
Metasploit Module: Web Site Crawler
Type: auxiliary
Path: modules/auxiliary/scanner/http/crawler.rb

Description:
Crawl a web site and store information about what was found
Metasploit Module: Cassandra Web File Read Vulnerability
Type: auxiliary
Path: modules/auxiliary/scanner/http/cassandra_web_file_read.rb
References: URL-https://github.com/avalanche123/cassandra-web/commit/f11e47a26f316827f631d7bcfec14b9dd94f44be, EDB-49362

Description:
This module exploits an unauthenticated directory traversal vulnerability in Cassandra Web
          'Cassandra Web' version 0.5.0 and earlier, allowing arbitrary file read with the web server privileges.
          This vulnerability occurred due to the disabled Rack::Protection module
Metasploit Module: Apache HTTPD mod_negotiation Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/mod_negotiation_scanner.rb

Description:
This module scans the webserver of the given host(s) for the existence of mod_negotiate.
          If the webserver has mod_negotiation enabled, the IP address will be displayed.
Metasploit Module: WordPress GI-Media Library Plugin Directory Traversal Vulnerability
Type: auxiliary
Path: modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb
References: CVE-2015-10136, URL-http://web.archive.org/web/[PII_REDACTED]4407/http://wordpressa.quantika14.com/repository/index.php?id=24

Description:
This module exploits a directory traversal vulnerability in WordPress Plugin
          GI-Media Library version 2.2.2, allowing to read arbitrary files from the
          system with the web server privileges. This module has been tested successfully
          on GI-Media Library version 2.2.2 with WordPress 4.1.3 on Ubuntu 12.04 Server.

Check method (fingerprinting):
check_plugin_version_from_readme('gi-media-library', '3.0')
  end
Metasploit Module: Embedthis GoAhead Embedded Web Server Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/goahead_traversal.rb
References: CVE-2014-9707

Description:
This module exploits a directory traversal vulnerability in the Embedthis
          GoAhead Web Server v3.4.1, allowing an attacker to read arbitrary files
          with the web server privileges.
Metasploit Module: N-able N-Central Authentication Bypass and XXE Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb
Disclosure date: 2025-11-17
References: CVE-2025-9316, CVE-2025-11700, URL-https://horizon3.ai/attack-research/attack-blogs/n-able-n-central-from-n-days-to-0-days/

Description:
This module scans for vulnerable N-able N-Central instances affected by
          CVE-2025-9316 (Unauthenticated Session Bypass) and CVE-2025-11700 (XXE).

          The module attempts to exploit CVE-2025-9316 by sending a sessionHello SOAP
          request to the ServerMMS endpoint with various appliance IDs to obtain an
          unauthenticated session. If successful, it then tests for CVE-2025-11700
          by writing an XXE payload file and triggering it via importServiceTemplateFromFile.

          Files of interest that can be read via XXE:
          - /opt/nable/var/ncsai/etc/ncbackup.conf
          - /var/opt/n-central/tmp/ncbackup/ncbackup.bin (PostgreSQL dump)
          - /opt/nable/etc/keystore.bcfks (encrypted keystore)
          - /opt/nable/etc/masterPassword (keystore password)

          Affected versions: N-Central < 2025.4.0.9
Metasploit Module: Ruby on Rails JSON Processor YAML Deserialization Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/rails_json_yaml_scanner.rb
References: CVE-2013-0333

Description:
This module attempts to identify Ruby on Rails instances vulnerable to
          an arbitrary object instantiation flaw in the JSON request processor.
Metasploit Module: ColdFusion Server Check
Type: auxiliary
Path: modules/auxiliary/scanner/http/coldfusion_locale_traversal.rb
References: CVE-2010-2861, BID-42342, OSVDB-67047, URL-https://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/, URL-https://www.adobe.com/support/security/bulletins/apsb10-18.html

Description:
This module attempts to exploit the directory traversal in the 'locale'
        attribute.  According to the advisory the following versions are vulnerable:

        ColdFusion MX6 6.1 base patches,
        ColdFusion MX7 7,0,0,91690 base patches,
        ColdFusion MX8 8,0,1,195765 base patches,
        ColdFusion MX8 8,0,1,195765 with Hotfix4.

        Adobe released patches for ColdFusion 8.0, 8.0.1, and 9 but ColdFusion 9 is reported
        to have directory traversal protections in place, subsequently this module does NOT
        work against ColdFusion 9.  Adobe did not release patches for ColdFusion 6.1 or
        ColdFusion 7.

        It is not recommended to set FILE when doing scans across a group of servers where the OS
        may vary; otherwise, the file requested may not make sense for the OS
Metasploit Module: Sockso Music Host Server 1.5 Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/sockso_traversal.rb
Disclosure date: 2012-03-14
References: CVE-2012-10061, URL-http://aluigi.altervista.org/adv/sockso_1-adv.txt

Description:
This module exploits a directory traversal bug in Sockso on port
          4444.  This is done by using "../" in the path to retrieve a file on
          a vulnerable machine.
Metasploit Module: HTTP Vuln Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/web_vulndb.rb

Description:
This module identifies common vulnerable files or cgis.
Metasploit Module: GitLab GraphQL API User Enumeration
Type: auxiliary
Path: modules/auxiliary/scanner/http/gitlab_graphql_user_enum.rb
Disclosure date: 2022-02-25
References: CVE-2021-4191, URL-https://about.gitlab.com/releases/2022/02/25/critical-security-release-gitlab-14-8-2-released/#unauthenticated-user-enumeration-on-graphql-api, URL-https://www.rapid7.com/blog/post/2022/03/03/cve-2021-4191-gitlab-graphql-api-user-enumeration-fixed/

Description:
This module queries the GitLab GraphQL API without authentication
          to acquire the list of GitLab users (CVE-2021-4191). The module works
          on all GitLab versions from 13.0 up to 14.8.2, 14.7.4, and 14.6.5.
Metasploit Module: FrontPage Server Extensions Anonymous Login Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/frontpage_login.rb
Authors: Matteo Cantoni <goony[at]nothink.org>
References: URL-https://en.wikipedia.org/wiki/Microsoft_FrontPage, URL-https://docs.microsoft.com/en-us/previous-versions/office/developer/sharepoint-2010/ms454298(v=office.14)

Description:
This module queries the FrontPage Server Extensions and determines whether anonymous access is allowed.
Metasploit Module: Dolibarr 16 pre-auth contact database dump
Type: auxiliary
Path: modules/auxiliary/scanner/http/dolibarr_16_contact_dump.rb
Disclosure date: 2023-03-14
References: CVE-2023-33568, URL-https://www.dsecbypass.com/en/dolibarr-pre-auth-contact-database-dump/, URL-https://github.com/Dolibarr/dolibarr/blob/16.0.5/ChangeLog#L34, URL-https://github.com/Dolibarr/dolibarr/commit/bb7b69ef43673ed403436eac05e0bc31d5033ff7, URL-https://github.com/Dolibarr/dolibarr/commit/be82f51f68d738cce205f4ce5b469ef42ed82d9e

Description:
Dolibarr version 16 < 16.0.5 is vulnerable to a pre-authentication contact database dump.
          An unauthenticated attacker may retrieve a company's entire customer file, prospects, suppliers,
          and potentially employee information if a contact file exists.
          Both public and private notes are also included in the dump.
Metasploit Module: Spring Cloud Config Server Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/springcloud_traversal.rb
Disclosure date: 2019-04-17
References: CVE-2019-3799, URL-https://pivotal.io/security/cve-2019-3799

Description:
This module exploits an unauthenticated directory traversal vulnerability
          which exists in Spring Cloud Config versions 2.1.x prior to 2.1.2,
          versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6. Spring
          Cloud Config listens by default on port 8888.
Metasploit Module: V-CMS Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/vcms_login.rb

Description:
This module attempts to authenticate to an English-based V-CMS login interface. It
          should only work against version v1.1 or older, because these versions do not have
          any default protections against brute forcing.
Metasploit Module: Grafana Plugin Path Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/grafana_plugin_traversal.rb
Disclosure date: 2021-12-02
References: CVE-2021-43798, URL-https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/, EDB-50581, URL-https://github.com/jas502n/Grafana-CVE-2021-43798, URL-https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545ce, URL-https://labs.detectify.com/security-guidance/how-i-found-the-grafana-zero-day-path-traversal-exploit-that-gave-me-access-to-your-logs/

Description:
Grafana versions 8.0.0-beta1 through 8.3.0 prior to 8.0.7, 8.1.8, 8.2.7, or 8.3.1 are vulnerable to directory traversal
          through the plugin URL.  A valid plugin ID is required, but many are installed by default.

Check method (fingerprinting):
res = send_request_cgi!({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    })
    return Exploit::CheckCode::Unknown('No response or unexpected status code from target') unless res && res.code == 200

    # We need to take into account beta versions, which end with -beta<digit>. See: https://grafana.com/docs/grafana/latest/release-notes/
    # Also take into account preview versions, which end with -preview. See https://grafana.com/grafana/download/10.0.0-preview?edition=oss for more info.
    /"subTitle":"Grafana v(?<full_version>\d{1,2}\.\d{1,2}\.\d{1,2}(?:(?:-beta\d)?|(?:-preview)?)) \([0-9a-f]{10}\)",/ =~ res.body
    return Exploit::CheckCode::Safe('Could not detect Grafana version in response') unless full_version

    # However, since 8.3.1 does not have a beta, we can safely ignore the -beta suffix when comparing versions
    # In fact, this is necessary because Rex::Version doesn't correctly handle versions ending with -beta when comparing
    if /-beta\d$/ =~ full_version
      version = Rex::Version.new(full_version[0..-7])
    elsif /-preview$/ =~ full_version
      version = Rex::Version.new(full_version[0..-9])
    else
      version = Rex::Version.new(full_version)
    end

    if version.between?(Rex::Version.new('8.0.0-beta1'), Rex::Version.new('8.0.7')) ||
       version.between?(Rex::Version.new('8.1.0'), Rex::Version.new('8.1.8')) ||
       version.between?(Rex::Version.new('8.2.0'), Rex::Version.new('8.2.7')) ||
       version.be
Metasploit Module: Apache NiFi Version Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/apache_nifi_version.rb

Description:
This module identifies Apache NiFi websites and reports their version number.

          Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.11.0-1.13.0
          Also works against NiFi <= 1.13.0, but the module needs to be adjusted:
          set SSL false
          set rport 8080
Metasploit Module: HTTP Page Scraper
Type: auxiliary
Path: modules/auxiliary/scanner/http/scraper.rb
Authors: et

Description:
Scrape defined data from a specific web page based on a regular expression
Metasploit Module: Buffalo NAS Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/buffalo_login.rb

Description:
This module simply attempts to login to a Buffalo NAS instance using a specific
        username and password. It has been confirmed to work on version 1.68
Metasploit Module: Linksys E1500 Directory Traversal Vulnerability
Type: auxiliary
Path: modules/auxiliary/scanner/http/linksys_e1500_traversal.rb
References: CVE-2013-10062, URL-http://www.s3cur1ty.de/m1adv2013-004, URL-http://homekb.cisco.com/Cisco2/ukp.aspx?pid=80&app=vw&vw=1&login=1&json=1&docid=d7d0a87be9864e20bc347a73f194411f_KB_EN_v1.xml, BID-57760, OSVDB-89911, EDB-24475

Description:
This module exploits a directory traversal vulnerability which is present in
        different Linksys home routers, like the E1500.
Metasploit Module: WordPress TI WooCommerce Wishlist SQL Injection (CVE-2024-43917)
Type: auxiliary
Path: modules/auxiliary/scanner/http/wp_ti_woocommerce_wishlist_sqli.rb
Disclosure date: 2024-09-25
References: CVE-2024-43917, URL-https://patchstack.com/articles/unpatched-sql-injection-vulnerability-in-ti-woocommerce-wishlist-plugin/

Description:
The TI WooCommerce Wishlist plugin <= 2.8.2 is vulnerable to an unauthenticated SQL injection, allowing attackers to retrieve sensitive information.
Metasploit Module: GitLab Login Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/gitlab_login.rb
References: URL-https://labs.f-secure.com/archive/gitlab-user-enumeration/

Description:
This module attempts to login to a GitLab instance using a specific user/pass.
Metasploit Module: Oracle ILO Manager Login Brute Force Utility
Type: auxiliary
Path: modules/auxiliary/scanner/http/oracle_ilom_login.rb

Description:
This module scans for Oracle Integrated Lights Out Manager (ILO) login portal, and
          performs a login brute force attack to identify valid credentials.
Metasploit Module: WordPress DukaPress Plugin File Read Vulnerability
Type: auxiliary
Path: modules/auxiliary/scanner/http/wp_dukapress_file_read.rb
References: EDB-35346, CVE-2014-8799, OSVDB-115130

Description:
This module exploits a directory traversal vulnerability in WordPress Plugin
          "DukaPress" version <= 2.5.3, allowing to read arbitrary files with the
          web server privileges.

Check method (fingerprinting):
check_plugin_version_from_readme('dukapress', '2.5.4')
  end
Metasploit Module: Adobe XML External Entity Injection
Type: auxiliary
Path: modules/auxiliary/scanner/http/adobe_xml_inject.rb
References: CVE-2009-3960, OSVDB-62292, BID-38197, URL-http://www.security-assessment.com/files/advisories/2010-02-22_Multiple_Adobe_Products-XML_External_Entity_and_XML_Injection.pdf, URL-https://www.adobe.com/support/security/bulletins/apsb10-05.html

Description:
Multiple Adobe Products -- XML External Entity Injection. Affected Software: BlazeDS 3.2 and
        earlier versions, LiveCycle 9.0, 8.2.1, and 8.0.1, LiveCycle Data Services 3.0, 2.6.1, and
        2.5.1, Flex Data Services 2.0.1, ColdFusion 9.0, 8.0.1, 8.0, and 7.0.2
Metasploit Module: Wordpress Arbitrary File Deletion
Type: auxiliary
Path: modules/auxiliary/scanner/http/wp_arbitrary_file_deletion.rb
Platform: php
Disclosure date: 2018-06-26
References: CVE-2018-12895, EDB-44949, URL-https://blog.sonarsource.com/wordpress-file-delete-to-code-execution/, URL-https://blog.vulnspy.com/2018/06/27/Wordpress-4-9-6-Arbitrary-File-Delection-Vulnerbility-Exploit/

Description:
An arbitrary file deletion vulnerability in the WordPress core allows any user with privileges of an
          Author to completely take over the WordPress site and to execute arbitrary code on the server.
Metasploit Module: Total.js prior to 3.2.4 Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/totaljs_traversal.rb
Disclosure date: 2019-02-18
References: CVE-2019-8903, URL-https://blog.totaljs.com/blogs/news/20190213-a-critical-security-fix/, URL-https://security.snyk.io/vuln/SNYK-JS-TOTALJS-173710

Description:
This module check and exploits a directory traversal vulnerability in Total.js prior to 3.2.4.

          Here is a list of accepted extensions: flac, jpg, jpeg, png, gif, ico, js, css, txt, xml,
          woff, woff2, otf, ttf, eot, svg, zip, rar, pdf, docx, xlsx, doc, xls, html, htm, appcache,
          manifest, map, ogv, ogg, mp4, mp3, webp, webm, swf, package, json, md, m4v, jsx, heif, heic

Check method (fingerprinting):
uri = normalize_uri(target_uri.path) + '%2e%2e%2fpackage.json'
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => uri
    )
    if res && res.code == 200
      json = res.get_json_document
      if json.empty? || !json['dependencies']['total.js']
        return Exploit::CheckCode::Safe('Total.js dependency not found in package.json')
      else
        print_status("Total.js version is: #{json['dependencies']['total.js']}")
        print_status("App name: #{json['name']}")
        print_status("App description: #{json['description']}")
        print_status("App version: #{json['version']}")
        return Exploit::CheckCode::Vulnerable('Successfully retrieved package.json via path traversal')
      end
    elsif res && res.headers['X-Powered-By'].to_s.downcase.include?('total.js')
      print_status('Target appear to be vulnerable!')
      print_status("X-Powered-By: #{res.headers['X-Powered-By']}")
      return Exploit::CheckCode::Detected('Total.js detected via X-Powered-By header')
    else
      vprint_warning('No response')
      return Exploit::CheckCode::Unknown('No response received from target')
    end
  end
Metasploit Module: Apache HTTPD mod_negotiation Filename Bruter
Type: auxiliary
Path: modules/auxiliary/scanner/http/mod_negotiation_brute.rb

Description:
This module performs a brute force attack in order to discover existing files on a
          server which uses mod_negotiation. If the filename is found, the IP address and the
          files found will be displayed.
Metasploit Module: HTTP File Extension Scanner
Type: auxiliary
Path: modules/auxiliary/scanner/http/replace_ext.rb

Description:
This module identifies the existence of additional files
          by modifying the extension of an existing file.
Metasploit Module: ManageEngine DeviceExpert 5.6 ScheduleResultViewer FileName Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/manageengine_deviceexpert_traversal.rb
Disclosure date: 2012-03-18
References: OSVDB-80262

Description:
This module exploits a directory traversal vulnerability found in ManageEngine
          DeviceExpert's ScheduleResultViewer Servlet.  This is done by using
          "..\..\..\..\..\..\..\..\..\..\" in the path in order to retrieve a file on a
          vulnerable machine.  Please note that the SSL option is required in order to send
          HTTP requests.
Metasploit Module: Cisco Firepower Management Console 6.0 Post Auth Report Download Directory Traversal
Type: auxiliary
Path: modules/auxiliary/scanner/http/cisco_firepower_download.rb
Disclosure date: 2016-10-10
References: CVE-2016-6435, URL-https://blog.korelogic.com/blog/2016/10/10/virtual_appliance_spelunking

Description:
This module exploits a directory traversal vulnerability in Cisco Firepower Management
          under the context of www user. Authentication is required to exploit this vulnerability.
Metasploit Module: MS09-020 IIS6 WebDAV Unicode Authentication Bypass
Type: auxiliary
Path: modules/auxiliary/scanner/http/ms09_020_webdav_unicode_bypass.rb
References: MSB-MS09-020, CVE-2009-1535, CVE-2009-1122, OSVDB-54555, BID-34993

Description:
This module attempts to to bypass authentication using the WebDAV IIS6
          Unicode vulnerability discovered by Kingcope. The vulnerability appears
          to be exploitable where WebDAV is enabled on the IIS6 server, and any
          protected folder requires either Basic, Digest or NTLM authentication.