wpscan 3.8.28 → 4.0.1

data/app/models/version.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module WPScan
+  module Model
+    # Version
+    class Version
+      include Finders::Finding
+
+      attr_reader :number
+
+      def initialize(number, opts = {})
+        @number = number.to_s
+        @number = "0#{number}" if @number[0, 1] == '.'
+
+        parse_finding_options(opts)
+      end
+
+      # @param [ Version, String ] other
+      # rubocop:disable Style/NumericPredicate
+      def ==(other)
+        (self <=> other) == 0
+      end
+      # rubocop:enable all
+
+      # @param [ Version, String ] other
+      def <(other)
+        (self <=> other) == -1
+      end
+
+      # @param [ Version, String ] other
+      def >(other)
+        (self <=> other) == 1
+      end
+
+      # @param [ Version, String ] other
+      def <=>(other)
+        other = Version.new(other) unless other.is_a?(Version) # handle potential '.1' version
+
+        Gem::Version.new(number) <=> Gem::Version.new(other.number)
+      rescue ArgumentError
+        false
+      end
+
+      def to_s
+        number
+      end
+    end
+  end
+end

data/app/models/wp_item/wordpress_org_data.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module WPScan
+  module Model
+    class WpItem
+      # Fetches and exposes the public wordpress.org info API response for a
+      # plugin or theme. The HTTP call is performed at most once per item.
+      module WordpressOrgData
+        # Timeout (in seconds) for the wordpress.org API lookup. Kept low so a
+        # slow or unreachable wordpress.org does not noticeably stall the scan.
+        WORDPRESS_ORG_API_TIMEOUT = 5
+
+        # @return [ String, nil ] The wordpress.org API URL returning info for
+        #   this item. Subclasses override this; nil disables the lookup.
+        def wordpress_org_api_url
+          nil
+        end
+
+        # @return [ Hash ] Empty hash if the item is not on wordpress.org or the
+        #   lookup fails.
+        def wordpress_org_data
+          return @wordpress_org_data if defined?(@wordpress_org_data)
+
+          @wordpress_org_data = fetch_wordpress_org_data
+        end
+
+        # Number of active installs as reported by the wordpress.org API.
+        # See https://codex.wordpress.org/WordPress.org_API
+        #
+        # @return [ Integer, nil ]
+        def active_installs
+          wordpress_org_data['active_installs']
+        end
+
+        private
+
+        # @return [ Hash ]
+        def fetch_wordpress_org_data
+          url = wordpress_org_api_url
+          return {} unless url
+
+          res = Browser.get(url, connecttimeout: WORDPRESS_ORG_API_TIMEOUT, timeout: WORDPRESS_ORG_API_TIMEOUT)
+          return {} unless res.code == 200
+
+          data = JSON.parse(res.body)
+          data.is_a?(Hash) ? data : {}
+        rescue StandardError
+          {}
+        end
+      end
+
+      include WordpressOrgData
+    end
+  end
+end

data/app/models/wp_item.rb

@@ -6,8 +6,8 @@ module WPScan
     class WpItem
       include Vulnerable
       include Finders::Finding
-      include CMSScanner::Target::Platform::PHP
-      include CMSScanner::Target::Server::Generic
+      include WPScan::Target::Platform::PHP
+      include WPScan::Target::Server::Generic
 
       # Most common readme filenames, based on checking all public plugins and themes.
       READMES = %w[readme.txt README.txt README.md readme.md Readme.txt].freeze
@@ -41,23 +41,25 @@ module WPScan
 
         Array(db_data['vulnerabilities']).each do |json_vuln|
           vulnerability = Vulnerability.load_from_json(json_vuln)
+          vulnerability.detected_version = version || nil
           @vulnerabilities << vulnerability if vulnerable_to?(vulnerability)
         end
 
         @vulnerabilities
       end
 
-      # Checks if the wp_item is vulnerable to a specific vulnerability
+      # Checks if the wp_item is vulnerable to a specific vulnerability.
+      # A vuln with multiple backported ranges matches when any single range
+      # covers the detected version.
       #
       # @param [ Vulnerability ] vuln Vulnerability to check the item against
       #
       # @return [ Boolean ]
       def vulnerable_to?(vuln)
-        return false if version && vuln&.introduced_in && version < vuln.introduced_in
+        return true unless version
+        return true if vuln.nil?
 
-        return true unless version && vuln&.fixed_in && !vuln.fixed_in.empty?
-
-        version < vuln.fixed_in
+        vuln.affects?(version)
       end
 
       # @return [ String ]
@@ -71,9 +73,109 @@ module WPScan
         @popular ||= metadata['popular'] ? true : false
       end
 
-      # @return [ String ]
+      # @return [ String, nil ]
       def last_updated
-        @last_updated ||= metadata['last_updated']
+        resolve_last_updated unless defined?(@last_updated)
+        @last_updated
+      end
+
+      # @return [ String, nil ] 'db', 'wordpress.org', or nil when last_updated is unknown
+      def last_updated_source
+        resolve_last_updated unless defined?(@last_updated_source)
+        @last_updated_source
+      end
+
+      # WordPress.org takes precedence over local DB metadata since the WPScan
+      # DB is not synced in real time and may be stale.
+      def resolve_last_updated
+        if (api_value = wordpress_org_data['last_updated'])
+          @last_updated        = api_value
+          @last_updated_source = 'WordPress.org'
+        elsif (db_value = metadata['last_updated'])
+          @last_updated        = db_value
+          @last_updated_source = 'db'
+        else
+          @last_updated        = nil
+          @last_updated_source = nil
+        end
+      end
+
+      # @return [ String, nil ] Human-friendly relative time hint for last_updated
+      #   (e.g. "3 months ago"). nil when last_updated cannot be parsed.
+      def last_updated_relative
+        @last_updated_relative ||= relative_time_for(last_updated)
+      end
+
+      # Parenthesized annotation appended to the CLI "Last Updated" line, e.g.
+      # " (3 months ago, per wordpress.org)". Empty string when there is nothing
+      # to annotate.
+      #
+      # @return [ String ]
+      def last_updated_cli_suffix
+        parts = []
+        parts << last_updated_relative if last_updated_relative
+        parts << 'per WordPress.org' if last_updated_source == 'WordPress.org'
+        parts.empty? ? '' : " (#{parts.join(', ')})"
+      end
+
+      # ISO 8601 (UTC) representation of last_updated, used by the JSON output so
+      # downstream consumers always see a consistent format regardless of whether
+      # the value came from the local DB or the wordpress.org API.
+      #
+      # @return [ String, nil ]
+      def last_updated_iso
+        return @last_updated_iso if defined?(@last_updated_iso)
+
+        @last_updated_iso = parse_last_updated&.iso8601
+      end
+
+      # Friendly representation of last_updated, used in CLI output, matching the
+      # wordpress.org API style (e.g. "2026-04-14 12:01pm GMT"). Falls back to the
+      # raw string when the value cannot be parsed.
+      #
+      # @return [ String, nil ]
+      def last_updated_display
+        return @last_updated_display if defined?(@last_updated_display)
+
+        time = parse_last_updated
+        @last_updated_display = time ? time.strftime('%Y-%m-%d %-l:%M%P GMT') : last_updated
+      end
+
+      # @return [ Time, nil ] last_updated parsed as UTC Time, or nil
+      def parse_last_updated
+        value = last_updated
+        return nil if value.nil? || value.to_s.strip.empty?
+
+        Time.parse(value.to_s).utc
+      rescue ArgumentError, TypeError
+        nil
+      end
+
+      # @param [ String, nil ] value A timestamp parseable by Time.parse
+      # @return [ String, nil ]
+      def relative_time_for(value)
+        return nil if value.nil? || value.to_s.strip.empty?
+
+        time  = Time.parse(value.to_s).utc
+        delta = Time.now.utc - time
+        return 'in the future' if delta.negative?
+
+        seconds = delta.to_i
+        case seconds
+        when 0...60        then 'just now'
+        when 60...3600     then pluralize_unit(seconds / 60, 'minute')
+        when 3600...86_400 then pluralize_unit(seconds / 3600, 'hour')
+        when 86_400...2_592_000 then pluralize_unit(seconds / 86_400, 'day')
+        when 2_592_000...31_536_000 then pluralize_unit(seconds / 2_592_000, 'month')
+        else pluralize_unit(seconds / 31_536_000, 'year')
+        end
+      rescue ArgumentError, TypeError
+        nil
+      end
+
+      # @return [ String ]
+      def pluralize_unit(count, unit)
+        "#{count} #{unit}#{'s' if count != 1} ago"
       end
 
       # @return [ Boolean ]
@@ -133,9 +235,9 @@ module WPScan
       #
       # @return [ Boolean ]
       def directory_listing?(path = nil, params = {})
-        return if detection_opts[:mode] == :passive
+        return false if detection_opts[:mode] == :passive
 
-        super(path, params)
+        super
       end
 
       # @param [ String ] path
@@ -143,12 +245,12 @@ module WPScan
       #
       # @return [ Boolean ]
       def error_log?(path = 'error_log', params = {})
-        return if detection_opts[:mode] == :passive
+        return false if detection_opts[:mode] == :passive
 
-        super(path, params)
+        super
       end
 
-      # See CMSScanner::Target#head_and_get
+      # See WPScan::Target#head_and_get
       #
       # This is used by the error_log? above in the super()
       # to have the correct path (ie readme.txt checked from the plugin/theme location

data/app/models/wp_version.rb

@@ -3,13 +3,13 @@
 module WPScan
   module Model
     # WP Version
-    class WpVersion < CMSScanner::Model::Version
+    class WpVersion < WPScan::Model::Version
       include Vulnerable
 
       def initialize(number, opts = {})
         raise Error::InvalidWordPressVersion unless WpVersion.valid?(number.to_s)
 
-        super(number, opts)
+        super
       end
 
       # @param [ String ] number
@@ -58,7 +58,9 @@ module WPScan
         @vulnerabilities = []
 
         Array(db_data['vulnerabilities']).each do |json_vuln|
-          @vulnerabilities << Vulnerability.load_from_json(json_vuln)
+          vulnerability = Vulnerability.load_from_json(json_vuln)
+          vulnerability.detected_version = self
+          @vulnerabilities << vulnerability
         end
 
         @vulnerabilities

data/app/models/xml_rpc.rb

@@ -2,9 +2,79 @@
 
 module WPScan
   module Model
-    # Override of the CMSScanner::XMLRPC to include the references
-    class XMLRPC < CMSScanner::Model::XMLRPC
-      include References # To be able to use the :wpvulndb reference if needed
+    # XML-RPC interface.
+    class XMLRPC < InterestingFinding
+      include References
+
+      # @return [ String ]
+      def to_s
+        @to_s ||= "XML-RPC seems to be enabled: #{url}"
+      end
+
+      # @return [ Browser ]
+      def browser
+        @browser ||= WPScan::Browser.instance
+      end
+
+      # @return [ Array<String> ]
+      def available_methods
+        return @available_methods if @available_methods
+
+        @available_methods = []
+
+        res = method_call('system.listMethods').run
+        doc = Nokogiri::XML.parse(res.body)
+
+        doc.search('methodResponse params param value array data value string').each do |s|
+          @available_methods << s.text
+        end
+
+        @available_methods
+      end
+
+      # @return [ Boolean ] Whether or not the XMLRPC is enabled
+      def enabled?
+        !available_methods.empty?
+      end
+
+      # @param [ String ] method_name
+      # @param [ Array ] method_params
+      # @param [ Hash ] request_params
+      #
+      # @return [ Typhoeus::Request ]
+      def method_call(method_name, method_params = [], request_params = {})
+        browser.forge_request(
+          url,
+          request_params.merge(
+            method: :post,
+            body: ::XMLRPC::Create.new.methodCall(method_name, *method_params)
+          )
+        )
+      end
+
+      # @param [ Array<Array> ] methods_and_params
+      # @param [ Hash ] request_params
+      #
+      # Example of methods_and_params:
+      # [
+      #   [method1, param1, param2],
+      #   [method2, param1],
+      #   [method3]
+      # ]
+      #
+      # @return [ Typhoeus::Request ]
+      def multi_call(methods_and_params = [], request_params = {})
+        browser.forge_request(
+          url,
+          request_params.merge(
+            method: :post,
+            body: ::XMLRPC::Create.new.methodCall(
+              'system.multicall',
+              methods_and_params.collect { |m| { methodName: m[0], params: m[1..] } }
+            )
+          )
+        )
+      end
 
       # @return [ Hash ]
       def references

data/app/models.rb

@@ -2,7 +2,6 @@
 
 module WPScan
   module Model
-    include CMSScanner::Model
   end
 end
 
@@ -10,9 +9,11 @@ require_relative 'models/interesting_finding'
 require_relative 'models/wp_version'
 require_relative 'models/xml_rpc'
 require_relative 'models/wp_item'
+require_relative 'models/wp_item/wordpress_org_data'
 require_relative 'models/timthumb'
 require_relative 'models/media'
 require_relative 'models/plugin'
 require_relative 'models/theme'
 require_relative 'models/config_backup'
 require_relative 'models/db_export'
+require_relative 'models/backup_folder'

data/app/user_agents.txt

@@ -0,0 +1,46 @@
+# Windows
+Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.0.249.0 Safari/532.5
+Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.14 (KHTML, like Gecko) Chrome/9.0.601.0 Safari/534.14
+Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.27 (KHTML, like Gecko) Chrome/12.0.712.0 Safari/534.27
+Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.24 Safari/535.1
+Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8 ( .NET CLR 3.5.30729; .NET4.0E)
+Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
+Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
+Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko/20100101 Firefox/7.0.1
+Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.6 (KHTML, like Gecko) Chrome/20.0.1092.0 Safari/536.6
+Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1
+Mozilla/5.0 (Windows NT 6.1; rv:12.0) Gecko/20120403211507 Firefox/12.0
+Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20120427 Firefox/15.0a1
+Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)
+Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
+Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/6.0)
+Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00
+Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.19.4 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5
+
+# MAC
+Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.15 Safari/534.13
+Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.5; en-US; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15
+Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
+Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/418.8 (KHTML, like Gecko) Safari/419.3
+Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit/536.3 (KHTML, like Gecko) Chrome/19.0.1063.0 Safari/536.3
+Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) Gecko/20100101 Firefox/10.0.1
+Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10
+
+# Linux
+Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.20 Safari/535.1
+Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.24 (KHTML, like Gecko) Ubuntu/10.10 Chromium/12.0.703.0 Chrome/12.0.703.0 Safari/534.24
+Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.9) Gecko/20100915 Gentoo Firefox/3.6.9
+Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.16) Gecko/20120421 Gecko Firefox/11.0
+Mozilla/5.0 (X11; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0
+Opera/9.80 (X11; Linux x86_64; U; pl) Presto/2.7.62 Version/11.00
+Mozilla/5.0 (X11; U; Linux x86_64; us; rv:1.9.1.19) Gecko/20110430 shadowfox/7.0 (like Firefox/7.0
+
+# iPad
+Mozilla/5.0 (iPad; CPU OS 7_1_1 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D201 Safari/9537.53
+Mozilla/5.0 (iPad; CPU OS 7_0_4 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11B554a Safari/9537.53
+Mozilla/5.0 (iPad; CPU OS 6_1_3 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10B329 Safari/8536.25
+
+# iPhone
+Mozilla/5.0 (iPhone; CPU iPhone OS 7_0 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11A465 Safari/9537.53
+Mozilla/5.0 (iPhone; CPU iPhone OS 7_0_3 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11B511 Safari/9537.53
+Mozilla/5.0 (iPhone; CPU iPhone OS 7_1_1 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D201 Safari/9537.53

data/app/views/cli/core/banner.erb

@@ -6,9 +6,9 @@ _______________________________________________________________
             \  /\  /  | |     ____) | (__| (_| | | | |
              \/  \/   |_|    |_____/ \___|\__,_|_| |_|
 
-         WordPress Security Scanner by the WPScan Team
+                  WordPress Security Scanner
                          Version <%= WPScan::VERSION %>
-<%= ' ' * ((63 - WPScan::DB::Sponsor.text.length)/2) + WPScan::DB::Sponsor.text %>
-       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
+                    An Automattic endeavor
+                    https://automattic.com
 _______________________________________________________________
 

data/app/views/cli/core/finished.erb

@@ -0,0 +1,15 @@
+<%= info_icon %> Finished: <%= @stop_time.asctime %>
+<%= info_icon %> Requests Done: <%= @requests_done %>
+<%= info_icon %> Cached Requests: <%= @cached_requests %>
+<% if @response_status_codes && !@response_status_codes.empty? -%>
+<%= info_icon %> Most response codes received: <%= @response_status_codes.map { |label, count| "#{label}: #{count}" }.join(', ') %>
+<% end -%>
+<% if @response_status_codes_warnings && !@response_status_codes_warnings.empty? -%>
+<% @response_status_codes_warnings.each do |warning| -%>
+<%= warning_icon %> <%= warning %>
+<% end -%>
+<% end -%>
+<%= info_icon %> Data Sent: <%= @data_sent.bytes_to_human %>
+<%= info_icon %> Data Received: <%= @data_received.bytes_to_human %>
+<%= info_icon %> Memory used: <%= @used_memory.bytes_to_human %>
+<%= info_icon %> Elapsed time: <%= Time.at(@elapsed).utc.strftime('%H:%M:%S') %>

data/app/views/cli/core/help.erb

@@ -0,0 +1,4 @@
+<%= @help %>
+<% if @simple -%>
+[!] To see full list of options use --hh.
+<% end -%>

data/app/views/cli/core/started.erb

@@ -0,0 +1,11 @@
+<%= info_icon %> URL: <%= @url %> [<%= @ip %>]
+<% if @url != @effective_url -%>
+<%= info_icon %> Effective URL: <%= @effective_url %>
+<% end -%>
+<%= info_icon %> Started: <%= @start_time.asctime %>
+<%= info_icon %> Command Line: wpscan <%= @command_line %>
+<%= info_icon %> Hostname: <%= @hostname %>
+<% if WPScan::ParsedCli.exclude_vulns && !WPScan::ParsedCli.exclude_vulns.empty? -%>
+<%= warning_icon %> Excluded vulnerabilities: <%= Array(WPScan::ParsedCli.exclude_vulns).join(', ') %>
+<% end -%>
+

data/app/views/cli/enumeration/backup_folders.erb

@@ -0,0 +1,11 @@
+<% if @backup_folders.empty? -%>
+<%= notice_icon %> No Backup Folders Found.
+<% else -%>
+<%= notice_icon %> Backup Folder(s) Identified:
+<% @backup_folders.each do |backup_folder| -%>
+
+<% icon = backup_folder.severity == :high ? critical_icon : warning_icon -%>
+<%= icon %> <%= backup_folder %>
+<%= render('@finding', item: backup_folder) -%>
+<% end -%>
+<% end %>

data/app/views/cli/enumeration/plugin.erb

@@ -0,0 +1,13 @@
+<%= bar_clear -%>
+
+<%= info_icon %> <%= @plugin %>
+<%= render('@wp_item', wp_item: @plugin) -%>
+ |
+<%= render('@finding', item: @plugin) -%>
+ |
+<% if @plugin.version -%>
+ | Version: <%= @plugin.version %> (<%= @plugin.version.confidence %>% confidence)
+<%= render('@finding', item: @plugin.version) -%>
+<% else -%>
+ | The version could not be determined.
+<% end -%>

data/app/views/cli/enumeration/plugins.erb

@@ -4,17 +4,6 @@
 <% else -%>
 <%= notice_icon %> Plugin(s) Identified:
 <% @plugins.each do |plugin| -%>
-
-<%= info_icon %> <%= plugin %>
-<%= render('@wp_item', wp_item: plugin) -%>
- |
-<%= render('@finding', item: plugin) -%>
- |
-<% if plugin.version -%>
- | Version: <%= plugin.version %> (<%= plugin.version.confidence %>% confidence)
-<%= render('@finding', item: plugin.version) -%>
-<% else -%>
- | The version could not be determined.
-<% end -%>
+<%= render('plugin', plugin: plugin) -%>
 <% end -%>
 <% end %>

data/app/views/cli/enumeration/theme.erb

@@ -0,0 +1,4 @@
+<%= bar_clear -%>
+
+<%= info_icon %> <%= @theme %>
+<%= render('@theme', theme: @theme, show_parents: false) -%>

data/app/views/cli/enumeration/themes.erb

@@ -4,8 +4,6 @@
 <% else -%>
 <%= notice_icon %> Theme(s) Identified:
 <% @themes.each do |theme| -%>
-
-<%= info_icon %> <%= theme %>
-<%= render('@theme', theme: theme, show_parents: false) -%>
+<%= render('theme', theme: theme) -%>
 <% end -%>
 <% end %>

data/app/views/cli/enumeration/user.erb

@@ -0,0 +1,4 @@
+<%= bar_clear -%>
+
+<%= info_icon %> <%= @user %>
+<%= render('@finding', item: @user) -%>

data/app/views/cli/enumeration/users.erb

@@ -4,8 +4,6 @@
 <% else -%>
 <%= notice_icon %> User(s) Identified:
 <% @users.each do |user| -%>
-
-<%= info_icon %> <%= user %>
-<%= render('@finding', item: user) -%>
+<%= render('user', user: user) -%>
 <% end -%>
 <% end %>

data/app/views/cli/finding.erb

@@ -18,7 +18,7 @@
 <% end -%>
 <% end -%>
 <% end -%>
-<% if @item.respond_to?(:vulnerabilities) && !(vulns = @item.vulnerabilities).empty? -%>
+<% if @item.respond_to?(:filtered_vulnerabilities) && !(vulns = @item.filtered_vulnerabilities).empty? -%>
 <% vulns_size = vulns.size -%>
  |
  | <%= critical_icon %> <%= vulns_size %> <%= vulns_size == 1 ? 'vulnerability' : 'vulnerabilities' %> identified:

data/app/views/cli/interesting_findings/_array.erb

@@ -0,0 +1,10 @@
+<% unless @a.empty? -%>
+<% if @a.size == 1 -%>
+ | <%= @s %>: <%= @a.first %>
+<% else -%>
+ | <%= @p %>:
+<% @a.each do |line| -%>
+ |  - <%= line %>
+<% end -%>
+<% end -%>
+<% end -%>

data/app/views/cli/interesting_findings/findings.erb

@@ -0,0 +1,23 @@
+<% unless @findings.empty? -%>
+Interesting Finding(s):
+<% @findings.each do |finding| -%>
+
+<%= info_icon %> <%= finding %>
+<%= render('_array', a: finding.interesting_entries, s: 'Interesting Entry', p: 'Interesting Entries') -%>
+ | Found By: <%= finding.found_by %>
+<% if finding.confidence > 0 -%>
+ | Confidence: <%= finding.confidence %>%
+<% end -%>
+<% unless (confirmed = finding.confirmed_by).empty? -%>
+<% if confirmed.size == 1 -%>
+ | Confirmed By: <%= confirmed.first.found_by %><% if confirmed.first.confidence > 0 %>, <%= confirmed.first.confidence %>% confidence<% end %>
+<% else -%>
+ | Confirmed By:
+<% confirmed.each do |c| -%>
+ |  - <%= c.found_by %><% if c.confidence > 0 %>, <%= c.confidence %>% confidence<% end %>
+<% end -%>
+<% end -%>
+<% end -%>
+<%= render('_array', a: finding.references_urls, s: 'Reference', p: 'References') -%>
+<% end -%>
+<% end %>

data/app/views/cli/scan_aborted.erb

@@ -0,0 +1,5 @@
+
+Scan Aborted: <%= @reason %>
+<% if @verbose -%>
+Trace: <%= @trace.join("\n") %>
+<% end %>

data/app/views/cli/update_aborted.erb

@@ -0,0 +1,5 @@
+
+Update Aborted: <%= @reason %>
+<% if @verbose -%>
+Trace: <%= @trace.join("\n") %>
+<% end %>

data/app/views/cli/vuln_api/status.erb

@@ -1,6 +1,8 @@
 <% unless @status.empty? -%>
 <% if @status['http_error'] -%>
 <%= critical_icon %> WPScan DB API, <%= @status['http_error'].to_s %>
+<% elsif @status['parse_error'] -%>
+<%= critical_icon %> WPScan DB API returned an invalid response. Please check your network/proxy configuration or try again later.
 <% else -%>
 <%= info_icon %> WPScan DB API OK
  | Plan: <%= @status['plan'] %>