blitzstrike 2.4.112 → 2.4.114

package/intelligence/cve-corpus.json

@@ -1,6 +1,6 @@
 {
  "source": "nuclei-templates http/cves",
- "count": 4113,
+ "count": 4092,
  "cves": [
   {
    "cve": "CVE-2000-0114",
@@ -2477,15 +2477,6 @@
    "cwe": "CWE-287",
    "match": "\\b(?:netsweeper)\\b"
   },
-  {
-   "cve": "CVE-2014-9735",
-   "name": "WordPress RevSlider - Remote Code Execution via File Upload",
-   "product": "WordPress RevSlider",
-   "severity": "high",
-   "epss": "0.75256",
-   "cwe": "CWE-264",
-   "match": "\\b(?:revslider)\\b"
-  },
   {
    "cve": "CVE-2015-0554",
    "name": "ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure",
@@ -5402,15 +5393,6 @@
    "cwe": "CWE-22",
    "match": "\\b(?:filemanager|responsive)\\b"
   },
-  {
-   "cve": "CVE-2018-15745",
-   "name": "Argus Surveillance DVR 4.0.0.0 - Local File Inclusion",
-   "product": "Argus Surveillance DVR",
-   "severity": "high",
-   "epss": "0.97709",
-   "cwe": "CWE-22",
-   "match": "\\b(?:argus|dvr|for|samsung|surveillance|viewer)\\b"
-  },
   {
    "cve": "CVE-2018-15811",
    "name": "DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization",
@@ -8309,15 +8291,6 @@
    "cwe": "CWE-94",
    "match": "\\b(?:thinkphp)\\b"
   },
-  {
-   "cve": "CVE-2019-9194",
-   "name": "elFinder <= 2.1.47 - Command Injection",
-   "product": "elFinder",
-   "severity": "critical",
-   "epss": "0.96633",
-   "cwe": "CWE-78",
-   "match": "\\b(?:elfinder)\\b"
-  },
   {
    "cve": "CVE-2019-9618",
    "name": "WordPress GraceMedia Media Player 1.0 - Local File Inclusion",
@@ -8894,15 +8867,6 @@
    "cwe": "CWE-306",
    "match": "\\b(?:vbulletin)\\b"
   },
-  {
-   "cve": "CVE-2020-12800",
-   "name": "WordPress Contact Form 7 <1.3.3.3 - Remote Code Execution",
-   "product": "WordPress Contact Form",
-   "severity": "critical",
-   "epss": "0.78751",
-   "cwe": "CWE-434",
-   "match": "\\b(?:contact|form)\\b"
-  },
   {
    "cve": "CVE-2020-12832",
    "name": "WordPress Simple File List - Path Traversal",
@@ -10559,15 +10523,6 @@
    "cwe": "CWE-89",
    "match": "\\b(?:bookstore|cse)\\b"
   },
-  {
-   "cve": "CVE-2020-36155",
-   "name": "Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta",
-   "product": "Ultimate Member",
-   "severity": "critical",
-   "epss": "0.08975",
-   "cwe": "CWE-269",
-   "match": "\\b(?:member|plugins|ultimate)\\b"
-  },
   {
    "cve": "CVE-2020-36289",
    "name": "Jira Server and Data Center - Information Disclosure",
@@ -11882,15 +11837,6 @@
    "cwe": "CWE-94",
    "match": "\\b(?:lodash|template)\\b"
   },
-  {
-   "cve": "CVE-2021-23394",
-   "name": "elFinder < 2.1.58 - Remote Code Execution",
-   "product": "elFinder",
-   "severity": "high",
-   "epss": "0.19083",
-   "cwe": "CWE-434",
-   "match": "\\b(?:elfinder)\\b"
-  },
   {
    "cve": "CVE-2021-24139",
    "name": "10Web Photo Gallery < 1.5.55 - SQL Injection",
@@ -12134,15 +12080,6 @@
    "cwe": "CWE-79",
    "match": "\\b(?:contact|form|supsystic)\\b"
   },
-  {
-   "cve": "CVE-2021-24278",
-   "name": "WordPress Contact Form 7 <2.3.4 - Arbitrary Nonce Generation",
-   "product": "WordPress Contact Form",
-   "severity": "high",
-   "epss": "0.07359",
-   "cwe": "CWE-863",
-   "match": "\\b(?:contact|form)\\b"
-  },
   {
    "cve": "CVE-2021-24284",
    "name": "WordPress Kaswara Modern VC Addons <=3.0.1 - Arbitrary File Upload",
@@ -12881,15 +12818,6 @@
    "cwe": "CWE-79",
    "match": "\\b(?:feedwordpress)\\b"
   },
-  {
-   "cve": "CVE-2021-25063",
-   "name": "WordPress Contact Form 7 Skins <=2.5.0 - Cross-Site Scripting",
-   "product": "WordPress Contact Form",
-   "severity": "medium",
-   "epss": "0.02412",
-   "cwe": "CWE-79",
-   "match": "\\b(?:contact|form)\\b"
-  },
   {
    "cve": "CVE-2021-25065",
    "name": "Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting",
@@ -14069,15 +13997,6 @@
    "cwe": "CWE-287",
    "match": "\\b(?:octobercms)\\b"
   },
-  {
-   "cve": "CVE-2021-32682",
-   "name": "elFinder 2.1.58 - Remote Code Execution",
-   "product": "elFinder",
-   "severity": "critical",
-   "epss": "0.69934",
-   "cwe": "CWE-22",
-   "match": "\\b(?:elfinder)\\b"
-  },
   {
    "cve": "CVE-2021-32789",
    "name": "WooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL Injection",
@@ -15572,15 +15491,6 @@
    "cwe": "CWE-200",
    "match": "\\b(?:build|create|gocd|pipeline|pipelines|pre|takeover)\\b"
   },
-  {
-   "cve": "CVE-2021-43421",
-   "name": "Studio-42 elFinder <2.1.60 - Arbitrary File Upload",
-   "product": "Studio-42 elFinder",
-   "severity": "critical",
-   "epss": "0.42781",
-   "cwe": "CWE-434",
-   "match": "\\b(?:elfinder)\\b"
-  },
   {
    "cve": "CVE-2021-43495",
    "name": "AlquistManager Local File Inclusion",
@@ -16319,15 +16229,6 @@
    "cwe": "CWE-79",
    "match": "\\b(?:woocs)\\b"
   },
-  {
-   "cve": "CVE-2022-0250",
-   "name": "Redirection for Contact Form 7 < 2.5.0 - Cross-Site Scripting",
-   "product": "Redirection for Contact Form",
-   "severity": "medium",
-   "epss": "0.01513",
-   "cwe": "CWE-79",
-   "match": "\\b(?:contact|for|form|plugins|redirect|redirection|wpcf7)\\b"
-  },
   {
    "cve": "CVE-2022-0271",
    "name": "LearnPress <4.1.6 - Cross-Site Scripting",
@@ -16562,15 +16463,6 @@
    "cwe": "CWE-863",
    "match": "\\b(?:shareaholic)\\b"
   },
-  {
-   "cve": "CVE-2022-0595",
-   "name": "WordPress Contact Form 7 <1.3.6.3 - Stored Cross-Site Scripting",
-   "product": "WordPress Contact Form",
-   "severity": "medium",
-   "epss": "0.13575",
-   "cwe": "CWE-79",
-   "match": "\\b(?:contact|form)\\b"
-  },
   {
    "cve": "CVE-2022-0597",
    "name": "Microweber < 1.2.11 - Open Redirection",
@@ -17516,15 +17408,6 @@
    "cwe": "CWE-78",
    "match": "\\b(?:gitlab)\\b"
   },
-  {
-   "cve": "CVE-2022-2187",
-   "name": "WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting",
-   "product": "WordPress Contact Form",
-   "severity": "medium",
-   "epss": "0.01428",
-   "cwe": "CWE-79",
-   "match": "\\b(?:contact|form)\\b"
-  },
   {
    "cve": "CVE-2022-2219",
    "name": "Unyson < 2.7.27 - Cross Site Scripting",
@@ -18200,15 +18083,6 @@
    "cwe": "CWE-425",
    "match": "\\b(?:board|job|ninja)\\b"
   },
-  {
-   "cve": "CVE-2022-2546",
-   "name": "WordPress All-in-One WP Migration <=7.62 - Cross-Site Scripting",
-   "product": "WordPress All-in-One WP Migration",
-   "severity": "medium",
-   "epss": "0.01204",
-   "cwe": "CWE-79",
-   "match": "\\b(?:all|migration|one)\\b"
-  },
   {
    "cve": "CVE-2022-25481",
    "name": "ThinkPHP 5.0.24 - Information Disclosure",
@@ -18434,15 +18308,6 @@
    "cwe": "CWE-306",
    "match": "\\b(?:automation|oas)\\b"
   },
-  {
-   "cve": "CVE-2022-26960",
-   "name": "elFinder <=2.1.60 - Local File Inclusion",
-   "product": "elFinder",
-   "severity": "critical",
-   "epss": "0.50993",
-   "cwe": "CWE-22",
-   "match": "\\b(?:elfinder)\\b"
-  },
   {
    "cve": "CVE-2022-27043",
    "name": "Yearning - Directory Traversal",
@@ -23438,15 +23303,6 @@
    "cwe": "CWE-79",
    "match": "\\b(?:gibbon)\\b"
   },
-  {
-   "cve": "CVE-2023-3460",
-   "name": "Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation",
-   "product": "Ultimate Member",
-   "severity": "critical",
-   "epss": "0.72306",
-   "cwe": "CWE-269",
-   "match": "\\b(?:member|ultimate)\\b"
-  },
   {
    "cve": "CVE-2023-34659",
    "name": "JeecgBoot 3.5.0 - SQL Injection",
@@ -25139,15 +24995,6 @@
    "cwe": null,
    "match": "\\b(?:gibbon|lms)\\b"
   },
-  {
-   "cve": "CVE-2023-4596",
-   "name": "WordPress Plugin Forminator 1.24.6 - Arbitrary File Upload",
-   "product": "WordPress Plugin Forminator",
-   "severity": "critical",
-   "epss": "0.12749",
-   "cwe": "CWE-434",
-   "match": "\\b(?:forminator)\\b"
-  },
   {
    "cve": "CVE-2023-4634",
    "name": "Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion",
@@ -26480,15 +26327,6 @@
    "cwe": "CWE-22",
    "match": "\\b(?:plugins|system)\\b"
   },
-  {
-   "cve": "CVE-2024-1071",
-   "name": "WordPress Ultimate Member 2.1.3 - 2.8.2 \u2013 SQL Injection",
-   "product": "WordPress Ultimate Member",
-   "severity": "critical",
-   "epss": "0.89431",
-   "cwe": "CWE-89",
-   "match": "\\b(?:member|plugins|ultimate)\\b"
-  },
   {
    "cve": "CVE-2024-10763",
    "name": "WordPress Campress Theme <= 1.35 - Unauthenticated Local File Inclusion",
@@ -30854,15 +30692,6 @@
    "cwe": "CWE-22",
    "match": "\\b(?:affiliate|grow|plugins|tracker|tradedoubler)\\b"
   },
-  {
-   "cve": "CVE-2024-6517",
-   "name": "Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting",
-   "product": "Contact Form",
-   "severity": "medium",
-   "epss": "0.00665",
-   "cwe": "CWE-79",
-   "match": "\\b(?:contact|form)\\b"
-  },
   {
    "cve": "CVE-2024-6555",
    "name": "WP Popups - Information Disclosure",
@@ -31376,15 +31205,6 @@
    "cwe": null,
    "match": "\\b(?:webiq)\\b"
   },
-  {
-   "cve": "CVE-2024-8852",
-   "name": "All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure",
-   "product": "All-in-One WP Migration",
-   "severity": "medium",
-   "epss": "0.01175",
-   "cwe": "CWE-532",
-   "match": "\\b(?:all|migration|one|plugins)\\b"
-  },
   {
    "cve": "CVE-2024-8856",
    "name": "WP Time Capsule Plugin - Remote Code Execution",
@@ -33338,15 +33158,6 @@
    "cwe": "CWE-94",
    "match": "\\b(?:extra|ocean|oceanwp|woocommerce)\\b"
   },
-  {
-   "cve": "CVE-2025-3515",
-   "name": "Contact Form 7 Drag and Drop Multiple File Upload - Arbitrary File Upload",
-   "product": "Contact Form",
-   "severity": "high",
-   "epss": "0.0509",
-   "cwe": "CWE-434",
-   "match": "\\b(?:contact|form)\\b"
-  },
   {
    "cve": "CVE-2025-3605",
    "name": "WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.112",
+  "version": "2.4.114",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {