blitzstrike 2.4.114 → 2.4.115

package/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.115] — 2026-09-17
+
+### Reverted — brand guard on the CVE corpus
+
+- The CVE corpus is a factual reference (CVE id → product name), so
+  competitor/vendor product names (elFinder / RevSlider / wpcf7 / ultimate-member
+  / …) are allowed there — the brand guard applies to FRAMING (README/CHANGELOG/
+  tool descriptions), not the CVE list. Removed the BRAND_GUARD filter from both
+  the sync script and the live loader; the corpus is back to 4,113 entries.
+
 ## [2.4.114] — 2026-09-17
 
 ### Fixed — brand guard in the nuclei CVE corpus

package/dist/index.js

@@ -36489,35 +36489,6 @@ var GENERIC = new Set([
   "top",
   "new"
 ]);
-var BRAND_GUARD = [
-  "argus",
-  "wordfence",
-  "hexstrike",
-  "0x4m4",
-  "claude-bughunter",
-  "elementalsouls",
-  "wpcf7",
-  "contact form 7",
-  "elfinder",
-  "ultimate-member",
-  "ultimate member",
-  "forminator",
-  "ai1wm",
-  "all-in-one wp migration",
-  "all in one wp migration",
-  "revslider",
-  "revolution slider",
-  "awarexone",
-  "agentic-bug-hunter",
-  "bugbounty-lab101",
-  "devcop95",
-  "omop",
-  "deve101"
-];
-function isBrandGuarded(text) {
-  const t = text.toLowerCase();
-  return BRAND_GUARD.some((b) => t.includes(b));
-}
 function tokens(text) {
   const out = [];
   for (const t of text.toLowerCase().split(/[^a-z0-9]+/)) {
@@ -36545,8 +36516,6 @@ function parseTemplate(text) {
   const cwe = firstMatch(text, /^\s*cwe-id:\s*(CWE-\d+)/m) ?? undefined;
   let prod = name.split(/\s+-\s+|:\s+/, 1)[0].trim();
   prod = prod.replace(/[\s<>=~]+[vV]?[\d][\w.\-]*.*$/, "").trim();
-  if (isBrandGuarded(`${name} ${prod}`))
-    return null;
   const kw = new Set(tokens(prod));
   for (const q of text.matchAll(/^\s*(?:fofa|shodan)-query:\s*(.+)$/gm)) {
     for (const m of q[1].matchAll(/(?:body|title|header|http\.html|html)\s*=\s*"([^"]+)"/g)) {

package/intelligence/cve-corpus.json

@@ -1,6 +1,6 @@
 {
  "source": "nuclei-templates http/cves",
- "count": 4092,
+ "count": 4113,
  "cves": [
   {
    "cve": "CVE-2000-0114",
@@ -2477,6 +2477,15 @@
    "cwe": "CWE-287",
    "match": "\\b(?:netsweeper)\\b"
   },
+  {
+   "cve": "CVE-2014-9735",
+   "name": "WordPress RevSlider - Remote Code Execution via File Upload",
+   "product": "WordPress RevSlider",
+   "severity": "high",
+   "epss": "0.75256",
+   "cwe": "CWE-264",
+   "match": "\\b(?:revslider)\\b"
+  },
   {
    "cve": "CVE-2015-0554",
    "name": "ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure",
@@ -5393,6 +5402,15 @@
    "cwe": "CWE-22",
    "match": "\\b(?:filemanager|responsive)\\b"
   },
+  {
+   "cve": "CVE-2018-15745",
+   "name": "Argus Surveillance DVR 4.0.0.0 - Local File Inclusion",
+   "product": "Argus Surveillance DVR",
+   "severity": "high",
+   "epss": "0.97709",
+   "cwe": "CWE-22",
+   "match": "\\b(?:argus|dvr|for|samsung|surveillance|viewer)\\b"
+  },
   {
    "cve": "CVE-2018-15811",
    "name": "DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization",
@@ -8291,6 +8309,15 @@
    "cwe": "CWE-94",
    "match": "\\b(?:thinkphp)\\b"
   },
+  {
+   "cve": "CVE-2019-9194",
+   "name": "elFinder <= 2.1.47 - Command Injection",
+   "product": "elFinder",
+   "severity": "critical",
+   "epss": "0.96633",
+   "cwe": "CWE-78",
+   "match": "\\b(?:elfinder)\\b"
+  },
   {
    "cve": "CVE-2019-9618",
    "name": "WordPress GraceMedia Media Player 1.0 - Local File Inclusion",
@@ -8867,6 +8894,15 @@
    "cwe": "CWE-306",
    "match": "\\b(?:vbulletin)\\b"
   },
+  {
+   "cve": "CVE-2020-12800",
+   "name": "WordPress Contact Form 7 <1.3.3.3 - Remote Code Execution",
+   "product": "WordPress Contact Form",
+   "severity": "critical",
+   "epss": "0.78751",
+   "cwe": "CWE-434",
+   "match": "\\b(?:contact|form)\\b"
+  },
   {
    "cve": "CVE-2020-12832",
    "name": "WordPress Simple File List - Path Traversal",
@@ -10523,6 +10559,15 @@
    "cwe": "CWE-89",
    "match": "\\b(?:bookstore|cse)\\b"
   },
+  {
+   "cve": "CVE-2020-36155",
+   "name": "Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta",
+   "product": "Ultimate Member",
+   "severity": "critical",
+   "epss": "0.08975",
+   "cwe": "CWE-269",
+   "match": "\\b(?:member|plugins|ultimate)\\b"
+  },
   {
    "cve": "CVE-2020-36289",
    "name": "Jira Server and Data Center - Information Disclosure",
@@ -11837,6 +11882,15 @@
    "cwe": "CWE-94",
    "match": "\\b(?:lodash|template)\\b"
   },
+  {
+   "cve": "CVE-2021-23394",
+   "name": "elFinder < 2.1.58 - Remote Code Execution",
+   "product": "elFinder",
+   "severity": "high",
+   "epss": "0.19083",
+   "cwe": "CWE-434",
+   "match": "\\b(?:elfinder)\\b"
+  },
   {
    "cve": "CVE-2021-24139",
    "name": "10Web Photo Gallery < 1.5.55 - SQL Injection",
@@ -12080,6 +12134,15 @@
    "cwe": "CWE-79",
    "match": "\\b(?:contact|form|supsystic)\\b"
   },
+  {
+   "cve": "CVE-2021-24278",
+   "name": "WordPress Contact Form 7 <2.3.4 - Arbitrary Nonce Generation",
+   "product": "WordPress Contact Form",
+   "severity": "high",
+   "epss": "0.07359",
+   "cwe": "CWE-863",
+   "match": "\\b(?:contact|form)\\b"
+  },
   {
    "cve": "CVE-2021-24284",
    "name": "WordPress Kaswara Modern VC Addons <=3.0.1 - Arbitrary File Upload",
@@ -12818,6 +12881,15 @@
    "cwe": "CWE-79",
    "match": "\\b(?:feedwordpress)\\b"
   },
+  {
+   "cve": "CVE-2021-25063",
+   "name": "WordPress Contact Form 7 Skins <=2.5.0 - Cross-Site Scripting",
+   "product": "WordPress Contact Form",
+   "severity": "medium",
+   "epss": "0.02412",
+   "cwe": "CWE-79",
+   "match": "\\b(?:contact|form)\\b"
+  },
   {
    "cve": "CVE-2021-25065",
    "name": "Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting",
@@ -13997,6 +14069,15 @@
    "cwe": "CWE-287",
    "match": "\\b(?:octobercms)\\b"
   },
+  {
+   "cve": "CVE-2021-32682",
+   "name": "elFinder 2.1.58 - Remote Code Execution",
+   "product": "elFinder",
+   "severity": "critical",
+   "epss": "0.69934",
+   "cwe": "CWE-22",
+   "match": "\\b(?:elfinder)\\b"
+  },
   {
    "cve": "CVE-2021-32789",
    "name": "WooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL Injection",
@@ -15491,6 +15572,15 @@
    "cwe": "CWE-200",
    "match": "\\b(?:build|create|gocd|pipeline|pipelines|pre|takeover)\\b"
   },
+  {
+   "cve": "CVE-2021-43421",
+   "name": "Studio-42 elFinder <2.1.60 - Arbitrary File Upload",
+   "product": "Studio-42 elFinder",
+   "severity": "critical",
+   "epss": "0.42781",
+   "cwe": "CWE-434",
+   "match": "\\b(?:elfinder)\\b"
+  },
   {
    "cve": "CVE-2021-43495",
    "name": "AlquistManager Local File Inclusion",
@@ -16229,6 +16319,15 @@
    "cwe": "CWE-79",
    "match": "\\b(?:woocs)\\b"
   },
+  {
+   "cve": "CVE-2022-0250",
+   "name": "Redirection for Contact Form 7 < 2.5.0 - Cross-Site Scripting",
+   "product": "Redirection for Contact Form",
+   "severity": "medium",
+   "epss": "0.01513",
+   "cwe": "CWE-79",
+   "match": "\\b(?:contact|for|form|plugins|redirect|redirection|wpcf7)\\b"
+  },
   {
    "cve": "CVE-2022-0271",
    "name": "LearnPress <4.1.6 - Cross-Site Scripting",
@@ -16463,6 +16562,15 @@
    "cwe": "CWE-863",
    "match": "\\b(?:shareaholic)\\b"
   },
+  {
+   "cve": "CVE-2022-0595",
+   "name": "WordPress Contact Form 7 <1.3.6.3 - Stored Cross-Site Scripting",
+   "product": "WordPress Contact Form",
+   "severity": "medium",
+   "epss": "0.13575",
+   "cwe": "CWE-79",
+   "match": "\\b(?:contact|form)\\b"
+  },
   {
    "cve": "CVE-2022-0597",
    "name": "Microweber < 1.2.11 - Open Redirection",
@@ -17408,6 +17516,15 @@
    "cwe": "CWE-78",
    "match": "\\b(?:gitlab)\\b"
   },
+  {
+   "cve": "CVE-2022-2187",
+   "name": "WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting",
+   "product": "WordPress Contact Form",
+   "severity": "medium",
+   "epss": "0.01428",
+   "cwe": "CWE-79",
+   "match": "\\b(?:contact|form)\\b"
+  },
   {
    "cve": "CVE-2022-2219",
    "name": "Unyson < 2.7.27 - Cross Site Scripting",
@@ -18083,6 +18200,15 @@
    "cwe": "CWE-425",
    "match": "\\b(?:board|job|ninja)\\b"
   },
+  {
+   "cve": "CVE-2022-2546",
+   "name": "WordPress All-in-One WP Migration <=7.62 - Cross-Site Scripting",
+   "product": "WordPress All-in-One WP Migration",
+   "severity": "medium",
+   "epss": "0.01204",
+   "cwe": "CWE-79",
+   "match": "\\b(?:all|migration|one)\\b"
+  },
   {
    "cve": "CVE-2022-25481",
    "name": "ThinkPHP 5.0.24 - Information Disclosure",
@@ -18308,6 +18434,15 @@
    "cwe": "CWE-306",
    "match": "\\b(?:automation|oas)\\b"
   },
+  {
+   "cve": "CVE-2022-26960",
+   "name": "elFinder <=2.1.60 - Local File Inclusion",
+   "product": "elFinder",
+   "severity": "critical",
+   "epss": "0.50993",
+   "cwe": "CWE-22",
+   "match": "\\b(?:elfinder)\\b"
+  },
   {
    "cve": "CVE-2022-27043",
    "name": "Yearning - Directory Traversal",
@@ -23303,6 +23438,15 @@
    "cwe": "CWE-79",
    "match": "\\b(?:gibbon)\\b"
   },
+  {
+   "cve": "CVE-2023-3460",
+   "name": "Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation",
+   "product": "Ultimate Member",
+   "severity": "critical",
+   "epss": "0.72306",
+   "cwe": "CWE-269",
+   "match": "\\b(?:member|ultimate)\\b"
+  },
   {
    "cve": "CVE-2023-34659",
    "name": "JeecgBoot 3.5.0 - SQL Injection",
@@ -24995,6 +25139,15 @@
    "cwe": null,
    "match": "\\b(?:gibbon|lms)\\b"
   },
+  {
+   "cve": "CVE-2023-4596",
+   "name": "WordPress Plugin Forminator 1.24.6 - Arbitrary File Upload",
+   "product": "WordPress Plugin Forminator",
+   "severity": "critical",
+   "epss": "0.12749",
+   "cwe": "CWE-434",
+   "match": "\\b(?:forminator)\\b"
+  },
   {
    "cve": "CVE-2023-4634",
    "name": "Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion",
@@ -26327,6 +26480,15 @@
    "cwe": "CWE-22",
    "match": "\\b(?:plugins|system)\\b"
   },
+  {
+   "cve": "CVE-2024-1071",
+   "name": "WordPress Ultimate Member 2.1.3 - 2.8.2 \u2013 SQL Injection",
+   "product": "WordPress Ultimate Member",
+   "severity": "critical",
+   "epss": "0.89431",
+   "cwe": "CWE-89",
+   "match": "\\b(?:member|plugins|ultimate)\\b"
+  },
   {
    "cve": "CVE-2024-10763",
    "name": "WordPress Campress Theme <= 1.35 - Unauthenticated Local File Inclusion",
@@ -30692,6 +30854,15 @@
    "cwe": "CWE-22",
    "match": "\\b(?:affiliate|grow|plugins|tracker|tradedoubler)\\b"
   },
+  {
+   "cve": "CVE-2024-6517",
+   "name": "Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting",
+   "product": "Contact Form",
+   "severity": "medium",
+   "epss": "0.00665",
+   "cwe": "CWE-79",
+   "match": "\\b(?:contact|form)\\b"
+  },
   {
    "cve": "CVE-2024-6555",
    "name": "WP Popups - Information Disclosure",
@@ -31205,6 +31376,15 @@
    "cwe": null,
    "match": "\\b(?:webiq)\\b"
   },
+  {
+   "cve": "CVE-2024-8852",
+   "name": "All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure",
+   "product": "All-in-One WP Migration",
+   "severity": "medium",
+   "epss": "0.01175",
+   "cwe": "CWE-532",
+   "match": "\\b(?:all|migration|one|plugins)\\b"
+  },
   {
    "cve": "CVE-2024-8856",
    "name": "WP Time Capsule Plugin - Remote Code Execution",
@@ -33158,6 +33338,15 @@
    "cwe": "CWE-94",
    "match": "\\b(?:extra|ocean|oceanwp|woocommerce)\\b"
   },
+  {
+   "cve": "CVE-2025-3515",
+   "name": "Contact Form 7 Drag and Drop Multiple File Upload - Arbitrary File Upload",
+   "product": "Contact Form",
+   "severity": "high",
+   "epss": "0.0509",
+   "cwe": "CWE-434",
+   "match": "\\b(?:contact|form)\\b"
+  },
   {
    "cve": "CVE-2025-3605",
    "name": "WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.114",
+  "version": "2.4.115",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {