Nuclei POC 精选分析 - 2025-11-25
📊 智能筛选概况
- 发现变更: 50 个模板更新
- 精选分析: 30 个高价值 POC
- 智能跳过: 20 个低优先级模板
- 高风险漏洞: 14 个
- 主要类别: CVE漏洞(9), 其他(18), 配置错误(3)
💡 智能筛选说明: 系统自动优先分析 CVE 漏洞、高危漏洞和新增模板，跳过低价值的技术识别类模板，确保高效利用 API 资源。
严重程度分布
- 🔴 严重: 8 个
- 🟠 高危: 6 个
- 🟡 中危: 3 个
- 🔵 低危: 8 个
- ⚪ 信息: 5 个
🔍 重点漏洞分析
Post SMTP <= 3.6.0 - Email Log Disclosure
- 漏洞ID:
CVE-2025-11833 - 严重程度: 🔴 CRITICAL
- 风险等级: 极高风险 (5/5)
- 影响资产: WordPress 站点
- 预估影响: 数千万个
描述: Post SMTP WordPress plugin <= 3.6.0 contains an unauthorized data access vulnerability caused by missing capability check in __construct function, letting unauthenticated attackers read arbitrary logged emails, exploit requires no authentication.
攻击向量: 网络扫描
CVE编号: CVE-2025-11833
参考链接:
Post SMTP <= 3.6.0 - Email Log Disclosure
- 漏洞ID:
CVE-2025-11833 - 严重程度: 🔴 CRITICAL
- 风险等级: 极高风险 (5/5)
- 影响资产: WordPress 站点
- 预估影响: 数千万个
描述: Post SMTP WordPress plugin <= 3.6.0 contains an unauthorized data access vulnerability caused by missing capability check in __construct function, letting unauthenticated attackers read arbitrary logged emails, exploit requires no authentication.
攻击向量: 网络扫描
CVE编号: CVE-2025-11833
参考链接:
Post SMTP <= 3.6.0 - Email Log Disclosure
- 漏洞ID:
CVE-2025-11833 - 严重程度: 🔴 CRITICAL
- 风险等级: 极高风险 (5/5)
- 影响资产: WordPress 站点
- 预估影响: 数千万个
描述: Post SMTP WordPress plugin <= 3.6.0 contains an unauthorized data access vulnerability caused by missing capability check in __construct function, letting unauthenticated attackers read arbitrary logged emails, exploit requires no authentication.
攻击向量: 网络扫描
CVE编号: CVE-2025-11833
参考链接:
Post SMTP <= 3.6.0 - Email Log Disclosure
- 漏洞ID:
CVE-2025-11833 - 严重程度: 🔴 CRITICAL
- 风险等级: 极高风险 (5/5)
- 影响资产: WordPress 站点
- 预估影响: 数千万个
描述: Post SMTP WordPress plugin <= 3.6.0 contains an unauthorized data access vulnerability caused by missing capability check in __construct function, letting unauthenticated attackers read arbitrary logged emails, exploit requires no authentication.
攻击向量: 网络扫描
CVE编号: CVE-2025-11833
参考链接:
WordPress File Upload <= 4.24.11 - Arbitrary File Read
- 漏洞ID:
CVE-2024-9047 - 严重程度: 🔴 CRITICAL
- 风险等级: 极高风险 (5/5)
- 影响资产: WordPress 站点
- 预估影响: 数千万个
描述: The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.
攻击向量: 网络扫描
CVE编号: CVE-2024-9047
参考链接:
WordPress File Upload <= 4.24.11 - Arbitrary File Read
- 漏洞ID:
CVE-2024-9047 - 严重程度: 🔴 CRITICAL
- 风险等级: 极高风险 (5/5)
- 影响资产: WordPress 站点
- 预估影响: 数千万个
描述: The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.
攻击向量: 网络扫描
CVE编号: CVE-2024-9047
参考链接:
Shai Hulud 2.0 - Supply Chain Malware Detection
- 漏洞ID:
shai-hulud-supply-chain - 严重程度: 🔴 CRITICAL
- 风险等级: 极高风险 (5/5)
- 影响资产: 未知
- 预估影响: 数千个
描述: Detects compromised npm packages from the Shai Hulud 2.0 supply chain attack discovered in November 2025. The attack affected over 25,000 malicious repositories across approximately 350 GitHub users, targeting major organizations including Zapier, ENS Domains, PostHog, Postman, AsyncAPI, Voiceflow, and BrowserBase. The malware executes during the preinstall phase and performs credential theft, cloud resource access (AWS, Azure, GCP), and GitHub persistence through self-hosted runners named 'SHA1HULUD'. Malicious versions were published between November 21-23, 2025.
攻击向量: 网络扫描
参考链接:
Shai Hulud 2.0 - Supply Chain Malware Detection
- 漏洞ID:
shai-hulud-supply-chain - 严重程度: 🔴 CRITICAL
- 风险等级: 极高风险 (5/5)
- 影响资产: 未知
- 预估影响: 数千个
描述: Detects compromised npm packages from the Shai Hulud 2.0 supply chain attack discovered in November 2025. The attack affected over 25,000 malicious repositories across approximately 350 GitHub users, targeting major organizations including Zapier, ENS Domains, PostHog, Postman, AsyncAPI, Voiceflow, and BrowserBase. The malware executes during the preinstall phase and performs credential theft, cloud resource access (AWS, Azure, GCP), and GitHub persistence through self-hosted runners named 'SHA1HULUD'. Malicious versions were published between November 21-23, 2025.
攻击向量: 网络扫描
参考链接:
UFIDA NC - Arbitrary File Read
- 漏洞ID:
yonyou-nc-lfi - 严重程度: 🟠 HIGH
- 风险等级: 高风险 (4/5)
- 影响资产: 未知
- 预估影响: 数千个
描述: UFIDA NC is vulnerable to an arbitrary file read vulnerability in the nc.uap.lfw.file.action.DocServlet component. An unauthenticated remote attacker can exploit this flaw to read sensitive files on the server by sending crafted requests.
攻击向量: 网络扫描
参考链接:
UFIDA NC - Arbitrary File Read
- 漏洞ID:
yonyou-nc-lfi - 严重程度: 🟠 HIGH
- 风险等级: 高风险 (4/5)
- 影响资产: 未知
- 预估影响: 数千个
描述: UFIDA NC is vulnerable to an arbitrary file read vulnerability in the nc.uap.lfw.file.action.DocServlet component. An unauthenticated remote attacker can exploit this flaw to read sensitive files on the server by sending crafted requests.
攻击向量: 网络扫描
参考链接:
UFIDA NC - Arbitrary File Read
- 漏洞ID:
yonyou-nc-lfi - 严重程度: 🟠 HIGH
- 风险等级: 高风险 (4/5)
- 影响资产: 未知
- 预估影响: 数千个
描述: UFIDA NC is vulnerable to an arbitrary file read vulnerability in the nc.uap.lfw.file.action.DocServlet component. An unauthenticated remote attacker can exploit this flaw to read sensitive files on the server by sending crafted requests.
攻击向量: 网络扫描
参考链接:
UFIDA NC - Arbitrary File Read
- 漏洞ID:
yonyou-nc-lfi - 严重程度: 🟠 HIGH
- 风险等级: 高风险 (4/5)
- 影响资产: 未知
- 预估影响: 数千个
描述: UFIDA NC is vulnerable to an arbitrary file read vulnerability in the nc.uap.lfw.file.action.DocServlet component. An unauthenticated remote attacker can exploit this flaw to read sensitive files on the server by sending crafted requests.
攻击向量: 网络扫描
参考链接:
UFIDA NC - Arbitrary File Read
- 漏洞ID:
yonyou-nc-lfi - 严重程度: 🟠 HIGH
- 风险等级: 高风险 (4/5)
- 影响资产: 未知
- 预估影响: 数千个
描述: UFIDA NC is vulnerable to an arbitrary file read vulnerability in the nc.uap.lfw.file.action.DocServlet component. An unauthenticated remote attacker can exploit this flaw to read sensitive files on the server by sending crafted requests.
攻击向量: 网络扫描
参考链接:
UFIDA NC - Arbitrary File Read
- 漏洞ID:
yonyou-nc-lfi - 严重程度: 🟠 HIGH
- 风险等级: 高风险 (4/5)
- 影响资产: 未知
- 预估影响: 数千个
描述: UFIDA NC is vulnerable to an arbitrary file read vulnerability in the nc.uap.lfw.file.action.DocServlet component. An unauthenticated remote attacker can exploit this flaw to read sensitive files on the server by sending crafted requests.
攻击向量: 网络扫描
参考链接:
📋 完整模板列表
| 模板名称 | 严重程度 | 类别 | 影响资产 | 风险评分 |
|---|---|---|---|---|
| Post SMTP <= 3.6.0 - Email Log Disclosure | 🔴 critical | CVE漏洞 | WordPress 站点 | 5/5 |
| Post SMTP <= 3.6.0 - Email Log Disclosure | 🔴 critical | CVE漏洞 | WordPress 站点 | 5/5 |
| Post SMTP <= 3.6.0 - Email Log Disclosure | 🔴 critical | CVE漏洞 | WordPress 站点 | 5/5 |
| Post SMTP <= 3.6.0 - Email Log Disclosure | 🔴 critical | CVE漏洞 | WordPress 站点 | 5/5 |
| WordPress File Upload <= 4.24.11 - Arbitra | 🔴 critical | CVE漏洞 | WordPress 站点 | 5/5 |
| WordPress File Upload <= 4.24.11 - Arbitra | 🔴 critical | CVE漏洞 | WordPress 站点 | 5/5 |
| Shai Hulud 2.0 - Supply Chain Malware Detection | 🔴 critical | 其他 | 通用 | 5/5 |
| Shai Hulud 2.0 - Supply Chain Malware Detection | 🔴 critical | 其他 | 通用 | 5/5 |
| UFIDA NC - Arbitrary File Read | 🟠 high | 其他 | 通用 | 4/5 |
| UFIDA NC - Arbitrary File Read | 🟠 high | 其他 | 通用 | 4/5 |
| UFIDA NC - Arbitrary File Read | 🟠 high | 其他 | 通用 | 4/5 |
| UFIDA NC - Arbitrary File Read | 🟠 high | 其他 | 通用 | 4/5 |
| UFIDA NC - Arbitrary File Read | 🟠 high | 其他 | 通用 | 4/5 |
| UFIDA NC - Arbitrary File Read | 🟠 high | 其他 | 通用 | 4/5 |
| Cisco Finesse - Server-Side Request Forgery (SSRF) | 🟡 medium | CVE漏洞 | 通用 | 3.5/5 |
| Astro - Broken Access Control | 🟡 medium | CVE漏洞 | 通用 | 3/5 |
| Astro - Broken Access Control | 🟡 medium | CVE漏洞 | 通用 | 3/5 |
| WordPress Twenty Seventeen - Full Path Disclosure | 🔵 low | 其他 | WordPress 站点 | 2/5 |
| WordPress Twenty Seventeen - Full Path Disclosure | 🔵 low | 其他 | WordPress 站点 | 2/5 |
| WordPress Twenty Seventeen - Full Path Disclosure | 🔵 low | 其他 | WordPress 站点 | 2/5 |
| WordPress Twenty Seventeen - Full Path Disclosure | 🔵 low | 其他 | WordPress 站点 | 2/5 |
| Microsoft SharePoint - Layouts Disclosure | 🔵 low | 配置错误 | 通用 | 2/5 |
| Microsoft SharePoint - Layouts Disclosure | 🔵 low | 配置错误 | 通用 | 2/5 |
| Microsoft SharePoint - Layouts Disclosure | 🔵 low | 配置错误 | 通用 | 2/5 |
| Unauthenticated Java Message Broker - Detect | 🔵 low | 其他 | 通用 | 2/5 |
| ASP.NET Framework Exceptions | ⚪ info | 其他 | 通用 | 1/5 |
| Node.js Framework Exceptions | ⚪ info | 其他 | 通用 | 1/5 |
| Exposed Cryptocurrency Wallet Address | ⚪ info | 其他 | 通用 | 1/5 |
| ASP.NET Framework Exceptions | ⚪ info | 其他 | 通用 | 1/5 |
| Node.js Framework Exceptions | ⚪ info | 其他 | 通用 | 1/5 |
🛡️ 安全建议
🚨 发现高风险漏洞，建议立即扫描相关资产 🔍 关注新发布的 CVE 漏洞，及时更新补丁
🔧 扫描建议
建议使用以下 Nuclei 命令进行扫描：
# 扫描高危漏洞
nuclei -t http/cves/2025/CVE-2025-11833.yaml -t http/cves/2025/CVE-2025-11833.yaml -t http/cves/2025/CVE-2025-11833.yaml -t http/cves/2025/CVE-2025-11833.yaml -t http/cves/2024/CVE-2024-9047.yaml -t http/cves/2024/CVE-2024-9047.yaml -t file/malware/shai-hulud-supply-chain.yaml -t file/malware/shai-hulud-supply-chain.yaml -t http/vulnerabilities/yonyou/yonyou-nc-lfi.yaml -t http/vulnerabilities/yonyou/yonyou-nc-lfi.yaml -t http/vulnerabilities/yonyou/yonyou-nc-lfi.yaml -t http/vulnerabilities/yonyou/yonyou-nc-lfi.yaml -t http/vulnerabilities/yonyou/yonyou-nc-lfi.yaml -t http/vulnerabilities/yonyou/yonyou-nc-lfi.yaml -u target-url
# 扫描所有今日新增模板
nuclei -t http/cves/2025/CVE-2025-11833.yaml -t http/cves/2025/CVE-2025-11833.yaml -t http/cves/2025/CVE-2025-11833.yaml -t http/cves/2025/CVE-2025-11833.yaml -t http/cves/2024/CVE-2024-9047.yaml -t http/cves/2024/CVE-2024-9047.yaml -t file/malware/shai-hulud-supply-chain.yaml -t file/malware/shai-hulud-supply-chain.yaml -t http/vulnerabilities/yonyou/yonyou-nc-lfi.yaml -t http/vulnerabilities/yonyou/yonyou-nc-lfi.yaml -t http/vulnerabilities/yonyou/yonyou-nc-lfi.yaml -t http/vulnerabilities/yonyou/yonyou-nc-lfi.yaml -t http/vulnerabilities/yonyou/yonyou-nc-lfi.yaml -t http/vulnerabilities/yonyou/yonyou-nc-lfi.yaml -t http/cves/2024/CVE-2024-20404.yaml -t http/cves/2025/CVE-2025-64525.yaml -t http/cves/2025/CVE-2025-64525.yaml -t http/vulnerabilities/wordpress/wp-twenty-theme-fpd.yaml -t http/vulnerabilities/wordpress/wp-twenty-theme-fpd.yaml -t http/vulnerabilities/wordpress/wp-twenty-theme-fpd.yaml -t http/vulnerabilities/wordpress/wp-twenty-theme-fpd.yaml -t http/misconfiguration/microsoft/sharepoint-layouts-disclosure.yaml -t http/misconfiguration/microsoft/sharepoint-layouts-disclosure.yaml -t http/misconfiguration/microsoft/sharepoint-layouts-disclosure.yaml -t network/detection/unauth-java-message-broker-detect.yaml -t file/logs/aspnet-framework-exceptions.yaml -t file/logs/nodejs-framework-exceptions.yaml -t http/miscellaneous/crypto-address-detect.yaml -t file/logs/aspnet-framework-exceptions.yaml -t file/logs/nodejs-framework-exceptions.yaml -u target-url
本报告基于 Nuclei 模板库自动生成，数据来源：ProjectDiscovery/nuclei-templates
扫描建议仅供参考，请在授权环境下进行安全测试