Nuclei POC 精选分析 - 2026-04-22

📊 智能筛选概况

• 发现变更: 96 个模板更新
• 精选分析: 30 个高价值 POC
• 智能跳过: 66 个低优先级模板
• 高风险漏洞: 7 个
• 主要类别: CVE漏洞(10), 其他(5), 技术识别(15)

💡 智能筛选说明: 系统自动优先分析 CVE 漏洞、高危漏洞和新增模板，跳过低价值的技术识别类模板，确保高效利用 API 资源。

严重程度分布

• 🔴 严重: 2 个
• 🟠 高危: 5 个
• 🟡 中危: 5 个
• ⚪ 信息: 18 个

🔍 重点漏洞分析

WeGIA <= 3.6.4 - Remote Code Execution

• 漏洞ID: CVE-2026-28409
• CVE: CVE-2026-28409 (2026)
• 严重程度: 🔴 CRITICAL
• 风险等级: 极高风险 (5/5)
• 影响资产: 未知
• 预估影响: 数千个
• EPSS: 0.00258 (percentile 0.49232) @ 2026-04-21

描述: WeGIA <= 3.6.5 contains a remote code execution caused by improper validation of backup file names in the database restoration functionality, letting attackers with administrative access execute arbitrary OS commands

攻击向量: 网络扫描

CVE编号: CVE-2026-28409

参考链接:

• 参考资料
• 参考资料
• 参考资料

WeGIA <= 3.6.4 - Remote Code Execution

• 漏洞ID: CVE-2026-28409
• CVE: CVE-2026-28409 (2026)
• 严重程度: 🔴 CRITICAL
• 风险等级: 极高风险 (5/5)
• 影响资产: 未知
• 预估影响: 数千个
• EPSS: 0.00258 (percentile 0.49232) @ 2026-04-21

描述: WeGIA <= 3.6.5 contains a remote code execution caused by improper validation of backup file names in the database restoration functionality, letting attackers with administrative access execute arbitrary OS commands

攻击向量: 网络扫描

CVE编号: CVE-2026-28409

参考链接:

• 参考资料
• 参考资料
• 参考资料

RabbitMQ AMQP - Default Login

• 漏洞ID: rabbitmq-amqp-default-login
• CVE: -
• 严重程度: 🟠 HIGH
• 风险等级: 极高风险 (5/5)
• 影响资产: 未知
• 预估影响: 数千个

描述: RabbitMQ server accepts connections with weak or default credentials over the AMQP 0-9-1 protocol (port 5672).Default credentials (guest/guest) or commonly used weak passwords were found, allowing unauthorized access to the message broker, its queues, exchanges, and all data flowing through them.

攻击向量: 网络扫描

参考链接:

• 参考资料
• 参考资料
• 参考资料

RabbitMQ AMQP - Default Login

• 漏洞ID: rabbitmq-amqp-default-login
• CVE: -
• 严重程度: 🟠 HIGH
• 风险等级: 极高风险 (5/5)
• 影响资产: 未知
• 预估影响: 数千个

描述: RabbitMQ server accepts connections with weak or default credentials over the AMQP 0-9-1 protocol (port 5672).Default credentials (guest/guest) or commonly used weak passwords were found, allowing unauthorized access to the message broker, its queues, exchanges, and all data flowing through them.

攻击向量: 网络扫描

参考链接:

• 参考资料
• 参考资料
• 参考资料

esm.sh <= v136 - Local File Inclusion

• 漏洞ID: CVE-2025-59341
• CVE: CVE-2025-59341 (2025)
• 严重程度: 🟠 HIGH
• 风险等级: 极高风险 (4.5/5)
• 影响资产: 未知
• 预估影响: 数千个
• EPSS: 0.00122 (percentile 0.31273) @ 2026-04-21

描述: esm.sh <= 136 contains a local file inclusion caused by improper URL handling, letting attackers read arbitrary files from the host filesystem remotely, exploit requires crafted request.

攻击向量: 网络扫描

CVE编号: CVE-2025-59341

参考链接:

• 参考资料
• 参考资料
• 参考资料

esm.sh <= v136 - Local File Inclusion

• 漏洞ID: CVE-2025-59341
• CVE: CVE-2025-59341 (2025)
• 严重程度: 🟠 HIGH
• 风险等级: 极高风险 (4.5/5)
• 影响资产: 未知
• 预估影响: 数千个
• EPSS: 0.00122 (percentile 0.31273) @ 2026-04-21

描述: esm.sh <= 136 contains a local file inclusion caused by improper URL handling, letting attackers read arbitrary files from the host filesystem remotely, exploit requires crafted request.

攻击向量: 网络扫描

CVE编号: CVE-2025-59341

参考链接:

• 参考资料
• 参考资料
• 参考资料

esm.sh <= v136 - Local File Inclusion

• 漏洞ID: CVE-2025-59341
• CVE: CVE-2025-59341 (2025)
• 严重程度: 🟠 HIGH
• 风险等级: 极高风险 (4.5/5)
• 影响资产: 未知
• 预估影响: 数千个
• EPSS: 0.00122 (percentile 0.31273) @ 2026-04-21

描述: esm.sh <= 136 contains a local file inclusion caused by improper URL handling, letting attackers read arbitrary files from the host filesystem remotely, exploit requires crafted request.

攻击向量: 网络扫描

CVE编号: CVE-2025-59341

参考链接:

• 参考资料
• 参考资料
• 参考资料

📋 完整模板列表

🛡️ 安全建议

🚨 发现高风险漏洞，建议立即扫描相关资产 🔍 关注新发布的 CVE 漏洞，及时更新补丁 ⚡ 检测到远程代码执行漏洞，优先处理

🔧 扫描建议

建议使用以下 Nuclei 命令进行扫描：

# 扫描高危漏洞
nuclei -t http/cves/2026/CVE-2026-28409.yaml -t http/cves/2026/CVE-2026-28409.yaml -t javascript/default-logins/rabbitmq-amqp-default-login.yaml -t javascript/default-logins/rabbitmq-amqp-default-login.yaml -t http/cves/2025/CVE-2025-59341.yaml -t http/cves/2025/CVE-2025-59341.yaml -t http/cves/2025/CVE-2025-59341.yaml -u target-url

# 扫描所有今日新增模板  
nuclei -t http/cves/2026/CVE-2026-28409.yaml -t http/cves/2026/CVE-2026-28409.yaml -t javascript/default-logins/rabbitmq-amqp-default-login.yaml -t javascript/default-logins/rabbitmq-amqp-default-login.yaml -t http/cves/2025/CVE-2025-59341.yaml -t http/cves/2025/CVE-2025-59341.yaml -t http/cves/2025/CVE-2025-59341.yaml -t http/cves/2026/CVE-2026-1314.yaml -t http/cves/2026/CVE-2026-1314.yaml -t http/cves/2026/CVE-2026-1314.yaml -t http/cves/2026/CVE-2026-1314.yaml -t http/cves/2026/CVE-2026-1314.yaml -t http/http/miscellaneous/contrastapi-domain-recon.yaml -t http/technologies/Wix-detect.yaml -t http/technologies/bigcommerce-detect.yaml -t http/technologies/bitrix-detect.yaml -t http/technologies/blogger-detect.yaml -t http/technologies/concrete5-detect.yaml -t http/technologies/django-detect.yaml -t http/technologies/expressionengine-detect.yaml -t http/technologies/flask-detect.yaml -t http/technologies/mezzanine-cms-detect.yaml -t http/technologies/opencart-detect.yaml -t http/technologies/oscommerce-detect.yaml -t http/technologies/shopify-detect.yaml -t http/technologies/silverstripe-detect.yaml -t http/technologies/squarespace-detect.yaml -t http/technologies/weebly-detect.yaml -t file/logs/aspnet-framework-exceptions.yaml -t file/logs/nodejs-framework-exceptions.yaml -u target-url

本报告基于 Nuclei 模板库自动生成，数据来源：ProjectDiscovery/nuclei-templates

扫描建议仅供参考，请在授权环境下进行安全测试