Vulnx – bot that detect vulnerabilities in multiple types of CMS | Hacker News Reader

Vulnx – bot that detect vulnerabilities in multiple types of CMS

github.com

65 pointsmodinfo16 comments

Really nice tool. Maybe this will finally change my boss' mind on using WordPress for all the landing pages...

why dont use wordpress? its an easy and powerfull cms. just dont install themes with tons of plugins of 3rd parties that dont care about security and updates.

I personally love to use jekyll its too easy and powerfull.

The fact that you have to even worry about security and updates. A simple landing page could easily be handled as a static site where all these problems go away.

The whole point of WordPress is themes and plugins. If you aren’t going to use them, why even bother for a landing page. Just throw together some static HTML.

Looking into it for my own needs, I find the number of instances where you need something else than plain static HTML far smaller than people would expect.

Well, the other "whole point" of Wordpress is that non-technical people can modify their website without involving a developer.

I wonder how many newbie contractors learn this every year when they set up a static site generator for their first client's brochure website and then realize that static site generators are for developers, not someone who just wants to keep their restaurant menu updated every month.

There is a middleground, with flat file CMS. I setup a Kirby install for a client not used to any sort of online administration and they're doing just fine.

Kirby looks interesting[1], and the $109 flat-fee license shouldn't be too much for most businesses, it is probably more than most individuals would pay to set up their holiday photo blog etc. I wonder if they considered a free-for-noncommercial license? I guess they do let you run it locally to see if it works for you, which is friendly.

1: https://getkirby.com/

While it technically does require a license, they never go after you or restrict what you can do with the software. I think if you email for official help they won't assist without a valid license number. I do think it's bad form that they discontinued the personal/non profit license which was about 30% cheaper.

its the same about saying "linux is worthless because the whole point are apps that you need to install and they may be insecure"...

As the other commenters noted, the point of using it is for the plugins. Unfortunately, the ecosystem is just plain garbage.

Quite recent anecdote: I was making a sales pitch and showed my contact our website. Lo and behold, one of the plugins went rogue and just started loading adware onto the website and forcing popups and page redirects.

The plugin in question? Manages fucking blog posts. On WordPress. A plugin to take the blog posts and index them into a separate page. On a blog engine.

Correct. It is utter garbage.

Looks like someome made a wrapper for joomscan and wpscan...

There's a new one of these every week. How is this one any better/different? Does it perform any better than a simple curl loop looking for the existence of a plugin? Or grep?

vulnx now has an interactive mode to easily interact.

Reply on news.ycombinator.com