github projectdiscovery/nuclei-templates v10.3.7
Nuclei Templates v10.3.7 – Release Notes
on GitHub

10 hours ago

New Templates Added: 102 | CVEs Added: 42 | First-time contributions: 9 | Bounties rewarded: 16

🔥 Release Highlights 🔥

What's Changed

💰 Bounties Rewarded 💰

Bug Fixes

False Negatives

False Positives

  • Reduced false positives in Dell iDRAC detection templates for iDRAC 6, 7, and 8 (Issue #14723, PRs #14739, #14738)

Enhancements

  • None in this release

Templates Added

  • [CVE-2025-69200] phpMyFAQ - Configuration Backup Disclosure (@louay-075) [high] 🔥
  • [CVE-2025-68926] RustFS < 1.0.0-alpha.77 - Hardcoded gRPC Authentication Token (@Chocapikk, @bilisheep) [critical] 🔥
  • [CVE-2025-68645] Zimbra Collaboration - Local File Inclusion (@dhiyaneshdk, @sirifu4k1) [high] 🔥
  • [CVE-2025-62522] Vite - Information Disclosure (@dhiyaneshdk) [medium] 🔥
  • [CVE-2025-60188] Atarim < 4.2.2 - Sensitive Information Exposure (@m4hs_wacker) [high] 🔥
  • [CVE-2025-52691] SmarterMail - Unrestricted File Upload (@dhiyaneshdk, @watchtowr) [critical] 🔥
  • [CVE-2025-34291] Langflow AI <= 1.6.9 - CORS Misconfiguration (@686f6c61) [critical] 🔥
  • [CVE-2025-14847] MongoDB Server - Info Disclosure (MongoBleed) (@pussycat0x, @joe-desimone, @dhiyaneshdk) [high] 🔥 (vKEV)
  • [CVE-2025-8848] LibreChat <= 0.7.9 - HTML Injection via Accept-Language Header (@Kazgangap) [medium] 🔥
  • [CVE-2024-43971] Sunshine Photo Cart <= 3.2.5 - Reflected Cross-Site Scripting (@0xanis) [medium]
  • [CVE-2024-30194] Sunshine Photo Cart <= 3.1.1 - Reflected Cross-Site Scripting (@0xanis) [medium]
  • [CVE-2024-29931] WP Go Maps <= 9.0.29 - Cross-Site Scripting (@Shivam Kamboj) [medium]
  • [CVE-2024-29792] Unlimited Elements for Elementor <= 1.5.93 - Cross Site Scripting (@Shivam Kamboj) [medium]
  • [CVE-2024-29138] WordPress Restrict User Access <= 2.5 - Cross-Site Scripting (@Shivam Kamboj) [medium]
  • [CVE-2024-28986] SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization (@rxerium) [critical] 🔥 (vKEV)
  • [CVE-2024-24882] Masteriyo LMS <= 1.7.2 - Unauthenticated Privilege Escalation (@riteshs4hu) [critical] 🔥 (vKEV)
  • [CVE-2024-6753] Social Auto Poster <= 5.3.14 - Stored Cross-Site Scripting (@Shivam Kamboj) [high]
  • [CVE-2024-5057] WordPress Easy Digital Downloads <= 3.2.12 - SQL Injection (@daffainfo) [critical] 🔥 (vKEV)
  • [CVE-2024-4455] YITH WooCommerce Ajax Search <= 2.4.0 - Cross-Site Scripting (@Shivam Kamboj) [high]
  • [CVE-2024-3469] GP Premium <= 2.4.0 - Cross-Site Scripting (@Shivam Kamboj) [medium]
  • [CVE-2023-33193] Emby Server - Authentication Bypass (@daffainfo) [critical] 🔥 (vKEV)
  • [CVE-2023-27351] PaperCut NG - Authentication Bypass (@daffainfo, @jjcho) [high] 🔥 (vKEV)
  • [CVE-2022-27924] Zimbra Collaboration Suite - Memcached Command Injection (@rxerium) [high] 🔥 (vKEV)
  • [CVE-2022-4940] WCFM Membership <= 2.10.0 - Broken Access Control (@0xanis) [high]
  • [CVE-2021-36754] PowerDNS Authoritative Server - Denial of Service (@daffainfo) [high]
  • [CVE-2021-28799] QNAP HBS 3 - Broken Access Control (@daffainfo) [critical] 🔥 (vKEV)
  • [CVE-2021-24213] GiveWP <= 2.9.7 - Cross-Site Scripting (@Shivam Kamboj) [medium]
  • [CVE-2021-4448] Kaswara Modern VC Addons <= 3.0.1 - Missing Authorization (@daffainfo) [high]
  • [CVE-2020-13125] Ultimate Addons for Elementor <= 1.24.1 - Registration Bypass (@daffainfo) [high]
  • [CVE-2019-15823] WPS Hide Login <= 1.5.2.2 - Login Page Bypass (@pussycat0x) [high]
  • [CVE-2019-11253] Kubernetes API Server - YAML Parsing DoS (Billion Laughs) (@ritikchaddha) [high] 🔥
  • [CVE-2018-10245] AWStats <= 7.5 - Full Path Disclosure (@0x_Akoko) [medium]
  • [CVE-2018-9206] Blueimp jQuery-File-Upload v9.22.0 - Unrestricted File Upload (@thewindghost) [critical] 🔥 (vKEV)
  • [CVE-2018-8011] Apache HTTP Server - NULL Pointer Dereference (@daffainfo) [high]
  • [CVE-2018-6961] VMware NSX SD-WAN Edge - Command Injection (@D3nverNg, @thewindghost) [critical] 🔥 (vKEV)
  • [CVE-2017-20192] Formidable Forms < 2.05.02 - Cross-Site Scripting (@0xanis) [medium]
  • [CVE-2017-11107] phpLDAPadmin <= 1.2.3 - Reflected XSS (@0x_Akoko) [medium]
  • [CVE-2016-15043] WP Mobile Detector <= 3.5 - Unrestricted File Upload (@D3nverNg, @thewindghost) [critical] 🔥 (vKEV)
  • [CVE-2016-15041] MainWP Dashboard <= 3.1.2 - Stored Cross-Site Scripting (@flame) [high]
  • [CVE-2012-10018] WordPress Mapplic <= 6.1 / Mapplic Lite <= 1.0 - Stored XSS via SVG File Upload (@KrE80r) [high]
  • [CVE-2011-3600] Apache OFBiz - XML External Entity Injection (@daffainfo, @pikpikcu) [high]
  • [CVE-2006-3392] Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure (@s4e-io) [medium]
  • [gcloud-service-account-keys-rotation] GCP Service Account Keys - No Rotation Configured (@kelu27) [high]
  • [cloudinary-csp-bypass] Content-Security-Policy Bypass - cloudinary (@pussycat0x) [medium]
  • [bitbucket-panel] Bitbucket Panel - Detect (@Shivam Kamboj) [info]
  • [ekoapi-admin-panel] EkoAPI Admin Panel - Detect (@rxerium) [info]
  • [librechat-login-panel] LibreChat Login Panel - Detection (@Kazgangap) [info]
  • [victoriametrics-panel] VictoriaMetrics Panel - Detect (@Shivam Kamboj) [info]
  • [woodpecker-ci-panel] Woodpecker CI Panel - Detect (@Shivam Kamboj) [info]
  • [xspeeder-login] XSpeeder Login - Detect (@rxerium) [info]
  • [bash-config-exposure] Bash Configuration - Exposure (@theamanrawat) [low]
  • [exposed-gitmodules] .gitmodules File Exposed (@pussycat0x) [high]
  • [flow-config-exposure] Flow Configuration - Exposure (@theamanrawat) [medium]
  • [grafana-metrics-exposure] Grafana Metrics Endpoint - Information Disclosure (@0x_Akoko) [low]
  • [jfrog-artifactory-build-exposure] JFrog Artifactory Build - Exposure (@theamanrawat) [medium]
  • [keycloak-admin-console-config] Keycloak Admin Console Configuration Disclosure (@0x_Akoko) [low]
  • [makefile-exposure] Makefile - Exposure (@0x_Akoko) [low]
  • [mysql-config-exposure] MySQL Conifg - Exposure (@theamanrawat) [high]
  • [prettier-ignore-disclosure] Prettier - Ignore File Disclosure (@ritikchaddha) [info]
  • [smtp-credentials-exposure] SMTP Credentials Exposure - Detection (@pussycat0x) [high]
  • [jolokia-config-exposure] Jolokia Configuration - Exposure (@theamanrawat) [medium]
  • [kcfinder-exposure] KCFinder - Exposure (@theamanrawat) [high]
  • [npmignore-disclosure] NPM .npmignore File Disclosure (@0x_Akoko) [info]
  • [postgres-credentials-exposure] PostgreSQL Credentials - Exposure (@theamanrawat) [high]
  • [python-requirements-disclosure] Python Requirements File Disclosure (@0x_Akoko) [low]
  • [rails-history-exposure] Rails/Ruby Console History - Exposure (@theamanrawat) [medium]
  • [oracle-ebs-sqllog-exposure] Oracle EBS SQL Log - Exposure (@theamanrawat) [medium]
  • [wp-enable-media-replace-log] WordPress Plugin Enable Media Replace - Log File Exposure (@dhiyaneshdk) [medium]
  • [wp-newsletter-log-exposure] WordPress Newsletter - Log File Exposure (@pussycat0x) [medium]
  • [flock-safety-camera-panel] Flock Safety Camera Admin Panel - Detect (@inokii) [info]
  • [aem-jcr-exposure] Adobe AEM JCR Compare Exposure (@pussycat0x) [medium]
  • [bitrix-fpd] Bitrix Path Disclosure (@dhiyaneshdk) [low]
  • [drupal-directory-listing] Drupal Directory Listing (@ritikchaddha) [low]
  • [grafana-unauth-access] Grafana Unauthenticated Access (@ritikchaddha) [high]
  • [icinga-dashboard-exposure] Icinga Exposed Dashboard (@dhiyaneshdk) [medium]
  • [imageresizer-debug-exposure] ImageResizer Debug - Information Exposure (@ritikchaddha) [low]
  • [roundcube-installer-exposure] Roundcube Webmail Installer - Exposure (@theamanrawat) [high]
  • [jboss-jmx-console-unauth] JBoss JMX Console - Unauthenticated Access (@0x_Akoko) [high]
  • [joomla-fpd] Joomla! - Full Path Disclosure (@pussycat0x) [low]
  • [mamp-phpinfo-exposure] MAMP - PHP Info Exposure (@0x_Akoko) [low]
  • [phpmyadmin-fpd] phpMyAdmin Full Path Disclosure (@dhiyaneshdk) [low]
  • [renovate-config-exposure] Renovate Configuration Exposure (@ritikchaddha) [info]
  • [wordfence-config-disclosure] WordPress Wordfence - Configuration File Disclosure (@ritikchaddha) [medium]
  • [wordpress-elementor-fpd] WordPress Elementor Page Builder - Full Path Disclosure (@dhiyaneshdk) [low]
  • [wordpress-menu-image-fpd] WordPress Menu Image - Full Path Disclosure (@dhiyaneshdk) [low]
  • [wordpress-twentynineteen-fpd] WordPress Twenty Nineteen - Full Path Disclosure (@pussycat0x) [low]
  • [wp-better-wp-security-fpd] WordPress Plugin iThemes Security - Full Path Disclosure (@dhiyaneshdk) [low]
  • [wp-custom-post-type-ui-fpd] WordPress Custom Post Type UI - Full Path Disclosure (@0x_Akoko) [low]
  • [wp-elementor-pro-fpd] WordPress Elementor Pro - Full Path Disclosure (@dhiyaneshdk) [low]
  • [wp-members-log-disclosure] WordPress Members Plugin - Debug/Error Log Disclosure (@ritikchaddha) [low]
  • [wp-nextgen-gallery-log] WordPress Gallery Plugin / NextGEN Gallery (nextgen-gallery) Error Log Disclosure (@dhiyaneshdk) [low]
  • [wp-popup-maker-fpd] Popup Maker - Full Path Disclosure (@theamanrawat) [low]
  • [wp-simple-custom-css-fpd] WordPress Simple Custom CSS Plugin - Full Path Disclosure (@0x_Akoko) [low]
  • [wp-user-role-editor-fpd] User Role Editor - Full Path Disclosure (@theamanrawat) [low]
  • [adonisjs-detect] AdonisJS - Detect (@rxerium) [info]
  • [newrelic-rum-detect] New Relic Browser Monitoring (RUM) - Tech Detect (@Shivam Kamboj) [info]
  • [wordpress-passive-detection] WordPress Passive Detection - Plugins & Themes (@princechaddha) [info]
  • [acme-challenge-path-xss] ACME Challenge Path - Reflected Cross-Site Scripting (@pussycat0x) [low]
  • [magento-downloader-fpd] Magento Downloader - Full Path Disclosure (@0x_Akoko) [low]
  • [jetpack-stored-xss] Jetpack < 6.5 - Stored Cross-Site Scripting (@0x_Akoko) [medium]
  • [wp-instagram-feed-xss] Instagram Feed < 1.6 - Cross-Site Scripting (@theamanrawat) [medium]
  • [wp-jetpack-ssrf] Wordpress Jetpack plugin - Server Side Request Forgery (@pussycat0x) [medium]

New Contributors

Full Changelog: v10.3.6...v10.3.7

Check out latest releases or
releases around projectdiscovery/nuclei-templates v10.3.7

Don't miss a new nuclei-templates release

NewReleases is sending notifications on new releases.

Get notifications