github projectdiscovery/nuclei-templates v10.5.0
Nuclei Templates v10.5.0 - Release Notes
on GitHub

3 hours ago

New Templates Added: 295 | CVEs Added: 36 | First-time contributions: 11

🔥 Release Highlights 🔥

  • [CVE-2026-87902] WordPress Core - PHP Template Path Traversal (@Hadrian,FLX) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-86218] N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-84434] WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload (@dhiyaneshdk) [critical] (vKEV) 🔥
  • [CVE-2026-49468] LiteLLM Proxy < 1.84.0 - Host Header Authentication Bypass (@str4k3r) [critical] 🔥
  • [CVE-2026-42018] JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass (@theamanrawat) [high] (kev) (vKEV) 🔥
  • [CVE-2026-18072] Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass (@str4k3r) [critical] 🔥
  • [CVE-2026-9103] Langflow OSS - Superuser Token Issuance (@str4k3r) [critical] 🔥
  • [CVE-2026-1340] Ivanti EPMM < 12.8.0.0 - Remote Code Execution (@0x_Akoko) [critical] (kev) (vKEV) 🔥
  • [CVE-2025-62593] Ray < 2.52.0 - Remote Code Execution (@Veraptos VaaS Alpha) [critical] (kev) (vKEV) 🔥
  • [CVE-2025-14847] MongoDB Server - Information Disclosure (MongoBleed) (@pussycat0x,joe-desimone,DhiyaneshDK,Wiz Research,diedromeo) [high] (kev) (vKEV) 🔥
  • [CVE-2024-57728] SimpleHelp <= 5.5.7 - Arbitrary File Upload (@Popy21) [high] (kev) (vKEV) 🔥

What's Changed

Bug Fixes

  • Fixed the cve-id classification field in CVE-2025-12536 where it was copy-pasted from another template (PR #17355).
  • Corrected the expression spacing in the X-T0KEN-INF0 header for the Yonyou NC MessageServlet RCE template, which broke the payload (PR #17353).
  • Fixed the info block in elfinder-version.yaml that was copy-pasted from the 2.1.58 RCE template, making every version-only detection report a critical RCE (PR #17358, Issue #17349).
  • Corrected the DSL matcher in CVE-2024-42640 that referenced out-of-scope body_3/body_4 variables that do not exist in a two-request block (PR #17191).
  • Fixed the endpoint path and XML declaration in CVE-2020-11991 (Apache Cocoon) so the template actually reaches the vulnerable XSLT endpoint (PR #17173).
  • Encoded payload-bearing # as %23 in query-string injections for CVE-2020-22208 and CVE-2023-30258, which were silently dropping the fragment (PR #16587).
  • Re-signed four code/ and javascript/ templates that carried a contributor's signing key instead of the ProjectDiscovery key (PR #17260).

False Negatives

  • CVE-2021-37598 — rewrote the WP Cerber access-control bypass template to fix a matcher inversion that turned true positives into false negatives on CDN-fronted sites (PR #17362, Issue #17023).
  • unauth-munin — fixed a tolower(body) DSL matcher that could never match because of the casing logic (PR #17357).
  • CVE-2022-0482 — the Easy!Appointments SSRF template matched on unavailables, a key from the wrong endpoint; switched to unavailability_events from the actual ajax_get_calendar_events response (PR #17241).
  • CVE-2025-29927 — added the missing matchers-condition: and to the Next.js middleware bypass request, which was evaluating matchers with OR logic and never matching when both conditions were needed (PR #17034).
  • CVE-2026-63077 — retargeted the TeamCity XStream deserialization template from the legacy /app/agents/ endpoint to /app/agents/v1 with the documented XML gadget, since the old probe never fires on affected builds (PR #17045).
  • CVE-2021-34429 — replaced unsafe: true with disable-path-automerge to stop Jetty WEB-INF disclosure detection from duplicating the request path, producing zero detections on vulnerable instances (PR #17298).
  • CVE-2025-14847 — moved the MongoDB MongoBleed template from javascript/ to network/ and switched the TCP matcher from a truncated maxBsonObjectSize field to version-only detection, since the original field sat beyond the 2048-byte read-size window (PR #17168).
  • caldera-c2 — added detection for Caldera 5.x Magma UI, since the existing template only matched the 4.x <title>Login | CALDERA</title> title (PR #17161).

False Positives

  • CVE-2018-7600 — rewrote the Drupalgeddon RCE template for non-destructive, false-positive-proof detection (PR #17167).
  • CVE-2024-45440 — stopped matching on patched Drupal 10.x versions (PR #17272).
  • CVE-2024-33832 — added the missing matchers-condition: and to the OneNav SSRF template, which was matching on status 200 alone (PR #17293).
  • CVE-2026-31807 — added matchers-condition: and to the XSS detection request, which was matching on supporting indicators alone (PR #17240).
  • sap-readconfigfile-disclosure — restored matchers-condition: and in request 2 (PR #17294).
  • gude-default-login — verified that credentials are actually required before reporting default creds (PR #17263).
  • outback-power-detect — required OutBack-specific markers so the template stops matching on Cisco Meraki local status pages (PR #17351).
  • adcs-certificate — required a link to a certificate file rather than matching any 200 response with .cer/.crt somewhere in the body (PR #17319, Issue #17314).
  • CVE-2021-44528 — added ruby-specific header checks to stop matching on non-Ruby backends (PR #17259).

Enhancements

  • Enhanced CVE-2025-55184 with updated classification, max-request limit, and refined matchers (PR #17345).
  • Added the user:user factory credential pair and version extraction to the GUDE Expert Net Control default-login template (PR #17194).
  • Extended niagara-fox-info-enum to detect FoxS (Fox over TLS) on port 4911, since stations that disable plaintext Fox were invisible to the existing template (PR #17311).
  • Updated matchers in CVE-2026-47717 (PR #17296).

Templates Added

  • [CVE-2026-89063] Bookly <=28.1 - IDOR Unauthenticated Sensitive Data Access (@0x_Akoko) [high]
  • [CVE-2026-89013] Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter (@dhiyaneshdk) [high] (vKEV)
  • [CVE-2026-87902] WordPress Core - PHP Template Path Traversal (@Hadrian,FLX) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-86218] N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-85688] TEN Framework - Arbitrary File Read & Write (@Aryu-RU,geo-chen) [critical]
  • [CVE-2026-84434] WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload (@dhiyaneshdk) [critical] (vKEV) 🔥
  • [CVE-2026-82456] argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access (@kh1166) [critical]
  • [CVE-2026-80099] Newfold WordPress Plugins - Unauthenticated Admin Bypass via Empty HMAC Secret (@ritikchaddha) [high] (vKEV)
  • [CVE-2026-69085] SiYuan <=3.7.2 - SQL Injection (@str4k3r) [critical]
  • [CVE-2026-61560] GitLab MCP Server < 2.1.27 - Unauthenticated SSE Transport Access (@ashish-cybersec) [critical]
  • [CVE-2026-58467] Cockpit CMS <= 2.14.0 - Path Traversal / Local File Inclusion (@abdullah Shahid (comradezephyr)) [high]
  • [CVE-2026-56681] 9router <=0.5.4 - Authentication Bypass (@0x_Akoko) [high]
  • [CVE-2026-55552] Yamcs <=5.11.12 - Arbitrary File Read (@Aryu-RU,AbdrrahimDahmani) [high]
  • [CVE-2026-55549] Yamcs <=5.8.6 - Cross-Site Scripting (@str4k3r) [medium]
  • [CVE-2026-49468] LiteLLM Proxy < 1.84.0 - Host Header Authentication Bypass (@str4k3r) [critical] 🔥
  • [CVE-2026-49060] Hippoo Mobile App for WooCommerce - Broken Access Control (@theamanrawat) [critical] (vKEV)
  • [CVE-2026-42018] JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass (@theamanrawat) [high] (kev) (vKEV) 🔥
  • [CVE-2026-40281] Gotenberg <= 8.30.1 - Remote Code Execution (@Aryu-RU) [critical]
  • [CVE-2026-29058] WWBN AVideo Encoder < 7.0 - Unauthenticated OS Command Injection (@ashish-cybersec) [critical]
  • [CVE-2026-27886] Strapi <=5.36.x - Admin Credential Enumeration (@zeroc00I) [critical]
  • [CVE-2026-26216] Crawl4AI < 0.8.0 - Unauthenticated Remote Code Execution via Hooks Parameter (@dishantmodi) [critical]
  • [CVE-2026-25703] NeuVector - Information Disclosure (@str4k3r) [high]
  • [CVE-2026-18072] Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass (@str4k3r) [critical] 🔥
  • [CVE-2026-13153] Essential Blocks < 6.4.0 - Information Disclosure (@str4k3r) [medium]
  • [CVE-2026-12227] Visual Composer <= 45.16.0 - Unauthenticated LFI (@0x_Akoko) [critical]
  • [CVE-2026-9103] Langflow OSS - Superuser Token Issuance (@str4k3r) [critical] 🔥
  • [CVE-2026-6639] AI Copilot Content Generator <=1.4.6 - Unauthenticated Task Data Exposure (@str4k3r) [high]
  • [CVE-2026-1340] Ivanti EPMM < 12.8.0.0 - Remote Code Execution (@0x_Akoko) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-0692] BlueSnap Payment Gateway for WooCommerce <=3.4.0 - IPN Authorization Bypass (@str4k3r) [high]
  • [CVE-2025-68273] Signal K Server <= 2.18.0 - Information Disclosure (@ChrisJr404) [medium]
  • [CVE-2025-62593] Ray < 2.52.0 - Remote Code Execution (@Veraptos VaaS Alpha) [critical] (kev) (vKEV) 🔥
  • [CVE-2025-34033] Blue Angel Software Suite (5V Technologies) - OS Command Injection (@princechaddha,ritikchaddha) [high] (vKEV)
  • [CVE-2025-14847] MongoDB Server - Information Disclosure (MongoBleed) (@pussycat0x,joe-desimone,DhiyaneshDK,Wiz Research,diedromeo) [high] (kev) (vKEV) 🔥
  • [CVE-2025-11452] Asgaros Forum < 3.2.0 - SQL Injection (@Pauullamm) [high]
  • [CVE-2024-57728] SimpleHelp <= 5.5.7 - Arbitrary File Upload (@Popy21) [high] (kev) (vKEV) 🔥
  • [CVE-2021-42392] H2 Database Console - JNDI Injection RCE (@i-am-paradox) [critical]
  • [3dprinteros-client-detect] 3DPrinterOS Client - Detect (@rxerium) [info]
  • [adempiere-detect] ADempiere - Detect (@rxerium) [info]
  • [admidio-detect] Admidio - Detect (@rxerium) [info]
  • [affine-detect] AFFiNE - Detect (@rxerium) [info]
  • [agenta-detect] Agenta - Detect (@rxerium) [info]
  • [akkoma-detect] Akkoma - Detect (@rxerium) [info]
  • [ant-media-server-detect] Ant Media Server - Detect (@rxerium) [info]
  • [appflowy-cloud-detect] AppFlowy Cloud - Detect (@rxerium) [info]
  • [apprise-api-detect] Apprise API - Detect (@rxerium) [info]
  • [aptabase-detect] Aptabase - Detect (@rxerium) [info]
  • [archivesspace-detect] ArchivesSpace - Detect (@rxerium) [info]
  • [autobrr-detect] autobrr - Detect (@rxerium) [info]
  • [azuracast-detect] AzuraCast - Detect (@rxerium) [info]
  • [backstage-detect] Backstage - Detect (@rxerium) [info]
  • [bagisto-detect] Bagisto - Detect (@rxerium) [info]
  • [bahmni-detect] Bahmni - Detect (@rxerium) [info]
  • [bareos-webui-detect] Bareos WebUI - Detect (@rxerium) [info]
  • [bludit-detect] Bludit - Detect (@rxerium) [info]
  • [broadleaf-commerce-detect] Broadleaf Commerce - Detect (@rxerium) [info]
  • [bunkerweb-detect] BunkerWeb - Detect (@rxerium) [info]
  • [cabot-detect] Cabot - Detect (@rxerium) [info]
  • [cal-com-detect] Cal.com - Detect (@rxerium) [info]
  • [calaos-webapp-detect] Calaos Web App - Detect (@rxerium) [info]
  • [castopod-detect] Castopod - Detect (@rxerium) [info]
  • [chartbrew-detect] Chartbrew - Detect (@rxerium) [info]
  • [chibisafe-detect] Chibisafe - Detect (@rxerium) [info]
  • [cinny-detect] Cinny - Detect (@rxerium) [info]
  • [ckan-detect] CKAN - Detect (@rxerium) [info]
  • [cloudbeaver-detect] CloudBeaver Community - Detect (@rxerium) [info]
  • [cloudreve-detect] Cloudreve - Detect (@rxerium) [info]
  • [cloudron-detect] Cloudron - Detect (@rxerium) [info]
  • [coder-detect] Coder - Detect (@rxerium) [info]
  • [coroot-detect] Coroot - Detect (@rxerium) [info]
  • [countly-detect] Countly - Detect (@rxerium) [info]
  • [cpanel-login-detect] cPanel Login Panel - Detect (@johnk3r) [info]
  • [crafty-controller-detect] Crafty Controller - Detect (@rxerium) [info]
  • [crater-detect] Crater - Detect (@rxerium) [info]
  • [cryptpad-detect] CryptPad - Detect (@rxerium) [info]
  • [cubejs-playground-detect] Cube.js Playground - Detect (@rxerium) [info]
  • [datasette-detect] Datasette - Detect (@rxerium) [info]
  • [dataverse-detect] Dataverse - Detect (@rxerium) [info]
  • [defguard-detect] Defguard - Detect (@rxerium) [info]
  • [dispatcharr-detect] Dispatcharr - Detect (@rxerium) [info]
  • [docker-registry-ui-detect] Docker Registry UI - Detect (@rxerium) [info]
  • [docspell-detect] Docspell - Detect (@rxerium) [info]
  • [documize-detect] Documize - Detect (@rxerium) [info]
  • [docusaurus-detect] Docusaurus - Detect (@rxerium) [info]
  • [duplicati-detect] Duplicati - Detect (@rxerium) [info]
  • [easyappointments-detect] Easy!Appointments - Detect (@rxerium) [info]
  • [eclipse-kapua-detect] Eclipse Kapua - Detect (@rxerium) [info]
  • [etherpad-detect] Etherpad - Detect (@rxerium) [info]
  • [evcc-detect] EVCC - Detect (@rxerium) [info]
  • [evershop-detect] EverShop - Detect (@rxerium) [info]
  • [excalidraw-detect] Excalidraw - Detect (@rxerium) [info]
  • [faveo-helpdesk-detect] Faveo Helpdesk - Detect (@rxerium) [info]
  • [fileflows-detect] FileFlows - Detect (@rxerium) [info]
  • [filerise-detect] FileRise - Detect (@rxerium) [info]
  • [filerun-detect] FileRun - Detect (@rxerium) [info]
  • [firefly-iii-detect] Firefly III - Detect (@rxerium) [info]
  • [firezone-detect] Firezone - Detect (@rxerium) [info]
  • [flagsmith-detect] Flagsmith - Detect (@rxerium) [info]
  • [flipt-detect] Flipt - Detect (@rxerium) [info]
  • [flowable-detect] Flowable - Detect (@rxerium) [info]
  • [flowfuse-detect] FlowFuse - Detect (@rxerium) [info]
  • [fluidd-detect] Fluidd - Detect (@rxerium) [info]
  • [focalboard-detect] Focalboard - Detect (@rxerium) [info]
  • [formbricks-detect] Formbricks - Detect (@rxerium) [info]
  • [frontaccounting-detect] FrontAccounting - Detect (@rxerium) [info]
  • [funkwhale-detect] Funkwhale - Detect (@rxerium) [info]
  • [galaxy-project-detect] Galaxy Project - Detect (@rxerium) [info]
  • [gameap-detect] GameAP - Detect (@rxerium) [info]
  • [gatus-detect] Gatus - Detect (@rxerium) [info]
  • [geonetwork-detect] GeoNetwork - Detect (@rxerium) [info]
  • [gladys-assistant-detect] Gladys Assistant - Detect (@rxerium) [info]
  • [glitchtip-detect] GlitchTip - Detect (@rxerium) [info]
  • [goatcounter-detect] GoatCounter - Detect (@rxerium) [info]
  • [gokapi-detect] Gokapi - Detect (@rxerium) [info]
  • [gollum-detect] Gollum - Detect (@rxerium) [info]
  • [gonic-detect] gonic - Detect (@rxerium) [info]
  • [gotosocial-detect] GoToSocial - Detect (@rxerium) [info]
  • [gpon-router-detect] GPON Home Gateway - Detect (@K3ysTr0K3R) [info]
  • [gravitee-apim-detect] Gravitee APIM - Detect (@rxerium) [info]
  • [grist-detect] Grist - Detect (@rxerium) [info]
  • [grocy-detect] Grocy - Detect (@rxerium) [info]
  • [growthbook-detect] GrowthBook - Detect (@rxerium) [info]
  • [hatchet-detect] Hatchet - Detect (@rxerium) [info]
  • [headplane-detect] Headplane - Detect (@rxerium) [info]
  • [highlight-io-detect] Highlight.io - Detect (@rxerium) [info]
  • [homegenie-detect] HomeGenie - Detect (@rxerium) [info]
  • [horilla-detect] Horilla - Detect (@rxerium) [info]
  • [htmly-detect] HTMLy - Detect (@rxerium) [info]
  • [http-etcd-unauthenticated-api-v3] etcd v3 Unauthenticated API (@x3lfyn) [high]
  • [http-etcd-unauthenticated-raft] etcd RAFT Unauthenticated API (@x3lfyn) [high]
  • [huawei-ssh-detect] Huawei SSH Service - Detect (@johnk3r) [info]
  • [humhub-detect] HumHub - Detect (@rxerium) [info]
  • [idempiere-detect] iDempiere - Detect (@rxerium) [info]
  • [illa-builder-detect] ILLA Builder - Detect (@rxerium) [info]
  • [inngest-detect] Inngest - Detect (@rxerium) [info]
  • [invoice-ninja-detect] Invoice Ninja - Detect (@rxerium) [info]
  • [invoiceplane-detect] InvoicePlane - Detect (@rxerium) [info]
  • [iobroker-detect] ioBroker - Detect (@rxerium) [info]
  • [iotsharp-detect] IoTSharp - Detect (@rxerium) [info]
  • [ipplan-detect] IPPlan - Detect (@rxerium) [info]
  • [islandora-detect] Islandora - Detect (@rxerium) [info]
  • [it-tools-detect] IT-Tools - Detect (@rxerium) [info]
  • [janus-webrtc-server-detect] Janus WebRTC Server - Detect (@rxerium) [info]
  • [jirafeau-detect] Jirafeau - Detect (@rxerium) [info]
  • [kanidm-detect] Kanidm - Detect (@rxerium) [info]
  • [kaui-detect] Kaui - Detect (@rxerium) [info]
  • [keila-detect] Keila - Detect (@rxerium) [info]
  • [kener-detect] Kener - Detect (@rxerium) [info]
  • [keystonejs-detect] KeystoneJS - Detect (@rxerium) [info]
  • [kimai-detect] Kimai - Detect (@rxerium) [info]
  • [komodo-detect] Komodo - Detect (@rxerium) [info]
  • [kubesphere-detect] KubeSphere - Detect (@rxerium) [info]
  • [lago-detect] Lago - Detect (@rxerium) [info]
  • [lemmy-detect] Lemmy - Detect (@rxerium) [info]
  • [librebooking-detect] LibreBooking - Detect (@rxerium) [info]
  • [libretime-detect] LibreTime - Detect (@rxerium) [info]
  • [lightdash-detect] Lightdash - Detect (@rxerium) [info]
  • [lizmap-detect] Lizmap - Detect (@rxerium) [info]
  • [lldap-detect] LLDAP - Detect (@rxerium) [info]
  • [logto-detect] Logto - Detect (@rxerium) [info]
  • [lowcoder-detect] Lowcoder - Detect (@rxerium) [info]
  • [loxberry-detect] LoxBerry - Detect (@rxerium) [info]
  • [lufi-detect] Lufi - Detect (@rxerium) [info]
  • [luigi-detect] Luigi - Detect (@rxerium) [info]
  • [mailtrain-detect] Mailtrain - Detect (@rxerium) [info]
  • [mailu-detect] Mailu - Detect (@rxerium) [info]
  • [mainflux-detect] Mainflux - Detect (@rxerium) [info]
  • [mainsail-detect] Mainsail - Detect (@rxerium) [info]
  • [mathesar-detect] Mathesar - Detect (@rxerium) [info]
  • [mayan-edms-detect] Mayan EDMS - Detect (@rxerium) [info]
  • [mcp-streamable-http-exposure] MCP Streamable HTTP Server - Unauthenticated Initialize (@DevamShah) [unknown]
  • [mediacms-detect] MediaCMS - Detect (@rxerium) [info]
  • [medusa-storefront-detect] Medusa Storefront - Detect (@rxerium) [info]
  • [metasfresh-detect] metasfresh - Detect (@rxerium) [info]
  • [microbin-detect] MicroBin - Detect (@rxerium) [info]
  • [mindsdb-detect] MindsDB - Detect (@rxerium) [info]
  • [minio-aistor-detect] MinIO AIStor Console - Detect (@r3dg33k) [info]
  • [minthcm-detect] MintHCM - Detect (@rxerium) [info]
  • [misskey-detect] Misskey - Detect (@rxerium) [info]
  • [mobilizon-detect] Mobilizon - Detect (@rxerium) [info]
  • [modbus-detect] Modbus TCP Service Detection (@K3ysTr0K3R) [info]
  • [monica-detect] Monica - Detect (@rxerium) [info]
  • [monitoror-detect] Monitoror - Detect (@rxerium) [info]
  • [netbird-detect] NetBird - Detect (@rxerium) [info]
  • [netmaker-detect] Netmaker - Detect (@rxerium) [info]
  • [nipap-detect] NIPAP - Detect (@rxerium) [info]
  • [nymea-detect] nymea - Detect (@rxerium) [info]
  • [oidc-signing-alg-none-supported] OpenID Connect - Unsigned (alg none) ID Token Supported (@rocky55ayush) [medium]
  • [omeka-s-detect] Omeka S - Detect (@rxerium) [info]
  • [openbas-detect] OpenBAS - Detect (@rxerium) [info]
  • [openboxes-detect] OpenBoxes - Detect (@rxerium) [info]
  • [openelis-detect] OpenELIS Global - Detect (@rxerium) [info]
  • [openevse-wifi-detect] OpenEVSE WiFi - Detect (@rxerium) [info]
  • [openmrs-detect] OpenMRS - Detect (@rxerium) [info]
  • [openroaming-portal] OpenRoaming Portal - Detect (@johnk3r) [info]
  • [opensupports-detect] OpenSupports - Detect (@rxerium) [info]
  • [openwb-detect] openWB - Detect (@rxerium) [info]
  • [openwisp-detect] OpenWISP - Detect (@rxerium) [info]
  • [opik-detect] Comet Opik - Detect (@rxerium) [info]
  • [orthanc-detect] Orthanc - Detect (@rxerium) [info]
  • [otter-wiki-detect] Otter Wiki - Detect (@rxerium) [info]
  • [ovenmediaengine-detect] OvenMediaEngine - Detect (@rxerium) [info]
  • [owncast-detect] Owncast - Detect (@rxerium) [info]
  • [pangolin-detect] Pangolin - Detect (@rxerium) [info]
  • [parseable-detect] Parseable - Detect (@rxerium) [info]
  • [part-db-detect] Part-DB - Detect (@rxerium) [info]
  • [peertube-detect] PeerTube - Detect (@rxerium) [info]
  • [pelican-panel-detect] Pelican Panel - Detect (@rxerium) [info]
  • [penpot-panel] Penpot - Login Panel (@ashish-cybersec) [info]
  • [peppermint-helpdesk-detect] Peppermint Helpdesk - Detect (@rxerium) [info]
  • [perses-detect] Perses - Detect (@rxerium) [info]
  • [pgweb-detect] Pgweb - Detect (@rxerium) [info]
  • [picoshare-detect] PicoShare - Detect (@rxerium) [info]
  • [pimatic-detect] pimatic - Detect (@rxerium) [info]
  • [pingvin-share-detect] Pingvin Share - Detect (@rxerium) [info]
  • [pixelfed-detect] Pixelfed - Detect (@rxerium) [info]
  • [plane-detect] Plane - Detect (@rxerium) [info]
  • [plik-detect] Plik - Detect (@rxerium) [info]
  • [pluxml-detect] PluXml - Detect (@rxerium) [info]
  • [postal-detect] Postal - Detect (@rxerium) [info]
  • [powerdns-admin-detect] PowerDNS-Admin - Detect (@rxerium) [info]
  • [powerdns-monitor-exposure] PowerDNS Authoritative Server Monitor - Unauthenticated Exposure (@ritikchaddha) [medium]
  • [pretix-detect] pretix - Detect (@rxerium) [info]
  • [proget-detect] ProGet - Detect (@rxerium) [info]
  • [promptfoo-detect] Promptfoo - Detect (@rxerium) [info]
  • [proxmox-backup-server-detect] Proxmox Backup Server - Detect (@rxerium) [info]
  • [prusalink-detect] PrusaLink - Detect (@rxerium) [info]
  • [psitransfer-detect] PsiTransfer - Detect (@rxerium) [info]
  • [publii-detect] Publii - Detect (@rxerium) [info]
  • [pufferpanel-detect] PufferPanel - Detect (@rxerium) [info]
  • [pydio-cells-detect] Pydio Cells - Detect (@rxerium) [info]
  • [qdrant-telemetry-exposure] Qdrant - Telemetry Exposure (@DevamShah) [medium]
  • [quay-detect] Quay - Detect (@rxerium) [info]
  • [raneto-detect] Raneto - Detect (@rxerium) [info]
  • [rapid-scada-detect] Rapid SCADA - Detect (@rxerium) [info]
  • [restate-detect] Restate - Detect (@rxerium) [info]
  • [restreamer-detect] Restreamer - Detect (@rxerium) [info]
  • [rport-detect] RPort - Detect (@rxerium) [info]
  • [runtipi-detect] Runtipi - Detect (@rxerium) [info]
  • [saleor-api-detect] Saleor API - Detect (@rxerium) [info]
  • [saleor-dashboard-detect] Saleor Dashboard - Detect (@rxerium) [info]
  • [scada-lts-detect] Scada-LTS - Detect (@rxerium) [info]
  • [sciencelogic-sl1-panel] ScienceLogic SL1 (EM7) Panel - Detect (@cham423) [info]
  • [scrutiny-detect] Scrutiny - Detect (@rxerium) [info]
  • [scrypted-detect] Scrypted - Detect (@rxerium) [info]
  • [secomea-gatemanager-panel] Secomea GateManager Panel - Detect (@cham423) [info]
  • [senaite-detect] SENAITE - Detect (@rxerium) [info]
  • [sentrifugo-detect] Sentrifugo - Detect (@rxerium) [info]
  • [serverless-framework-config-exposure] Serverless Framework - Configuration Exposure (@ChrisJr404) [medium]
  • [sharry-detect] Sharry - Detect (@rxerium) [info]
  • [shellhub-detect] ShellHub - Detect (@rxerium) [info]
  • [shuffle-soar-detect] Shuffle SOAR - Detect (@rxerium) [info]
  • [shynet-detect] Shynet - Detect (@rxerium) [info]
  • [solaranzeige-detect] Solaranzeige - Detect (@rxerium) [info]
  • [solarassistant-detect] SolarAssistant - Detect (@rxerium) [info]
  • [stalwart-mail-server-detect] Stalwart Mail Server - Detect (@rxerium) [info]
  • [starrocks-detect] StarRocks - Detect (@rxerium) [info]
  • [statping-ng-detect] Statping-ng - Detect (@rxerium) [info]
  • [sunshine-game-streaming-detect] Sunshine Game Streaming - Detect (@rxerium) [info]
  • [swarmpit-detect] Swarmpit - Detect (@rxerium) [info]
  • [swetrix-detect] Swetrix - Detect (@rxerium) [info]
  • [sylius-detect] Sylius - Detect (@rxerium) [info]
  • [taiga-detect] Taiga - Detect (@rxerium) [info]
  • [tasmoadmin-detect] TasmoAdmin - Detect (@rxerium) [info]
  • [technitium-dns-server-detect] Technitium DNS Server - Detect (@rxerium) [info]
  • [terraform-tfstate-exposure] Terraform State - File Exposure (@ChrisJr404) [high]
  • [terraformrc-credentials-exposure] Terraform CLI Configuration - Credentials Exposure (@ChrisJr404) [high]
  • [thinger-io-detect] Thinger.io - Detect (@rxerium) [info]
  • [thingspanel-detect] ThingsPanel - Detect (@rxerium) [info]
  • [tinacms-detect] TinaCMS - Detect (@rxerium) [info]
  • [trigger-dev-detect] Trigger.dev - Detect (@rxerium) [info]
  • [triliumnext-notes-detect] TriliumNext Notes - Detect (@rxerium) [info]
  • [tryton-sao-detect] Tryton SAO - Detect (@rxerium) [info]
  • [tuleap-detect] Tuleap - Detect (@rxerium) [info]
  • [turn-server] TURN Server (@johnk3r) [info]
  • [typemill-detect] TypeMill - Detect (@rxerium) [info]
  • [typesense-dashboard-detect] Typesense Dashboard - Detect (@rxerium) [info]
  • [typesetter-cms-detect] Typesetter CMS - Detect (@rxerium) [info]
  • [umbrel-detect] Umbrel - Detect (@rxerium) [info]
  • [uptrace-detect] Uptrace - Detect (@rxerium) [info]
  • [virto-commerce-detect] Virto Commerce - Detect (@rxerium) [info]
  • [volumio-detect] Volumio - Detect (@rxerium) [info]
  • [vouch-proxy-detect] Vouch Proxy - Detect (@rxerium) [info]
  • [watchyourlan-detect] WatchYourLAN - Detect (@rxerium) [info]
  • [weberp-detect] webERP - Detect (@rxerium) [info]
  • [webvirtcloud-detect] WebVirtCloud - Detect (@rxerium) [info]
  • [wekan-detect] Wekan - Detect (@rxerium) [info]
  • [whodb-detect] WhoDB - Detect (@rxerium) [info]
  • [winter-cms-detect] Winter CMS - Detect (@rxerium) [info]
  • [wordpress-click2shell] WordPress Click2Shell Theme Preview Selector Injection (@alex700) [high]
  • [writefreely-detect] WriteFreely - Detect (@rxerium) [info]
  • [yaade-detect] Yaade - Detect (@rxerium) [info]
  • [yugabytedb-detect] YugabyteDB - Detect (@rxerium) [info]
  • [zenko-cloudserver-detect] Zenko CloudServer - Detect (@rxerium) [info]
  • [zigbee2mqtt-detect] Zigbee2MQTT - Detect (@rxerium) [info]
  • [zincsearch-detect] ZincSearch - Detect (@rxerium) [info]

New Contributors

Check out latest releases or
releases around projectdiscovery/nuclei-templates v10.5.0

Don't miss a new nuclei-templates release

NewReleases is sending notifications on new releases.

Get notifications