github projectdiscovery/nuclei-templates v10.5.2
Nuclei Templates v10.5.2 - Release Notes
on GitHub

one hour ago

New Templates Added: 121 | CVEs Added: 102 | First-time contributions: 18

🔥 Release Highlights 🔥

  • [CVE-2026-123488] Craft CMS < 4.18.9, < 5.11.2 - Unauthenticated SQL Injection (@0x_Akoko) [critical] (vKEV) 🔥
  • [CVE-2026-123158] SSHole - OpenSSH/musl Password Auth Bypass (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-116690] MLflow 3.10.0-3.16.1 - Arbitrary File Read (@ashish-cybersec) [high] (vKEV) 🔥
  • [CVE-2026-116606] Barracuda Email Security Gateway - Authentication Bypass (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-114509] Laravel TokenGuard - Authentication Bypass (@kosoyyagent) [critical] (vKEV) 🔥
  • [CVE-2026-111497] Node.js Brotli Request-Body Integer Overflow (node2shell) - Remote Code Execution (@assetnote, @dhiyaneshdk, @goosvorbook) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-110447] Collabora Built-in CODE Server < 26.4.303 - OS Command Injection (@alex700) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-109619] PHP 8.2 < 8.2.35, 8.3 < 8.3.36, 8.4 < 8.4.27, 8.5 < 8.5.12 - Use-After-Free Remote Code Execution (@comradezephyr (Abdullah Shahid)) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-105740] Langflow 1.8.3 and 1.9.0 - Authenticated MCP Stdio Command Execution (@alex700) [critical] (vKEV) 🔥
  • [CVE-2026-105134] AhsayCBS <= 10.3.4 - Unauthenticated RCE (@0x_Akoko) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-102764] BeyondTrust Remote Support <= 26.2.3 - Origin Validation File Upload (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-102489] Zammad 6.3.0-6.5.4 - Session Hijacking & Remote Code Execution (@abdullah Shahid (comradezephyr)) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-97359] Rejetto HTTP File Server 2.4.x - Template Injection (@kosoyyagent) [critical] (vKEV) 🔥
  • [CVE-2026-97229] GitLab CE/EE < 19.2.8 / 19.3.5 / 19.4.2 - Unauthenticated RCE via Onigmo Integer Overflow (@rapid7) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-93485] WordPress Core < 7.1.1 - Unauthenticated Stored XSS via Comment (Comment2Shell) (@dhiyaneshdk) [high] (vKEV) 🔥
  • [CVE-2026-85595] Traefik < 2.11.55 / 3.0.0 - 3.7.10 - Digest Authentication Bypass (@Boreas37) [critical] 🔥
  • [CVE-2026-75650] Adobe Commerce/Magento <= 2.4.9 - StyleSmuggler Unauthenticated RCE via SSTI (@k0pak4) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-42016] JFrog Artifactory - Unauthenticated Admin Token Minting via Token Scope Bypass (@theamanrawat) [high] (kev) (vKEV) 🔥
  • [CVE-2026-18051] W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write (@HaroonArshad-53) [critical] 🔥

What's Changed

Bug Fixes

  • Fixed tag typos across 12 templates, where misspelled product and category tags kept them out of tag-based scans (PR #17506).
  • Added the missing intrusive tag to code/cves/2022/CVE-2022-42475.yaml (PR #17492).
  • Corrected the client certificate helper path in CVE-2024-47575, which pointed at a file that does not exist in the repository (PR #17443).
  • Lowered the severity of fastly-debug-headers from low to info, since debug headers are a fingerprint rather than a finding (PR #17458).

False Negatives

  • CVE-2025-54988: reworked the Apache Tika XXE template to fingerprint /version with a version check and send a real XFA payload, replacing the /tika request whose PDF never triggered the parser (PR #17385).
  • springboot-x-application-context: fixed a word matcher that could never match, so the template never reported an exposed context (PR #17495).
  • cisco-meraki-exposure: fixed a matcher that no longer matched the current local status page (PR #17618).
  • atlassian-crowd-panel: updated the matcher to the current login title (PR #17666).

False Positives

  • CVE-2024-29972: no longer matches catch-all 200 pages (PR #17414).
  • CVE-2025-58443: no longer matches catch-all 200 pages (PR #17418).
  • CVE-2026-27960: no longer matches GraphQL validation errors (PR #17425).
  • CVE-2025-4123: no longer matches same-origin 302 reflections (PR #17679).
  • CVE-2024-5333: added a version check so patched installs are no longer reported (PR #17442).
  • CVE-2019-5544: tightened the network matcher that reported unaffected hosts (PR #17451).
  • CVE-2026-109618: the version check no longer flags distro-backported PHP builds that are already patched (PR #17573, Issue #17507).
  • CVE-2026-18937: the matcher no longer triggers on any page that happens to contain the uid= and gid= substrings (PR #17753, Issue #17740).
  • dell-idrac9-detect: now requires both quoted iDRAC9 keys, so Apple AirPlay receivers on macOS and other devices no longer match (PR #17653, Issue #17611).
  • una-cms-rce: reduced false positives in the PHP object injection check (PR #17602, Issue #17450).
  • appsmith-info-disclosure: stops matching Appsmith >= v1.98, where the disclosure is patched (PR #17645).
  • rails-secret-token-disclosure: fixed a false positive and corrected a typo (PR #17481).
  • composer-auth-json: fixed a false positive and corrected a typo (PR #17482).
  • azure-pipelines-exposed: reduced false positives on files that are not actually Azure Pipelines configuration (PR #17510).

Enhancements

  • waf-detect now identifies Citrix NetScaler (PR #17543).
  • azure-domain-tenant was reworked into Microsoft Entra ID tenant detection, reading the tenant GUID from the pre-authentication redirect or the Application Proxy header and falling back to the userrealm and OpenID Connect discovery endpoints for hosts that do not disclose it (PR #17617).
  • haproxy-status now extracts the HAProxy version from the status page (PR #17620).
  • Revised the deprecated-tls detection and its remediation guidance (PR #17593).
  • Added an open redirect bypass payload to the DAST fuzzing template (PR #17496).
  • Documented template signing and the # digest line in CONTRIBUTING.md (PR #17660, Issue #17615).

Templates Added

  • [CVE-2026-125357] Munin munin-httpd 2.99.1-2.999.18 - Unauthenticated Path Traversal (@maulanawirawan) [medium]
  • [CVE-2026-123488] Craft CMS < 4.18.9, < 5.11.2 - Unauthenticated SQL Injection (@0x_Akoko) [critical] (vKEV) 🔥
  • [CVE-2026-123270] Redpanda Connect Streams API - Unauthenticated Remote Code Execution (@pagvac) [critical]
  • [CVE-2026-123158] SSHole - OpenSSH/musl Password Auth Bypass (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-120597] WordPress Welcart e-Commerce < 2.12.7 - Cross-Site Scripting (@maulanawirawan) [medium]
  • [CVE-2026-120446] madong-admin-saas <= 5.1.4 - Unauthenticated Platform Tenant Management Access (@maulanawirawan) [high]
  • [CVE-2026-120442] ape-volo-admin <= 3.5.2 - Authentication Bypass via Hardcoded JWT Signing Key (@maulanawirawan) [critical]
  • [CVE-2026-120201] Jpom 2.10.0-2.11.12 - Authentication Bypass (@0x_Akoko) [critical]
  • [CVE-2026-119495] WordPress Better Search < 4.5.3 - Unauthenticated Arbitrary Post Type Content Disclosure (@maulanawirawan) [medium]
  • [CVE-2026-118539] Drupal Commerce Core < 3.3.13 / < 8.x-2.41 - Guest Cart Admin Access Bypass (@alex700, @dpuccetti, @marcus_johansson, @rsnyd) [critical] (vKEV)
  • [CVE-2026-118523] EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure (@maulanawirawan) [medium]
  • [CVE-2026-118267] WP Data Access <= 5.5.89 - Incorrect Authorization to Privilege Escalation (@dhiyaneshdk) [high] (vKEV)
  • [CVE-2026-118066] LatePoint < 5.7.7 - Unauthenticated Authentication Bypass / Account Takeover (@dhiyaneshdk) [critical] (vKEV)
  • [CVE-2026-116817] OpenPanel - Unauthenticated Bull Board Queue Dashboard (@kosoyyagent) [medium]
  • [CVE-2026-116748] Transmission 4.0.0-4.1.2 - Permissive CORS Exposes RPC Session ID (@kosoyyagent) [medium]
  • [CVE-2026-116747] Kener - Authentication Bypass (@kosoyyagent) [critical]
  • [CVE-2026-116690] MLflow 3.10.0-3.16.1 - Arbitrary File Read (@ashish-cybersec) [high] (vKEV) 🔥
  • [CVE-2026-116606] Barracuda Email Security Gateway - Authentication Bypass (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-116548] VikRentCar <= 1.4.10 - Cross-Site Scripting (@dhiyaneshdk) [high] (vKEV)
  • [CVE-2026-116485] danmu_api - Unauthenticated Access to Admin API via Default Token (@kosoyyagent) [high]
  • [CVE-2026-116366] ClickHouse Server - Brotli v1.2.0 Decoder DoS/OOB-Write (@dhiyaneshdk) [critical]
  • [CVE-2026-116205] YesWiki < 4.7.0 - Unauthenticated Server-Side Request Forgery (@kosoyyagent) [high]
  • [CVE-2026-116167] SiYuan 2.9.0-3.8.6 - Unauthenticated XSS via check-auth "to" Parameter (@kosoyyagent) [high]
  • [CVE-2026-116070] Docker-Proxy hubcmdui - Missing Authentication on /api/config (@kosoyyagent) [medium]
  • [CVE-2026-116067] Paisa < 0.7.8 - Unauthenticated Path Traversal (@kosoyyagent) [high]
  • [CVE-2026-116006] Ruoyi-Vue-Pro - Unauthenticated Admin Takeover via Predictable SMS Code (@kosoyyagent) [critical]
  • [CVE-2026-115886] MLflow <3.17.0 - Unauthenticated SSRF via Third-Party (TruLens) Scorer (@kosoyyagent) [medium] (vKEV)
  • [CVE-2026-115574] Zulip Server 11.0 - 12.1 - Unauthenticated Custom Profile Field Disclosure (@maulanawirawan) [medium]
  • [CVE-2026-114509] Laravel TokenGuard - Authentication Bypass (@kosoyyagent) [critical] (vKEV) 🔥
  • [CVE-2026-112866] Product Filter by WBW <= 3.4.6 - SQL Injection (@HaroonArshad-53) [critical]
  • [CVE-2026-111497] Node.js Brotli Request-Body Integer Overflow (node2shell) - Remote Code Execution (@assetnote, @dhiyaneshdk, @goosvorbook) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-110447] Collabora Built-in CODE Server < 26.4.303 - OS Command Injection (@alex700) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-109619] PHP 8.2 < 8.2.35, 8.3 < 8.3.36, 8.4 < 8.4.27, 8.5 < 8.5.12 - Use-After-Free Remote Code Execution (@comradezephyr (Abdullah Shahid)) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-108123] WP Booking System <= 2.1.0.3 - Unauthenticated Email Log Disclosure (@0x_Akoko) [high]
  • [CVE-2026-105740] Langflow 1.8.3 and 1.9.0 - Authenticated MCP Stdio Command Execution (@alex700) [critical] (vKEV) 🔥
  • [CVE-2026-105134] AhsayCBS <= 10.3.4 - Unauthenticated RCE (@0x_Akoko) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-104736] LearnPress <= 4.4.9.1 - PHP Object Injection (@0x_Akoko, @pdteam) [critical] (vKEV)
  • [CVE-2026-102878] mcp-chrome-bridge (hangwin/mcp-chrome) <= 1.0.31 - CORS Origin Bypass (CSWSH) (@carfeii) [high]
  • [CVE-2026-102782] OrdaSoft Simple Membership < 7.4.0 - SQL Injection (@HaroonArshad-53) [critical]
  • [CVE-2026-102764] BeyondTrust Remote Support <= 26.2.3 - Origin Validation File Upload (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-102489] Zammad 6.3.0-6.5.4 - Session Hijacking & Remote Code Execution (@abdullah Shahid (comradezephyr)) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-97359] Rejetto HTTP File Server 2.4.x - Template Injection (@kosoyyagent) [critical] (vKEV) 🔥
  • [CVE-2026-97229] GitLab CE/EE < 19.2.8 / 19.3.5 / 19.4.2 - Unauthenticated RCE via Onigmo Integer Overflow (@rapid7) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-96655] Plex Media Server < 1.43.3.10861 - SSRF via Transcoder (@DhiyaneshGeek) [medium] (kev) (vKEV)
  • [CVE-2026-96652] Plex Media Server < 1.43.3.10861 - Unauthenticated SSRF via Companion Protocol (plex2shell) (@0x_Akoko, @pdteam, @alex700) [medium] (kev) (vKEV)
  • [CVE-2026-93485] WordPress Core < 7.1.1 - Unauthenticated Stored XSS via Comment (Comment2Shell) (@dhiyaneshdk) [high] (vKEV) 🔥
  • [CVE-2026-92998] Click n Chat < 1.1.3 - Unauthenticated SQL Injection (@HaroonArshad-53) [high]
  • [CVE-2026-89079] Theme My Login <= 7.2.1 - Privilege Escalation (@dhiyaneshdk) [critical] (vKEV)
  • [CVE-2026-89026] Issabel Framework - Hard-Coded PBX API JWT Key (@alex) [critical] (vKEV)
  • [CVE-2026-88804] SUSE Rancher - Stored XSS via Unauthenticated Settings Override (@R0gfall) [high]
  • [CVE-2026-85595] Traefik < 2.11.55 / 3.0.0 - 3.7.10 - Digest Authentication Bypass (@Boreas37) [critical] 🔥
  • [CVE-2026-82901] Ultimate Addons for Contact Form 7 <= 3.5.50 - Arbitrary File Upload (@dhiyaneshdk) [high] (vKEV)
  • [CVE-2026-75650] Adobe Commerce/Magento <= 2.4.9 - StyleSmuggler Unauthenticated RCE via SSTI (@k0pak4) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-75128] Langchain-Chatchat <= 0.3.1.3 - Unauthenticated RCE (@0x_Akoko) [critical]
  • [CVE-2026-62850] FreeScout < 1.8.225 - Unauthenticated Maintenance File Existence Oracle (@maulanawirawan) [medium]
  • [CVE-2026-59707] LocalAI < 4.6.0 - Server-Side Request Forgery (@ashish-cybersec) [critical]
  • [CVE-2026-56062] Quotes llama <= 3.1.5 - SQL Injection (@abdullah Shahid (comradezephyr)) [critical]
  • [CVE-2026-55864] GeoNetwork - Server-Side Request Forgery (SSRF) (@ashish-cybersec) [high]
  • [CVE-2026-54419] PIAF-HMS ec.php - SQL Injection (@alex700) [critical]
  • [CVE-2026-53468] Typemill CMS < 2.23.0 - Cross-Site Scripting (@sandiyochristan) [medium]
  • [CVE-2026-48048] XWiki Platform - Password Hash Disclosure (@ritikchaddha) [high]
  • [CVE-2026-42016] JFrog Artifactory - Unauthenticated Admin Token Minting via Token Scope Bypass (@theamanrawat) [high] (kev) (vKEV) 🔥
  • [CVE-2026-34577] Postiz < 2.21.3 - Unauthenticated Server-Side Request Forgery (@ashish-cybersec) [high]
  • [CVE-2026-34151] XWiki Platform - Path Traversal (@ritikchaddha) [high]
  • [CVE-2026-25939] FUXA - Authorization Bypass (@theamanrawat) [critical] (vKEV)
  • [CVE-2026-24898] OpenEMR < 8.0.0 - MedEx Callback Unauthenticated Token Disclosure (@securin) [critical]
  • [CVE-2026-22777] ComfyUI-Manager < 3.39.2 - CRLF Configuration Injection (@TassioSales, @dhiyaneshdk) [high]
  • [CVE-2026-19697] GutenKit Blocks Addon < 2.5.0 - Stored Cross-Site Scripting (@yaswanth77) [medium]
  • [CVE-2026-18110] Concrete CMS - User Enumeration (@community) [high]
  • [CVE-2026-18051] W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write (@HaroonArshad-53) [critical] 🔥
  • [CVE-2026-17540] WordPress Bit File Manager < 6.9.1 - Arbitrary File Read (@anirbala98) [high]
  • [CVE-2026-16959] WordPress Media Library Assistant < 3.40 - SQL Injection (@anirbala98) [medium]
  • [CVE-2026-16535] WordPress Link Library < 7.9.4 - Cross-Site Scripting (@anirbala98) [medium]
  • [CVE-2026-16065] Welcart e-Commerce < 2.11.32 - SQL Injection (@yaswanth77, @0x_Akoko) [medium]
  • [CVE-2026-16062] Event Booking Manager for WooCommerce <= 5.3.6 - PHP Object Injection (@yaswanth77, @0x_Akoko) [medium]
  • [CVE-2026-14554] WordPress Check & Log Email < 2.0.15 - SQL Injection (@anirbala98) [medium]
  • [CVE-2026-12970] WordPress LearnPress < 4.4.1 - Cross-Site Scripting (@anirbala98) [high]
  • [CVE-2026-12592] SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header (@yaswanth) [high]
  • [CVE-2026-12583] Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field (@yaswanth) [high]
  • [CVE-2026-11565] WordPress Advanced File Manager < 5.4.13 - Arbitrary File Read (@anirbala98) [high] (vKEV)
  • [CVE-2026-10525] NEX-Forms Express WP Form Builder < 9.2.3 - Unauthenticated Stored XSS (@sandiyochristan) [high]
  • [CVE-2026-9848] WP Ticket <= 6.0.4 - SQL Injection (@HaroonArshad-53) [high]
  • [CVE-2026-9062] WordPress Agile Store Locator < 1.6.9 - Arbitrary File Read (@anirbala98) [low]
  • [CVE-2026-7873] Langflow 1.7.2-1.10.0 - Authenticated Remote Code Execution (@0x_Akoko, @pdteam) [critical] (vKEV)
  • [CVE-2026-7482] Ollama < 0.17.1 - Information Disclosure (@theamanrawat) [high] (vKEV)
  • [CVE-2025-49387] WordPress Drag and Drop File Upload for Elementor Forms <=1.5.3 - Unauthenticated Arbitrary File Upload (@dhiyaneshdk) [critical] (vKEV)
  • [CVE-2025-11201] MLflow Tracking Server - Unauthenticated Model Source Path Traversal RCE (@dhiyaneshdk) [critical] (vKEV)
  • [CVE-2025-7340] HT Contact Form Widget for Elementor <= 2.2.1 - Unauthenticated Arbitrary File Upload (@dhiyaneshdk) [critical] (vKEV)
  • [CVE-2024-56829] Huang Yaoshi Pharmaceutical Management Software - Unrestricted File Upload (@kosoyyagent) [critical]
  • [CVE-2024-6695] Profile Builder <= 3.11.8 - Unauthenticated Privilege Escalation (@dhiyaneshdk) [critical] (vKEV)
  • [CVE-2023-54335] eXtplorer <= 2.1.14 - Authentication Bypass (@securin) [critical]
  • [CVE-2023-31719] FUXA <= 1.1.12 - Unauthenticated SQL Injection (@securin) [critical]
  • [CVE-2023-7335] EduSoho < 22.4.7 - Unauthenticated Arbitrary File Read (@0x_Akoko) [high] (vKEV)
  • [CVE-2021-24981] Directorist < 7.0.6.2 - Cross-Site Request Forgery to Arbitrary File Upload (@dhiyaneshdk) [high] (vKEV)
  • [CVE-2021-24353] Simple 301 Redirects by BetterLinks <= 2.0.3 - Unauthenticated Arbitrary Redirect Import (@dhiyaneshdk) [high] (vKEV)
  • [CVE-2021-4358] WP DSGVO Tools (GDPR) <= 3.1.22 - Unauthenticated Stored Cross-Site Scripting (@dhiyaneshdk) [high] (vKEV)
  • [CVE-2020-36847] WordPress Simple File List < 4.2.3 - Unauthenticated Remote Code Execution (@dhiyaneshdk) [critical] (vKEV)
  • [CVE-2020-24901] Krpano Panorama Viewer <= 1.20.8 - Cross-Site Scripting (@s4e-io) [medium] (vKEV)
  • [CVE-2020-24900] Krpano Panorama Viewer <= 1.20.8 - Cross-Site Scripting (@s4e-io) [medium]
  • [CVE-2017-1000226] Stop User Enumeration <= 1.3.8 - REST API User Enumeration Bypass (@theamanrawat) [medium] (vKEV)
  • [CVE-2015-5468] WP e-Commerce Shop Styling <= 2.5 - Authenticated Directory Traversal / Arbitrary File Read (@dhiyaneshdk) [high] (vKEV)
  • [CVE-2010-1428] Red Hat JBoss - Web/JMX Console Access (@Jayachandran from Securin Labs (https://securin.io)) [high] (kev) (vKEV)
  • [bwapp-default-login] bWAPP Default Login (@ayoubbuilds) [critical]
  • [jboss-admin-console-default-login] JBoss AS/EAP Admin Console - Default Login (@J2EEScan (ilmila), @Tortuginator) [high]
  • [actual-budget-panel] Actual Budget - Panel (@HaroonArshad-53) [info]
  • [coolify-panel] Coolify Login Panel - Detect (@rafaelsoje) [info]
  • [danfoss-ak-sm-800a-panel] Danfoss AK-SM 800A Web Management - Detect (@flukes86) [info]
  • [infisical-panel] Infisical Login Panel - Detect (@rafaelsoje) [info]
  • [jboss-admin-console-panel] JBoss AS/EAP Admin Console - Panel (@J2EEScan (ilmila), @ Tortuginator) [info]
  • [pocket-id-panel] Pocket ID Login Panel - Detect (@7xd0) [info]
  • [tailscale-panel] Tailscale - Panel Detect (@rxerium) [info]
  • [prefect-api-exposure] Prefect Server Unauthenticated API Exposure (@HaroonArshad-53) [medium]
  • [lighter-config] Lighter - Config Exposed (@icarot) [medium]
  • [dashdot-info-exposure] Dashdot - Server Information Exposure (@HaroonArshad-53) [medium]
  • [dvwa-setup] DVWA Exposed Setup Page (@mayoubmalik1-blip) [high]
  • [meilisearch-unauth] Meilisearch - Unauthenticated Index Exposure (@HaroonArshad-53) [medium]
  • [opencloud-detect] OpenCloud - Detect (@righettod) [info]
  • [diafan-cms-xss] Diafan CMS 6.0 - Cross-Site Scripting (@kosoyyagent) [medium]
  • [nuuo-unauth-rce] NUUO Crystal Server - Unauthenticated File Upload Remote Code Execution (@Exploit-Garbage) [critical]
  • [elementor-rest-nonce-bypass] Elementor 4.3.0 - 4.3.1 - REST Nonce Bypass (@alex700) [medium]
  • [jetpack-reader-xss] WordPress Jetpack < 16.1.3 - Reflected Cross-Site Scripting (@kosoyyagent, @0xr2r) [medium]

New Contributors

Check out latest releases or
releases around projectdiscovery/nuclei-templates v10.5.2

Don't miss a new nuclei-templates release

NewReleases is sending notifications on new releases.

Get notifications