Skip to content

Nuclei Templates v10.4.7 - Release Notes

Latest
Latest

Choose a tag to compare

View all tags
@princechaddha princechaddha released this 03 Aug 07:21
v10.4.7
83234ce

New Templates Added: 122 | CVEs Added: 49 | First-time contributions: 23

🔥 Release Highlights 🔥

  • [CVE-2026-63030] WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion (@slcyber, @mielverkerken, @pdteam, @FLX-0x00) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-60004] Gitea <= 1.27.0 - Pre-Auth Remote Code Execution (@0x_Akoko) [critical] 🔥
  • [CVE-2026-58455] Dockwatch <= 0.6.567 - OS Command Injection (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-56291] Balbooa Forms < 2.4.1 - Unauth Arbitrary File Upload (@nick Vidovic, @0x_Akoko) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-56290] Page Builder CK <= 3.5.10 - Unauth File Upload (@panchiko-p, @0x_Akoko) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-48908] Joomla SP Page Builder <= 6.6.1 - Unauth Arbitrary File Upload RCE (@0x_Akoko) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-46442] Flowise < 3.1.2 - node-custom-function Unauth RCE (@dhiyaneshdk, @princechaddha) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-44825] Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials (@pdteam, @0x_Akoko) [high] (kev) (vKEV) 🔥
  • [CVE-2026-16232] Check Point Security Management Server - SmartConsole Authentication Bypass (@sfewer-r7, @dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-15409] SonicWall SMA1000 - Server-Side Request Forgery (@dhiyaneshdk, @rapid7) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-9282] W3 Total Cache <= 2.9.4 - Unauth Arbitrary File Read (@0x_Akoko) [high] (kev) (vKEV) 🔥
  • [CVE-2026-8732] WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauth Administrator Account Creation (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-8713] Avada (Fusion) Builder <= 3.15.3 - Unauth Arbitrary File Deletion (@rool-machine) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-6875] ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE (@pdteam, @dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-3296] Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2025-71334] Flowise - Path Traversal (@theamanrawat) [critical] (kev) (vKEV) 🔥
  • [CVE-2025-68493] Apache Struts XWork - XML External Entity Injection (@pussycat0x) [high] (kev) (vKEV) 🔥
  • [CVE-2025-54988] Apache Tika - XXE Injection (@tx1ee) [critical] 🔥
  • [CVE-2025-6389] Sneeit WP Social WordPress Plugin - Unauth RCE via call_user_func (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2025-2505] WordPress Age Gate <= 3.5.3 - Unauth Local File Inclusion (@pussycat0x) [critical] (kev) (vKEV) 🔥
  • [CVE-2024-56511] DataEase < 2.10.4 - Authentication Bypass via Whitelist Path Traversal (@ChrisJr404) [critical] 🔥
  • [CVE-2023-34992] Fortinet FortiSIEM - Unauth Command Injection (@Thacien) [critical] 🔥

What's Changed

Bug Fixes

  • Stopped credential-stuffing and token-spray templates from sending their first request when no username, password or token is supplied (PR #16589, Issue #11238).
  • Restored missing matcher and extractor values in four templates that silently no-op'd, including CVE-2021-44228, CVE-2021-45046 and CVE-2026-42281 (PR #16661).
  • Replaced an unsupported RE2 lookahead that stopped home-env-permission.yaml from loading at all (PR #16664).
  • Added the missing capture group to three regex extractors (PR #16665).
  • Corrected the extractor part in portal-api-ssrf from interactsh to interactsh_request (PR #16667).
  • Corrected the DSL variable in thinkphp6-arbitrary-write from status_2 to status_code_2 (PR #16668).
  • Unhid two extractors marked internal that nothing consumed (PR #16669).
  • Marked the setup-stage matchers in CVE-2025-2075 as internal (PR #16671).
  • Removed an AWS access key ID from a reference URL in CVE-2024-51482.yaml (PR #16616).
  • Fixed an intrusive tag typo in CVE-2023-34124.yaml (PR #16675).
  • Corrected the id and filename for the IBM DB2 Server template (PR #16688).
  • Fixed the severity in directory-listing-no-host-header.yaml (PR #16614).
  • Corrected the author field for CVE-2024-23108 (PR #16620).
  • Moved CVE-2025-29635 from javascript to http to fix its classification (PR #16636).
  • Moved CVE-2021-27877.yaml to the correct folder (PR #16591).
  • Renamed Wix-detect.yaml to wix-detect.yaml (PR #16731) and renamed a CVE file to match the naming convention (PR #16730).
  • Renamed CVE-2021-45046 to CVE-2021-45046-DAST (PR #16685) and smb-default-creds to smb-default-login (PR #16592).
  • Removed superseded and redundant templates: geovision-geowebserver-lfi.yaml (PR #16687), geovision-geowebserver-xss.yaml (PR #16686) and config-json.yaml (PR #16680).

False Negatives

  • Fixed mongodb-unauth failing on MongoDB 6.0+ by switching from the removed OP_QUERY opcode to OP_MSG (PR #16454, Issue #16294).
  • Fixed CVE-2026-23550 missing WordPress canonical redirects that carry a trailing slash (PR #16566, Issue #16554).
  • Improved CVE-2026-63030 with safe route-confusion detection (PR #16658, Issue #16629).
  • Reduced false negatives in the exposed-zookeeper template (PR #16579, Issue #11076).
  • Extended the unauthenticated-jenkins matcher to cover both dashboard title variants (PR #16575).
  • Fixed the langfuse-panel health matcher, which checked the wrong response part (PR #16574).
  • Updated twitter-phish.yaml matchers to the current X/Twitter login page markup (PR #16362).

False Positives

  • Reduced false positives and improved accuracy in the following templates:
  • nfs-v3-exposed, which treated an RPC PROG_UNAVAIL reply as a valid hit (PR #16672, Issue #16662).
  • Mailpit < 1.28.2 SMTP CRLF injection, CVE-2026-23829 (PR #16580, Issue #16576).
  • CVE-2025-32969, by removing an incorrect content_type matcher (PR #16704).
  • CVE-2023-50839, by adding a plugin fingerprint before flagging (PR #16526).
  • kiali-panel (PR #16628).
  • dameng-detect, switched to a positive signature (PR #16468).
  • open-proxy-portscan, now rejects HTML bodies returned by WAFs (PR #16588).

Enhancements

  • Refactored airflow-detect.yaml to add an /openapi.json check with stop-at-first-match (PR #16703).
  • Added body fuzzing plus POST/PUT method support to the DAST templates (PR #15947).
  • Reworked CVE-2024-22476 into a flow-based check with randomised markers (PR #16590).
  • Improved the CVE-2026-63030 request payload and tightened its matchers (PR #16682).
  • Updated htaccess-config.yaml with .htaccess.bak, .txt and .old paths, dropping stale ones (PR #16706).
  • Enriched four Perforce templates with CVE-2026-6043 metadata and references (PR #16349).
  • Converted geovision-geowebserver LFI/XSS templates to CVE-2021-47795 (PR #16160, Issue #15275).
  • Converted the Bitrix open redirect template to CVE-2008-2052 (PR #16301, Issue #15275).
  • Updated the Wix subdomain takeover fingerprint (PR #16551).
  • Added the Arista VeloCloud favicon hash to favicon-detect (PR #16677).
  • Updated tags in CVE-2026-16232.yaml (PR #16689).

Templates Added

  • [CVE-2026-65694] Microweber CMS <= 2.0.20 - Unauth Arbitrary File Read (@0x_Akoko, @abdugafforov-bobur) [high]
  • [CVE-2026-63030] WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion (@slcyber, @mielverkerken, @pdteam, @FLX-0x00) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-60004] Gitea <= 1.27.0 - Pre-Auth Remote Code Execution (@0x_Akoko) [critical] 🔥
  • [CVE-2026-58455] Dockwatch <= 0.6.567 - OS Command Injection (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-56291] Balbooa Forms < 2.4.1 - Unauth Arbitrary File Upload (@nick Vidovic, @0x_Akoko) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-56290] Page Builder CK <= 3.5.10 - Unauth Arbitrary File Upload (@panchiko-p, @0x_Akoko) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-55450] Langflow < 1.9.1 - Unauth File Upload (@xtr0nix) [critical]
  • [CVE-2026-54836] YMC Filter - SQL Injection (@theamanrawat) [critical]
  • [CVE-2026-52824] Kimai <= 2.57.0 - Default APP_SECRET Authentication Bypass (@dhiyaneshdk) [critical]
  • [CVE-2026-52773] YesWiki Archived Revision - Cross-Site Scripting (@0x_Akoko) [medium]
  • [CVE-2026-49952] Discuz! X5.0 - Authentication Bypass (@0x_Akoko) [critical]
  • [CVE-2026-48909] Joomla SP LMS <= 4.1.3 - Remote Code Execution (@dhiyaneshdk) [critical]
  • [CVE-2026-48908] Joomla SP Page Builder <= 6.6.1 - Unauth Arbitrary File Upload RCE (@0x_Akoko) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-46442] Flowise < 3.1.2 - node-custom-function Unauthorized RCE (@dhiyaneshdk, @princechaddha) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-44825] Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials (@pdteam, @0x_Akoko) [high] (kev) (vKEV) 🔥
  • [CVE-2026-42796] Arelle < 2.39.10 - Remote Code Execution (@Aryu-RU) [critical]
  • [CVE-2026-39468] Meta Box <= 5.11.1 - Arbitrary File Deletion (@iamatownboy) [high]
  • [CVE-2026-34036] Dolibarr <=22.0.4 - Local File Inclusion (@y0no) [medium]
  • [CVE-2026-33497] Langflow < 1.7.0 - Path Traversal (@xtr0nix) [high]
  • [CVE-2026-31831] Tautulli <= 2.16.1 - Path Traversal (@WRG-11) [high]
  • [CVE-2026-30623] LiteLLM 1.18.10 - Command Injection (@LEESEUNGSU) [high]
  • [CVE-2026-23696] Windmill < 1.603.3 - SQL Injection (@Chocapikk, @dhiyaneshdk) [critical]
  • [CVE-2026-22683] Windmill < 1.603.3 - Operator Authorization Bypass (@Chocapikk, @dhiyaneshdk) [high]
  • [CVE-2026-16232] Check Point Security Management Server - SmartConsole Authentication Bypass (@sfewer-r7, @dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-15409] SonicWall SMA1000 - Server-Side Request Forgery (@dhiyaneshdk, @rapid7) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-15094] WP Hotel Booking <= 2.3.2 - Cross-Site Scripting (@SmigsBellamigs) [medium]
  • [CVE-2026-9282] W3 Total Cache <= 2.9.4 - Unauth Arbitrary File Read (@0x_Akoko) [high] (kev) (vKEV) 🔥
  • [CVE-2026-9198] IBM Langflow - Remote Code Execution (@yeswehack) [critical]
  • [CVE-2026-8732] WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauth Administrator Account Creation (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-8713] Avada (Fusion) Builder <= 3.15.3 - Unauth Arbitrary File Deletion (@rool-machine) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-8385] WordPress WP Go Maps < 10.0.10 - Unauth Marker Data Disclosure (@0x_Akoko) [medium]
  • [CVE-2026-6875] ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE (@pdteam, @dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-4987] SureForms <= 2.5.2 - Unauth Payment Amount Validation Bypass via form_id (@iamatownboy) [high]
  • [CVE-2026-3891] Pix for WooCommerce <= 1.5.0 - Unauth Arbitrary File Upload (@m4sh_wacker) [critical]
  • [CVE-2026-3335] Canto <= 3.1.1 - Missing Authorization to Unauth File Upload (@iamatownboy) [medium]
  • [CVE-2026-3296] Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-1980] WPBookit <= 1.0.8 - Unauth Customer Information Disclosure (@Aryu-RU) [medium]
  • [CVE-2026-1830] Quick Playground <= 1.3.1 - Missing Authorization to Unauth Arbitrary File Upload (@iamatownboy) [critical]
  • [CVE-2025-71334] Flowise - Path Traversal (@theamanrawat) [critical] (kev) (vKEV) 🔥
  • [CVE-2025-68493] Apache Struts XWork - XML External Entity Injection (@pussycat0x) [high] (kev) (vKEV) 🔥
  • [CVE-2025-55746] Directus - Unauth File Modification (@aleff-github) [critical]
  • [CVE-2025-54988] Apache Tika - XXE Injection (@tx1ee) [critical] 🔥
  • [CVE-2025-14047] User Frontend <= 4.2.4 - Missing Authorization to Unauth Attachment Deletion (@iamatownboy) [medium]
  • [CVE-2025-6389] Sneeit WP Social WordPress Plugin - Unauth RCE via call_user_func (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2025-2505] WordPress Age Gate <= 3.5.3 - Unauth Local File Inclusion (@pussycat0x) [critical] (kev) (vKEV) 🔥
  • [CVE-2024-56511] DataEase < 2.10.4 - Authentication Bypass via Whitelist Path Traversal (@ChrisJr404) [critical] 🔥
  • [CVE-2024-42323] Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code Execution (@ChrisJr404) [high]
  • [CVE-2023-34992] Fortinet FortiSIEM - Unauth Command Injection (@Thacien) [critical] 🔥
  • [CVE-2019-14793] Meta Box <= 4.16.2 - Arbitrary File Deletion (@ritikchaddha) [high]
  • [apport-error-reporting-disabled-check] Ensure Automatic Error Reporting is Not Enabled (@Th3l0newolf) [medium]
  • [gdm-automount-removable-media-disabled-check] Ensure GDM Automatic Mounting of Removable Media is Disabled (@Th3l0newolf) [medium]
  • [gdm-autorun-never-enabled-check] Ensure GDM autorun-never is Enabled (@Th3l0newolf) [medium]
  • [gdm-disable-user-list-enabled-check] Ensure GDM disable-user-list Option is Enabled (@Th3l0newolf) [low]
  • [gdm-login-banner-configured-check] Ensure GDM Login Banner is Configured (@Th3l0newolf) [low]
  • [gdm-removed-check] Ensure GDM is Removed (@Th3l0newolf) [medium]
  • [gdm-screen-lock-idle-check] Ensure GDM Screen Locks When the User is Idle (@Th3l0newolf) [medium]
  • [issue-file-permissions-check] Ensure Access to /etc/issue is Configured (@Th3l0newolf) [medium]
  • [issue-net-file-permissions-check] Ensure Access to /etc/issue.net is Configured (@Th3l0newolf) [medium]
  • [local-login-warning-banner-configured-check] Ensure Local Login Warning Banner is Configured Properly (@Th3l0newolf) [low]
  • [motd-configured-properly-check] Ensure Message of the Day is Configured Properly (@Th3l0newolf) [low]
  • [motd-file-permissions-check] Ensure Access to /etc/motd is Configured (@Th3l0newolf) [medium]
  • [prelink-not-installed-check] Ensure Prelink is Not Installed (@Th3l0newolf) [medium]
  • [remote-login-warning-banner-configured-check] Ensure Remote Login Warning Banner is Configured Properly (@Th3l0newolf) [low]
  • [unix-command-injection] Unix Command Injection - Generic Detection (@Jaenact) [high]
  • [windows-command-injection] Windows Command Injection - Generic Detection (@Jaenact) [high]
  • [sentinel-default-login] Alibaba Sentinel - Default Login (@wujiecong) [high]
  • [9router-default-login] 9Router - Default Login (@0x_Akoko) [high]
  • [aim-panel] Aim Panel - Detect (@rxerium) [info]
  • [arthas-web-console] Alibaba Arthas Web Console - Detect (@wujiecong) [info]
  • [aruba-airwave-panel] Aruba AirWave Management Platform - Login Panel (@rxerium) [info]
  • [asustor-adm-panel] ASUSTOR ADM - Login Panel (@rxerium) [info]
  • [atera-customer-portal] Atera Customer Portal - Login Panel (@rxerium) [info]
  • [bizzy-panel] BIZZY Login - Panel (@Kazgangap) [info]
  • [buffalo-terastation-pro-panel] Buffalo TeraStation Pro - Login Panel (@rxerium) [info]
  • [chatwoot-login-panel] Chatwoot Login Panel - Detect (@Th3l0newolf) [info]
  • [compreface-panel] CompreFace Panel - Detect (@rxerium) [info]
  • [cribl-stream-panel] Cribl Stream - Login Panel (@rxerium) [info]
  • [cyberark-pvwa-panel] CyberArk Password Vault Web Access - Login Panel (@rxerium) [info]
  • [deepstack-panel] DeepStack AI Server Panel - Detect (@rxerium) [info]
  • [delinea-secret-server-panel] Delinea Secret Server - Login Panel (@rxerium) [info]
  • [determined-ai-panel] Determined AI Panel - Detect (@rxerium) [info]
  • [fastchat-panel] FastChat Panel - Detect (@rxerium) [info]
  • [fiftyone-panel] FiftyOne Panel - Detect (@rxerium) [info]
  • [fooocus-panel] Fooocus Panel - Detect (@rxerium) [info]
  • [h2o-driverless-ai-panel] H2O Driverless AI Panel - Detect (@rxerium) [info]
  • [helicone-panel] Helicone Panel - Detect (@rxerium) [info]
  • [kaseya-vsa-login-panel] Kaseya VSA - Login Panel (@rxerium) [info]
  • [knime-server-panel] KNIME Server / Business Hub WebPortal - Detect (@rxerium) [info]
  • [kubeflow-katib-panel] Kubeflow Katib Panel - Detect (@rxerium) [info]
  • [langtrace-panel] Langtrace Panel - Detect (@rxerium) [info]
  • [nakivo-backup-replication-panel] NAKIVO Backup & Replication - Login Panel (@rxerium) [info]
  • [one-identity-safeguard-spp-panel] One Identity Safeguard for Privileged Passwords - Login Panel (@rxerium) [info]
  • [pingfederate-login-panel] PingFederate - Login Panel (@rxerium) [info]
  • [prodigy-panel] Prodigy Annotation Tool - Unauth Exposure (@rxerium) [medium]
  • [rubrik-panel] Rubrik - Login Panel (@rxerium) [info]
  • [rustdesk-server-pro-panel] RustDesk Server Pro - Login Panel (@rxerium) [info]
  • [sailpoint-identityiq-panel] SailPoint IdentityIQ - Login Panel (@rxerium) [info]
  • [scale-computing-hc3-panel] Scale Computing HC3 - Login Panel (@rxerium) [info]
  • [schneider-ecostruxure-building-operation-webstation-panel] Schneider EcoStruxure Building Operation WebStation - Login Panel (@rxerium) [info]
  • [signoz-panel] SigNoz - Login Panel (@rxerium) [info]
  • [simplehelp-login-panel] SimpleHelp - Login Panel (@rxerium) [info]
  • [sonicwall-sma-panel] SonicWall Secure Mobile Access (SMA) Panel - Detection (@dhiyaneshdk) [info]
  • [tenable-sc-panel] Tenable Security Center - Login Panel (@rxerium) [info]
  • [unitrends-recovery-series-panel] Unitrends Recovery Series - Login Panel (@rxerium) [info]
  • [verba-panel] Verba (The Golden RAGtriever) Panel - Detect (@rxerium) [info]
  • [vermeg-solife-panel] Vermeg Solife Panel - Detect (@righettod) [info]
  • [xcp-ng-xo-lite-panel] XCP-ng XO Lite - Login Panel (@rxerium) [info]
  • [xen-orchestra-panel] Xen Orchestra - Login Panel (@rxerium) [info]
  • [vllm-openai-api-exposed] vLLM OpenAI-Compatible API - Unauth Exposure (@fsoppelsa) [medium]
  • [claude-settings-exposure] Claude Code Project Settings Exposure (@shadowhunter-92) [medium]
  • [abb-ability-genix-detect] ABB Ability Genix Industrial Analytics and AI Suite - Detect (@rxerium) [info]
  • [cockroachdb-detect] CockroachDB DB Console - Detect (@rxerium) [info]
  • [deskpro-default-page] Deskpro Private Controller - Default Page Detect (@Th3l0newolf) [info]
  • [deskpro-on-default-page] Deskpro On-Premise Controller - Default Page Detect (@Th3l0newolf) [info]
  • [huggingface-tei-tgi-detect] HuggingFace TEI & TGI - Detect (@insidetrust, @hdm) [info]
  • [jan-detect] Jan AI - Detect (@insidetrust, @hdm) [info]
  • [pingaccess-detect] PingAccess - Detect (@rxerium) [info]
  • [qdrant-detect] Qdrant - Detect (@rxerium) [info]
  • [rasa-detect] Rasa Open Source - Detect (@rxerium) [info]
  • [seldon-core-detect] Seldon Core - Detect (@rxerium) [info]
  • [sglang-detect] SGLang - Detect (@insidetrust, @hdm) [info]
  • [vespa-detect] Vespa - Detect (@rxerium) [info]

New Contributors

Full Changelog: v10.4.6...v10.4.7

Contributors

nick, anupamme, and 49 other contributors
Assets 3
Loading