Release notes

Nuclei v3.2.8

Nuclei received a couple of updates this month. in v3.2.6, an issue with goroutine leaks causing a spike in memory uses was fixed, as well as some fuzzing output enhancements and a new addition of the -profile and -profile-list options to run a template using the template profile. v3.2.7 saw added support for multiple search queries in templates to run with the -uncover option, and -scan-name input support for PDCP results upload added as well.

We’d also like to highlight our first-time Nuclei contributors this month, @socialsister and @rsrdesarrollo. We really value your input, and look forward to your future contributions!

shuffledns v1.1.0

This release added a feature update and addressed some maintenance issues, such as adding multi-domain wildcard filtering and basic callback.

Nuclei Templates

May stats

8,753

This month’s Nuclei Templates update includes some exciting contributions - 65 new templates were added in this release, along with 41 new CVEs, and the input of 3 first-time contributors. In v9.8.6, we’ve added several CVEs that address critical issues: a vulnerability for the Email Subscribers plugin for WordPress and WooCommerce making it susceptible to SQL Injection, a path traversal vulnerability in the Java version of CData API Server, and modoboa prior to 2.1.0 sending a GET request to the endpoint /api/v2/parameters/core/ , which returns sensitive information without any authentication or authorization.

In v9.8.7 we included 62 new templates were added, 16 CVEs, and 3 new contributors, fixing critical and high priority issues such as an unsafe reflection vulnerability identified in the GitHub Enterprise Server that could lead to reflection injection, Path Traversal in Sonatype Nexus Repository 3 allowing an unauthenticated attacker to read system files, and a vulnerability in the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java leading to code injection.

Huge thanks to our contributors on this release - @lstatro, @rxerium, @righettod, @t3l3machus, @Kazgangap and @mastercho. And, congratulations to our first-time contributors: @theMiddleBlue, @userdehghani, @jason3e7, @x676f64, @Ahsraeisi and @jmac774!

Other news

Articles

How did two of ProjectDiscovery’s own research team ethically hack into Apple? Take a look at this Forbes article, detailing the steps that were taken - and how this led to a vulnerability being fixed after just two hours.
Read the article

Over on Medium, Serhat Çiçek laid out their process for using Nuclei to to detect Boolean-based SQLi, going into detail about how the tool works and makes use of our new fuzzing feature.
Read the article

Looking for an effective way to crawl endpoints? coffinxp7 shared their process on using Katana for exactly that purpose.
View the post

Ben-Hur Santos Ott shared an awesome video explaining and reviewing AWS cloud configurations using Project Discovery’s own cloud templates. If you’d like to understand more about how companies and pentesters can use these tools, this is a must-watch!
Watch the video

Our diverse community spans members from full-time bug bounty hunters to Fortune 500 security engineers.

Thanks,
The ProjectDiscovery Team

If you have any feedback or ideas for our Community Newsletter, please share them by filling out this form. You can provide links or suggestions for content that you would like to see in the newsletter.