Starstruk Logo MarkStarstruk

v10.2.7

projectdiscovery/nuclei-templatesv10.2.7Aug 9, 2025by princechaddha

AI Summary

Adds 50 templates and 8 CVEs, featuring critical RCE in NestJS DevTools and Fortinet FortiWeb SQL Injection.

Key Highlights

  • NestJS DevTools Integration Remote Code Execution (CVE-2025-54782)
  • Fortinet FortiWeb SQL Injection (CVE-2025-25257)
  • Güralp Systems FMUS Series Unauthenticated Access (CVE-2025-8286)
  • Bonita Web Authentication/Authorization Bypass (CVE-2022-25237)
  • Unauthenticated Arbitrary Plugin Upload in Alone Theme (CVE-2025-5394)

New Features

  • CVE-2025-54782 NestJS DevTools Integration - Remote Code Execution
  • CVE-2025-25257 Fortinet FortiWeb - SQL Injection
  • CVE-2025-8286 Güralp Systems FMUS - Unauthenticated Access
  • CVE-2022-25237 Bonita Web - Authentication/Authorization Bypass
  • Added various user name information detection templates

Full Release Notes

### New Templates Added: `50` | CVEs Added: `08` | First-time contributions: `3`

### 🔥 Release Highlights 🔥
- [CVE-2025-54782] NestJS DevTools Integration - Remote Code Execution (@nukunga) [critical] 🔥
- [CVE-2025-25257] Fortinet FortiWeb - SQL Injection (@watchtowr, @johnk3r) [critical] 🔥 (KEV)
- [CVE-2025-8286] Güralp Systems FMUS Series - Unauthenticated Access (@darses) [critical] 🔥
- [CVE-2025-8191] Swagger UI >=3.14.1 < 3.38.0 - DOM Based Cross-Site Scripting (@DhiyaneshDK) [medium] 🔥
- [CVE-2025-5394] Unauthenticated Arbitrary Plugin Upload in Alone Theme (@Nxploited, @DhiyaneshDK) [critical] 🔥 (KEV)
- [CVE-2025-4334] Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation (@pussycat0x) [critical] 🔥
- [CVE-2024-2053] Artica Proxy  - Unauthenticated LFI (@pussycat0x) [high] 🔥
- [CVE-2022-25237] Bonita Web 2021.2 - Authentication/Authorization Bypass (@Sourabh-Sahu) [critical] 🔥 (KEV)

## What's Changed
- [CVE-2025-54782] NestJS DevTools Integration - Remote Code Execution (@nukunga) [critical] 🔥
- [CVE-2025-53558] ZTE ZXHN-F660T/F660A - Default Credentials (@DhiyaneshDK) [high]
- [CVE-2025-48954] Discourse OAuth Social Login - Cross-site Scripting (@ferreiraklet, @DhiyaneshDK, @pdresearch) [high]
- [CVE-2025-44177] White Star Software ProTop - Directory Traversal (@s-cu-bot) [high]
- [CVE-2025-25257] Fortinet FortiWeb - SQL Injection (@watchtowr, @johnk3r) [critical] 🔥 (KEV)
- [CVE-2025-8286] Güralp Systems FMUS Series - Unauthenticated Access (@darses) [critical] 🔥
- [CVE-2025-8191] Swagger UI >=3.14.1 < 3.38.0 - DOM Based Cross-Site Scripting (@DhiyaneshDK) [medium] 🔥
- [CVE-2025-6197] Open Redirect via Organization Switching (@iamnoooob, @pdresearch) [medium]
- [CVE-2025-5394] Unauthenticated Arbitrary Plugin Upload in Alone Theme (@Nxploited, @DhiyaneshDK) [critical] 🔥 (KEV)
- [CVE-2025-4334] Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation (@pussycat0x) [critical] 🔥
- [CVE-2025-1595] EasyCVR <=2.1.2 - Information Disclosure (@ritikchaddha) [medium]
- [CVE-2024-2053] Artica Proxy  - Unauthenticated LFI (@pussycat0x) [high] 🔥
- [CVE-2022-25237] Bonita Web 2021.2 - Authentication/Authorization Bypass (@Sourabh-Sahu) [critical] 🔥 (KEV)
- [apache-inlong-default-login] Apache InLong - Default Login (@icarot) [high]
- [openmetadata-default-login] OpenMetadata - Default Login (@icarot) [high]
- [meddream-dicom-viewer-panel] MedDream DICOM Viewer - Panel (@darses) [info]
- [opensign-panel] OpenSign Login Panel - Detect (@righettod) [info]
- [scalar-detection] Scalar API Documentation - Detect (@recepgunes) [info]
- [suse-manager-panel] SUSE Manager Server - Panel (@darses) [info]
- [dnt-policy-detect] DNT Policy Declaration (@rxerium) [info]
- [zipline-installer] Zipline - Installer (@pussycat0x) [critical]
- [titiler-ssrf] TiTiler - Blind Server Side Request Forgery (@xbow, @DhiyaneshDK) [high]
- [tomcat-directory-listing] Apache Tomcat - Directory Listing Enabled (@oleveloper) [medium]
- [9gag] 9GAG User Name Information - Detect (@princechaddha, @rxerium) [info]
- [apple-developer] Apple Developer User Name Information - Detect (@princechaddha, @rxerium) [info]
- [apple-discussions] Apple Discussions User Name Information - Detect (@princechaddha, @rxerium) [info]
- [atcoder] AtCoder User Name Information - Detect (@princechaddha, @rxerium) [info]
- [bluesky] Bluesky User Name Information - Detect (@princechaddha, @rxerium) [info]
- [cgtrader] CGTrader User Name Information - Detect (@princechaddha, @rxerium) [info]
- [codechef] CodeChef User Name Information - Detect (@princechaddha, @rxerium) [info]
- [geeksforgeeks] GeeksforGeeks User Name Information - Detect (@princechaddha, @rxerium) [info]
- [genius-users] Genius Users User Name Information - Detect (@princechaddha, @rxerium) [info]
- [giant-bomb] Giant Bomb User Name Information - Detect (@princechaddha, @rxerium) [info]
- [hudsonrock] HudsonRock User Name Information - Detect (@princechaddha, @rxerium) [info]
- [kaskus] Kaskus User Name Information - Detect (@princechaddha, @rxerium) [info]
- [lastfm] Last.fm User Name Information - Detect (@princechaddha, @rxerium) [info]
- [letterboxd] Letterboxd User Name Information - Detect (@princechaddha, @rxerium) [info]
- [mixcloud] Mixcloud User Name Information - Detect (@princechaddha, @rxerium) [info]
- [monkeytype] Monkeytype User Name Information - Detect (@princechaddha, @rxerium) [info]
- [mydramalist] MyDramaList User Name Information - Detect (@princechaddha, @rxerium) [info]
- [nationstates-nation] NationStates Nation User Name Information - Detect (@princechaddha, @rxerium) [info]
- [replit] Replit User Name Information - Detect (@princechaddha, @rxerium) [info]
- [reverbnation] ReverbNation User Name Information - Detect (@princechaddha, @rxerium) [info]
- [runescape] RuneScape User Name Information - Detect (@princechaddha, @rxerium) [info]
- [scribd] Scribd User Name Information - Detect (@princechaddha, @rxerium) [info]
- [sketchfab] Sketchfab User Name Information - Detect (@princechaddha, @rxerium) [info]
- [slack] Slack User Name Information - Detect (@princechaddha, @rxerium) [info]
- [strava] Strava User Name Information - Detect (@princechaddha) [info]
- [topcoder] Topcoder User Name Information - Detect (@princechaddha, @rxerium) [info]
- [weblate] Weblate User Name Information - Detect (@princechaddha, @rxerium) [info]
- [younow] YouNow User Name Information - Detect (@princechaddha, @rxerium) [info]
- [apache-inlong-detect] Apache InLong - Detect (@icarot) [info]
- [nocobase-detect] NocoBase - Detect (@Fur1na) [info]
- [openmetadata-detect] OpenMetadata - Detect (@icarot) [info]
- [easycvr-user-info-disclosure] EasyCVR User - Information Disclosure (@dostghost) [medium]

## New Contributors
* @Sourabh-Sahu made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/12657
* @s-cu-bot made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/12749
* @oleveloper made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/12761

**Full Changelog**: https://github.com/projectdiscovery/nuclei-templates/compare/v10.2.6...v10.2.7