Starstruk Logo MarkStarstruk

v10.4.8

projectdiscovery/nuclei-templatesv10.4.8Aug 24, 2026by princechaddha

AI Summary

This release adds 112 new templates and 101 CVEs, featuring critical vulnerabilities such as Metabase SQL Injection, Adobe Commerce Identity Switch, and JetBrains TeamCity RCE.

Key Highlights

  • Metabase Unauthenticated SQL Injection (CVE-2026-72898)
  • Adobe Commerce/Magento Customer Session Identity Switch (CVE-2026-71362)
  • JetBrains TeamCity RCE (CVE-2026-63077)
  • Microsoft SharePoint Server WS-Federation Deserialization RCE (CVE-2026-58644)
  • Gitea Unauthenticated Arbitrary File Read (CVE-2026-59774)

New Features

  • CVE-2026-72898 Metabase - Unauthenticated SQL Injection
  • CVE-2026-71362 Adobe Commerce/Magento - Customer Session Identity Switch
  • CVE-2026-63077 JetBrains TeamCity - Remote Code Execution
  • CVE-2026-58644 Microsoft SharePoint Server - WS-Federation Deserialization RCE
  • CVE-2026-59774 Gitea - Unauthenticated Arbitrary File Read
  • Refactored Argo CD and Airflow templates
  • Fixed false negatives in 27 flow templates

Full Release Notes

### New Templates Added: `112` | CVEs Added: `101` | First-time contributions: `22`

### 🔥 Release Highlights 🔥
- [CVE-2026-72898] Metabase - Unauthenticated SQL Injection (@0x_Akoko, @pdteam) [critical] (kev) (vKEV) 🔥
- [CVE-2026-71362] Adobe Commerce/Magento - Customer Session Identity Switch (@0x_Akoko, @dinosn) [critical] 🔥
- [CVE-2026-64849] MLflow Webhook SSRF - Unauth Full-Read via Redirect Bypass (@DhiyaneshDk) [critical] (kev) (vKEV) 🔥
- [CVE-2026-64638] WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell) (@FLX | Nick Vidovic (greenhats)) [high] 🔥
- [CVE-2026-63077] JetBrains TeamCity < 2026.1.3, 2025.11.7 - RCE (@0x_Akoko, @pdteam) [critical] (kev) (vKEV) 🔥
- [CVE-2026-59774] Gitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File Read (@ashish-cybersec) [critical] 🔥
- [CVE-2026-58644] Microsoft SharePoint Server - WS-Federation Deserialization RCE (@pdteam) [critical] (kev) (vKEV) 🔥
- [CVE-2026-57219] RabbitMQ Management - OAuth 2 Client Secret Disclosure (@aryu-ru) [high] 🔥
- [CVE-2026-56270] Flowise <= 3.0.13 - Unauth OAuth Configuration Disclosure (@0x_Akoko, @pdteam) [high] (vKEV) 🔥
- [CVE-2026-53576] Kestra <= 1.3.20 - Remote Code Execution (@0x_Akoko, @pdteam, @aryu-ru) [critical] (vKEV) 🔥
- [CVE-2026-52806] Gogs <= 0.14.2 - Auth RCE via git rebase Argument Injection (@DhiyaneshDk, @pdteam) [critical] (vKEV) 🔥
- [CVE-2026-49049] JoomShaper Helix3 <=3.1.0 - Unauth Arbitrary JSON File Write (@DhiyaneshDk, @pdteam) [high] (vKEV) 🔥
- [CVE-2026-48939] Joomla iCagenda < 3.9.10 - Unauth Arbitrary File Upload RCE (@0x_Akoko) [critical] (kev) (vKEV) 🔥
- [CVE-2026-40217] LiteLLM < 1.25.0 - Remote Code Execution (@ritikchaddha) [high] (vKEV) 🔥
- [CVE-2026-34908] UniFi OS - Authentication Bypass via Path Traversal (..%2f) (@Boreas37) [critical] (kev) (vKEV) 🔥
- [CVE-2026-20896] Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Auth Bypass (@prithvee07) [critical] (vKEV) 🔥
- [CVE-2026-19478] GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation (@0x_Akoko, @DhiyaneshDk) [critical] (vKEV) 🔥

## What's Changed

**Bug Fixes**
* Corrected an unclosed string literal in the CVE-2026-0558 dsl matcher (PR #16950).
* Fixed a broken matcher in the newly added CVE-2026-3395 template (PR #16886).
* Fixed the username key structure in mysql-empty-password.yaml (PR #16939).
* Fixed indentation in kubernetes-metrics.yaml (PR #16934).
* Added the missing capture group to regex extractors in oracle-containers-panel,
  smtp-credentials-exposure and springboot-x-application-context (PR #16663).
* Corrected the max-request counter for CVE-2021-40822 (PR #16875).
* Corrected email and password variable names in CVE-2025-68613 (PR #16918).
* Renamed Wix-detect.yaml, cve-2026-44338.yaml and CVE-2026-44381.yaml to match the
  naming convention (PRs #16731, #16729, #16730).
* Moved 22 invalid or rejected CVE templates to vulnerabilities (PR #16889, Issue #16115).
* Removed CVE-2024-28752.yaml (PR #16745).
 
**False Negatives**
* CVE-2017-5521, CVE-2017-7615 and CVE-2020-23575 — regexes were placed in word matchers, so these templates could never fire (PR #16666).
* nh-c2 — corrected a dsl matcher that could never match (PR #16739).
* CVE-2026-21858 — added a /rest/sentry.js fallback to detect n8n 1.65.0 through  1.111.x (PR #16888).
* CVE-2025-14847 — now detects vulnerable MongoDB 8.0.x via buildinfo read-size truncation (PR #16741).
* CVE-2025-32969 — removed an incorrect content_type matcher that suppressed matches (PR #16704).
* CVE-2023-37629 — closed the filename quote before the .php extension so the payload is well formed (PR #16709).
  
**False Positives**
  * CVE-2025-29927 — added negative matchers so WAF block pages returning HTTP 200 no longer match (PR #16870, Issue #16782).
  * wp-vr-view-xss and vrview-xss — no longer fire on hosts that escape the payload (PR #16912).
  * wordpress-eol — tightened an over-broad version regex (PR #16752).
  * CVE-2021-24139 — both conditions must now match rather than either (PR #16748).
  * Marked precondition matchers internal across 27 flow templates so setup-stage matches no longer report as findings (PR #16719).
  * CVE-2024-0200 — marked the setup-stage matchers internal (PR #16670).

**Enhancements**
* Added the intrusive tag to 43 printer vulnerability, misconfiguration, CVE and default-login templates (PR #16908).
* Severity audit: raised 9 info-level templates based on independent CVE, CWE and vendor precedent (PR #16759).
* Promoted dahua-eims-rce.yaml to CVE-2024-13985 with updated tags and regex (PR #16873).
* Upgraded showdoc CNVD-2020-26585 to CVE-2025-0520 with improved logic (PR #16879).
* Extended milvus-detect.yaml to fingerprint Milvus via the :9091 healthz endpoint (PR #16754).
* Added response-validity error checks to snmpv3-detect (PR #16753).
* Refactored the Argo CD template (PR #16780).
* Refactored the Airflow template (PR #16703).
* Added new paths to htaccess-config.yaml (PR #16706).
* Updated the WSDL API path (PR #16880).
* Updated CVE-2022-29013.yaml (PR #16938) and CVE-2026-63030.yaml (PR #16682).
* Updated the CVE-2024-57726 version check (PR #16914) and CVE-2026-64849 (PR #16924).
* Metadata refresh across CVE-2024-57726, lg-nas-rce, ntopng-auth-bypass and tp-link-wr840n-auth-bypass (PR #16915).                                                                                                  

## Templates Added
- [CVE-2026-72898] Metabase - Unauthenticated SQL Injection (@0x_Akoko, @pdteam) [critical] (kev) (vKEV) 🔥
- [CVE-2026-71362] Adobe Commerce/Magento - Customer Session Identity Switch (@0x_Akoko, @dinosn) [critical] 🔥
- [CVE-2026-71209] Audiobookshelf - Authentication Bypass (@str4k3r) [critical]
- [CVE-2026-69251] Flowise < 3.1.3 - Remote Code Execution (@1dayexploit) [critical]
- [CVE-2026-69084] SiYuan - SQL Execution (@Boreas37) [critical]
- [CVE-2026-67208] Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console (@str4k3r) [critical]
- [CVE-2026-65919] Meshery <1.0.57 - Arbitrary File Read (@str4k3r) [high]
- [CVE-2026-65442] FormCraft3 <= 3.9.15 - Server-Side Request Forgery (@DhiyaneshDk) [high] (vKEV)
- [CVE-2026-64849] MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass (@DhiyaneshDk) [critical] (kev) (vKEV) 🔥
- [CVE-2026-64638] WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell) (@FLX | Nick Vidovic (greenhats)) [high] 🔥
- [CVE-2026-63077] JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution (@0x_Akoko, @pdteam) [critical] (kev) (vKEV) 🔥
- [CVE-2026-61808] LightRAG <= 1.5.4 - Missing Authentication (@str4k3r) [high]
- [CVE-2026-61511] vBulletin 6.x - Remote Code Execution (@0x_Akoko) [critical]
- [CVE-2026-59774] Gitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File Read (@ashish-cybersec) [critical] 🔥
- [CVE-2026-58644] Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE (@pdteam) [critical] (kev) (vKEV) 🔥
- [CVE-2026-58138] Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution (@aryu-ru) [critical] (vKEV)
- [CVE-2026-57827] RSFiles! for Joomla - Arbitrary File Upload (@omarkurt) [critical]
- [CVE-2026-57219] RabbitMQ Management - OAuth 2 Client Secret Disclosure (@aryu-ru) [high] 🔥
- [CVE-2026-56270] Flowise <= 3.0.13 - Unauthenticated OAuth Configuration Disclosure (@0x_Akoko, @pdteam) [high] (vKEV) 🔥
- [CVE-2026-56265] Crawl4AI < 0.8.7 - Hardcoded JWT Signing Key Authentication Bypass (@prithvee07) [critical]
- [CVE-2026-55224] MineAdmin < 3.2.0-alpha.2 - Plugin Path Traversal to RCE (@afanti) [high]
- [CVE-2026-55087] Etherpad 2.1.0 <= 3.0.0 - Cross-Site Scripting (@Haseeb-1698) [medium]
- [CVE-2026-54917] SeaweedFS <= 4.29 - Path Traversal File Write (@Haseeb-1698, @DhiyaneshDk) [high]
- [CVE-2026-53976] OpenChamber <1.13.0 - Unauthenticated Arbitrary File Read (@str4k3r) [critical]
- [CVE-2026-53755] crawl4ai < 0.8.9 - Server Side Request Forgery (@str4k3r) [high]
- [CVE-2026-53753] Crawl4AI <= 0.8.6 - Remote Code Execution (@aryu-ru, @q1uf3ng, @August829) [critical]
- [CVE-2026-53629] GLPI - Blind SQL Injection in History Log Filter (LogBleed) (@Boreas37) [high]
- [CVE-2026-53576] Kestra <= 1.3.20 - Remote Code Execution (@0x_Akoko, @pdteam, @aryu-ru) [critical] (vKEV) 🔥
- [CVE-2026-53519] Nezha Dashboard < 2.0.13 - Path Traversal (@Aryu-RU, @str4k3r) [critical]
- [CVE-2026-52806] Gogs <= 0.14.2 - Authenticated RCE via git rebase Argument Injection (@DhiyaneshDk, @pdteam) [critical] (vKEV) 🔥
- [CVE-2026-50160] Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite (@str4k3r) [critical]
- [CVE-2026-49069] WPZOOM Portfolio <= 1.4.21 - Reflected Cross-Site Scripting (@aryu-ru) [high]
- [CVE-2026-49049] JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write (@DhiyaneshDk, @pdteam) [high] (vKEV) 🔥
- [CVE-2026-48939] Joomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCE (@0x_Akoko) [critical] (kev) (vKEV) 🔥
- [CVE-2026-48030] Pheditor 2.0.1-2.0.3 - OS Command Injection (@juoum00000) [critical]
- [CVE-2026-45695] Kopia Server 0.23.0 - Remote Code Execution (@kenlacroix) [critical]
- [CVE-2026-45332] Automad < 2.0.0-beta.28 - Unauthenticated Admin Password Hash Disclosure (@str4k3r) [high]
- [CVE-2026-42461] Arcane < 1.18.0 - Unauthenticated Template and Env Disclosure (@str4k3r) [high]
- [CVE-2026-41432] New API < v0.12.10 - Stripe Webhook Bypass (@str4k3r) [high]
- [CVE-2026-41042] Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution (@buzhimingdeaikun) [critical]
- [CVE-2026-40280] Gotenberg <= 8.30.1 - Server Side Request Forgery (@str4k3r) [critical]
- [CVE-2026-40217] LiteLLM < 1.25.0 - Remote Code Execution (@ritikchaddha) [high] (vKEV) 🔥
- [CVE-2026-35037] Ech0 < 4.2.8 - Server-Side Request Forgery (@fineman999) [high]
- [CVE-2026-34976] Dgraph <=v25.3.0 - Admin Mutation Missing Authorization (@str4k3r) [critical]
- [CVE-2026-34908] UniFi OS - Authentication Bypass via Path Traversal (..%2f) (@Boreas37) [critical] (kev) (vKEV) 🔥
- [CVE-2026-32255] Kan <= 0.5.4 - Server-Side Request Forgery (@prithvee07) [high]
- [CVE-2026-30965] Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration (@str4k3r, @0x_Akoko) [critical]
- [CVE-2026-27796] Homarr < 1.54.0 - Information Disclosure (@str4k3r) [medium]
- [CVE-2026-27542] WooCommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Privilege Escalation (@theamanrawat, @pdresearch) [critical] (vKEV)
- [CVE-2026-26217] Crawl4AI < 0.8.0 - Local File Inclusion (@str4k3r, @Aryu-RU) [critical]
- [CVE-2026-25895] FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write (@prithvee07) [critical] (vKEV)
- [CVE-2026-25231] FileRise <= 3.3.0 - Unauthenticated File Read (@str4k3r) [high]
- [CVE-2026-20896] Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Authentication Bypass (@prithvee07) [critical] (vKEV) 🔥
- [CVE-2026-19900] LB-LINK Routers - Unauthenticated Command Injection (@0x_Akoko) [critical]
- [CVE-2026-19598] Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX Router (@DhiyaneshDk) [critical] (vKEV)
- [CVE-2026-19478] GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation (@0x_Akoko, @DhiyaneshDk) [critical] (vKEV) 🔥
- [CVE-2026-17594] Sonatype Nexus Repository < 3.95.0 - Privilege Escalation via Repository Format Mismatch (@1dayexploit) [high]
- [CVE-2026-17532] Seraphinite Accelerator <= 2.29.18 - Cross-Site Scripting (@0x_Akoko) [medium]
- [CVE-2026-17505] WordPress TranslatePress < 3.2.6 - Cross-Site Scripting (@0x_Akoko) [medium]
- [CVE-2026-16268] Newsletters < 4.16 - Unauthenticated SSRF via SNS Bounce Handler (@str4k3r) [medium]
- [CVE-2026-15826] User Profile Builder 3.16.4 - Unauthenticated Authentication Bypass (@theamanrawat) [critical] (vKEV)
- [CVE-2026-15733] WGDashboard <= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read (@str4k3r, @0x_Akoko) [critical]
- [CVE-2026-14894] WordPress Super Forms <= 6.3.313 - Arbitrary File Upload (@pdteam, @0x_Akoko) [critical] (vKEV)
- [CVE-2026-14483] Realtyna Organic IDX/WPL <= 5.2.0 - Unauthenticated Arbitrary File Upload (@str4k3r) [critical]
- [CVE-2026-13147] WordPress Kirki < 6.0.12 - Server-Side Request Forgery (@0x_Akoko) [high]
- [CVE-2026-13001] Podlove Podcast Publisher <= 4.5.1 - Arbitrary File Upload (@aryu-ru) [critical]
- [CVE-2026-12394] WordPress MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation (@str4k3r) [critical]
- [CVE-2026-11387] SMS Alert – SMS & OTP for WooCommerce - Privilege Escalation (@str4k3r) [critical]
- [CVE-2026-10768] Drupal LocalGov Workflows < 1.6.0 - Information Disclosure (@str4k3r) [high]
- [CVE-2026-9506] Bagisto <= 2.4.1 - Unauthenticated Arbitrary File Read (@str4k3r) [high]
- [CVE-2026-8857] MediaWiki EasyTimeline - Code Injection RCE (@pdteam) [high]
- [CVE-2026-8237] Concrete CMS <= 9.5.0 - Unauthenticated Conversation Message Disclosure (IDOR) (@Pauullamm) [medium]
- [CVE-2026-8236] Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure (@str4k3r) [medium]
- [CVE-2026-6854] My Calendar < 3.7.9 - Unauthenticated SQL Injection (@Pauullamm) [high]
- [CVE-2026-6826] Concrete CMS <9.5.1 - Unauthenticated File Usage Disclosure (@str4k3r) [medium]
- [CVE-2026-5032] W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure (@prithvee07) [high]
- [CVE-2026-4060] Geo Mashup <= 1.13.18 - SQL Injection (@ydking0911) [high]
- [CVE-2026-3576] Planyo Online Reservation System <= 3.0 - Arbitrary File Read (@aryu-ru) [high]
- [CVE-2026-3395] MaxSite CMS <=109.1 - Remote Code Execution (@ritikchaddha) [high] (vKEV)
- [CVE-2026-3001] Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting (@coffeetaro_12) [medium]
- [CVE-2026-2614] MLflow <= 3.9.0 - Arbitrary File Read (@str4k3r) [high]
- [CVE-2026-1115] parisneo/lollms < 2.2.0 - Authenticated Stored XSS (@str4k3r) [high]
- [CVE-2026-0717] LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings Disclosure (@str4k3r) [medium]
- [CVE-2026-0558] LolLMS <= 2.2.0 - Unauthenticated File Upload (@KoungQ) [critical]
- [CVE-2025-71324] Flowise - Path Traversal (@theamanrawat, @pdteam) [high] (vKEV)
- [CVE-2025-26399] SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE (@popy21) [critical] (kev) (vKEV) 🔥
- [CVE-2025-20282] Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload (@0x_Akoko, @pdteam) [critical] (vKEV) 🔥
- [CVE-2025-13528] Feedback Modal for Website <= 1.0.1 - Unauthenticated Feedback Export (@coffeetaro_12) [medium]
- [CVE-2025-13342] DynamiApps Frontend Admin <= 3.28.20 - Unauthenticated Arbitrary Options Update (@0x_Akoko) [critical] (vKEV)
- [CVE-2025-11953] React Native Community CLI - Unauthenticated OS Command Injection (@aryu-ru) [critical] (kev) (vKEV) 🔥
- [CVE-2025-0520] ShowDoc - Remote Code Execution (@pikpikcu, @Co5mos, @PapButfly) [critical] (vKEV)
- [CVE-2024-57726] SimpleHelp <= 5.5.7 - Privilege Escalation (@popy21) [critical] (kev) (vKEV) 🔥
- [CVE-2024-56064] WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload to RCE (@princechaddha) [critical] (vKEV)
- [CVE-2024-55890] D-Tale <= 3.16.0 - Pre-Auth RCE via Pandas Query Injection (@0x_Akoko) [critical] (vKEV)
- [CVE-2024-37014] Langflow <= 1.0.12 - Remote Code Execution (@0x_Akoko, @pdteam) [critical] (vKEV) 🔥
- [CVE-2024-13985] Dahua EIMS - Unauthenticated Remote Code Execution via capture_handle (@DhiyaneshDk) [critical] (vKEV)
- [CVE-2023-25826] OpenTSDB <= 2.4.1 - Unauthenticated RCE via Gnuplot Injection (@aryu-ru) [critical]
- [CVE-2022-1281] Photo Gallery WordPress v1.6.3 - SQL Injection (@theamanrawat) [critical] (vKEV)
- [CVE-2020-10204] Sonatype Nexus Repository Manager 3 - Remote Code Execution (@mmadersbacher) [high]
- [CVE-2019-1003030] Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization (@princechaddha) [critical] (kev) (vKEV) 🔥
- [CVE-2015-7501] Red Hat JBoss - Insecure Deserialization (@pdteam, @DhiyaneshDk) [critical] (vKEV) 🔥
- [net-vision-default-login] Net Vision UPS Monitor - Default Login (@Th3l0newolf) [high]
- [3xui-default-login] 3X-UI - Default Login (@mapioe) [high]
- [cyberstrikeai-panel] Ed1s0nZ CyberStrikeAI - Panel (@darses) [info]
- [easy-timepro-panel] easy TimePro Login - Panel (@Th3l0newolf) [info]
- [miniflux-panel] Miniflux - Login Panel (@ashish-cybersec) [info]
- [shiori-panel] Shiori Bookmark Manager - Detect (@johnk3r) [info]
- [zulip-login-panel] Zulip Login Panel (@Th3l0newolf) [info]
- [claude-code-agents] Claude Code Subagent Configuration - Exposure (@shadowhunter-92) [low]
- [firebase-auth-fingerprint] Firebase Authentication - Fingerprint (@zomasec, @zomaxsec) [info]
- [openshift-detect] OpenShift Monitoring Plugin - Detect (@righettod) [info]
- [geoserver-jsonarraycontains-sqli] GeoServer jsonArrayContains CQL Filter - SQL Injection (@portbuster1337, @DhiyaneshDk) [critical]

## New Contributors
* @juoum00000 made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16721
* @coffee0127 made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16709
* @Boreas37 made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16809
* @diedromeo made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16741
* @str4k3r made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16772
* @1dayexploit made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16749
* @Mapioe made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16866
* @ashish-cybersec made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16816
* @Pauullamm made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16812
* @owlsight203 made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16870
* @andrew207 made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16752
* @M818872 made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16718
* @hiddingtrojans made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16754
* @PalmOla made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16753
* @Popy21 made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16868
* @PapButfly made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16879
* @br-flo made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16759
* @prithvee07 made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16732
* @spcuftwadejacobhurst made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16929
* @buzhimingdeaikun made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16928
* @mmadersbacher made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16902
* @Haseeb-1698 made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16898

**Full Changelog**: https://github.com/projectdiscovery/nuclei-templates/compare/v10.4.7...v10.4.8