Loading story…
ProjectDiscovery's nuclei-templates repository received community pull requests to add detection coverage for two separate product exposures: an unauthenticated device registration issue in Dell Wyse Management Suite and an exposed MistServer Installation Wizard. Both submissions were opened by DhiyaneshGeek and describe templates intended to help defenders identify internet-facing systems affected by these weaknesses.
The Dell Wyse Management Suite template targets a security flaw that could allow device registration without authentication, while the MistServer template detects instances where the installation wizard remains exposed. In both cases, the contributor said the templates were validated against vulnerable and patched targets to improve true-positive accuracy and reduce false positives, and the MistServer submission was marked ready to merge in the repository workflow.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
On March 24, 2026, a GitHub pull request was opened to add a Nuclei template for detecting exposure of the MistServer Installation Wizard. The contribution stated the template was tested against vulnerable and patched configurations, and the pull request was marked ready for review.
On March 23, 2026, a GitHub pull request was opened in the projectdiscovery/nuclei-templates repository to add detection for an unauthenticated device registration weakness in Dell Wyse Management Suite. The submission said the template was validated against both vulnerable and patched targets to confirm accurate detection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ProjectDiscovery's `nuclei-templates` repository received new pull requests to detect exposed installation interfaces in **ModX CMS** and **Revive Adserver**, highlighting a common web misconfiguration that can leave setup pages accessible after deployment. The ModX submission, pull request `#15757`, adds a template for identifying an unfinished installation page, while pull request `#15759` targets Revive Adserver instances exposing installer endpoints through two common installation wizard paths. Both templates were submitted by **DhiyaneshGeek** and were described as validated against vulnerable and non-vulnerable targets to improve true-positive accuracy and reduce false positives. Automated review reported no security issues in the Revive Adserver template, and the ModX template was marked **Done** and **Ready to merge**, while the Revive Adserver detection remained open pending human review from **theamanrawat**.
Jun 29, 2026
ProjectDiscovery's `nuclei-templates` repository received new pull requests adding exposure-detection templates for **BaGet** and **Devtron**. One submission, opened by DhiyaneshGeek, adds a template for detecting BaGet exposure and was marked `verified:true`, configured with `max-request: 1`, and validated with a Shodan query. The pull request carried a verified GitHub signature, was labeled **Ready to merge**, and automated review reported no security issues in the template. A separate pull request by johnk3r adds two Devtron-focused templates: one to identify an exposed **Devtron panel** and another to detect an exposed `env-config` JavaScript file. The author said the templates were tested against both vulnerable and patched targets to improve accuracy and reduce false positives, while ProjectDiscovery's automated checks also found no security issues. Together, the submissions expand Nuclei coverage for identifying publicly exposed package management and DevOps administration assets.
Jun 29, 2026
ProjectDiscovery's `nuclei-templates` repository received several pull requests adding or refining detection logic for newly disclosed web vulnerabilities. Proposed templates covered **CVE-2026-0561** for cross-site scripting, **CVE-2025-69411** for a high-severity path traversal/local file read in the WordPress plugin `ioncube-tester-plus`, **CVE-2026-1405** for a critical SSRF issue in a WordPress REST API endpoint, and an unauthenticated remote command execution flaw in **Synway SMG Gateway** via `9-2radius.php`. The submissions generally reported validation against vulnerable and patched targets to reduce false positives, with several marked ready for merge pending maintainer review. The WordPress `ioncube-tester-plus` template demonstrated file disclosure through `loader-wizard.php` by abusing the `ininame` parameter to retrieve `/etc/passwd`, while the `slider-future` WordPress template showed SSRF by sending an external `image_url` to `/wp-json/slider-future/v1/upload-image/` and confirming outbound DNS interaction through OAST. The Synway SMG Gateway submission described command injection through the `radius_address` parameter reaching a `system()` call, but automated review flagged template quality problems including weak matching logic and missing metadata. Separately, a fix was proposed for the **CVE-2025-71243** template after reports of frequent false positives, replacing reflection-based checks with `md5`-based proof of code execution to improve accuracy.
Jun 29, 2026