Loading story…
ProjectDiscovery received new Nuclei template submissions for two user-enumeration issues: CVE-2025-62512 in Piwigo and CVE-2025-59716 in ownCloud Guests. The Piwigo template targets a password-reset information leak tied to CWE-204, where observable differences in responses can reveal whether an account exists. Automated review marked the template as medium severity and said it had been validated against both vulnerable and patched targets, but warned that its current matcher logic is too generic and should include Piwigo-specific indicators such as a Piwigo string or the pwg_ cookie prefix to reduce false positives.
A separate review of the ownCloud Guests template found more serious detection problems. The bot said the template matched the message "No such guest user" for a random nonexistent email, behavior seen on both vulnerable and patched systems, meaning it would not reliably confirm enumeration and could produce false positives. Review guidance said a valid check would need version-based detection or multi-request behavioral testing that compares responses for valid pending guest emails against invalid ones; otherwise, the template should be documented as endpoint detection requiring manual validation. Both pull requests were submitted by DhiyaneshGeek and routed for human review by Akokonunes.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-25, automated review concluded the ownCloud template was flawed because it matched behavior present on both vulnerable and patched systems. The review said proper verification would require comparing responses for valid pending guest emails versus invalid ones, or using version-based/manual validation approaches.
On 2026-03-25, a pull request proposed a Nuclei template for detecting the ownCloud Guests user enumeration issue. The pull request remained open and was sent for human review.
On 2026-03-24, automated review assessed the Piwigo template as medium severity and warned that its matcher logic was too generic, risking false positives. The review recommended adding Piwigo-specific identifiers such as a Piwigo string or pwg_ cookie prefix.
On 2026-03-24, a pull request added a Nuclei template to detect Piwigo user enumeration via password reset. The submission stated the template had been validated against both vulnerable and patched targets, and a human review was requested.
A user enumeration vulnerability in Piwigo's password reset functionality was identified and assigned CVE-2025-62512. The issue is associated with observable response discrepancies consistent with CWE-204.
A user enumeration vulnerability affecting ownCloud Guests was identified and assigned CVE-2025-59716. The issue involves distinguishing valid pending guest emails from invalid ones through behavioral differences in responses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ProjectDiscovery contributors opened and advanced Nuclei template pull requests for two newly tracked vulnerabilities: **`CVE-2026-4257`**, a **server-side template injection** issue in the **WordPress Contact Form by Supsystic** plugin, and **`CVE-2026-33032`**, a **broken access control** flaw in **Nginx UI**. The GitHub activity shows template development intended to support detection of both issues, with one pull request referencing a new `CVE-2026-4257.yaml` file and another marked ready to merge for the Nginx UI vulnerability. The available records are limited to repository metadata and do not include technical write-ups, affected version ranges, exploitation details, or vendor remediation guidance. Even so, the publication of detection content for these CVEs indicates that security researchers are operationalizing checks for exposed systems, and defenders using Nuclei should watch for template releases covering both the WordPress plugin SSTI and the Nginx UI authorization weakness.
Jun 29, 2026
ProjectDiscovery's `nuclei-templates` repository received several pull requests adding or refining detection logic for newly disclosed web vulnerabilities. Proposed templates covered **CVE-2026-0561** for cross-site scripting, **CVE-2025-69411** for a high-severity path traversal/local file read in the WordPress plugin `ioncube-tester-plus`, **CVE-2026-1405** for a critical SSRF issue in a WordPress REST API endpoint, and an unauthenticated remote command execution flaw in **Synway SMG Gateway** via `9-2radius.php`. The submissions generally reported validation against vulnerable and patched targets to reduce false positives, with several marked ready for merge pending maintainer review. The WordPress `ioncube-tester-plus` template demonstrated file disclosure through `loader-wizard.php` by abusing the `ininame` parameter to retrieve `/etc/passwd`, while the `slider-future` WordPress template showed SSRF by sending an external `image_url` to `/wp-json/slider-future/v1/upload-image/` and confirming outbound DNS interaction through OAST. The Synway SMG Gateway submission described command injection through the `radius_address` parameter reaching a `system()` call, but automated review flagged template quality problems including weak matching logic and missing metadata. Separately, a fix was proposed for the **CVE-2025-71243** template after reports of frequent false positives, replacing reflection-based checks with `md5`-based proof of code execution to improve accuracy.
Jun 29, 2026
ProjectDiscovery's `nuclei-templates` repository received two new vulnerability detection submissions: one for an **Odoo website information disclosure** issue and another for **`CVE-2026-3055`**. The Odoo template, submitted in pull request `#15693` by `aushack`, adds a check intended to identify exposed information on Odoo websites. The contributor said the template was validated against both a vulnerable target and a patched or non-vulnerable target to confirm detection accuracy and reduce false positives. A separate pull request, `#15721`, submitted by `shaikhyaser`, proposes a Nuclei template for `CVE-2026-3055`, a flaw discussed as potentially requiring a **SAML-enabled environment** and possibly involving **memory leakage**. Review comments in the repository show maintainers questioned whether the memory leak had been successfully reproduced, indicating the template's effectiveness and exploitability were still being evaluated and that the submission had not yet been merged at the time of review.
Jun 29, 2026