Loading story…
ProjectDiscovery's nuclei-templates repository received new pull requests to detect exposed installation interfaces in ModX CMS and Revive Adserver, highlighting a common web misconfiguration that can leave setup pages accessible after deployment. The ModX submission, pull request #15757, adds a template for identifying an unfinished installation page, while pull request #15759 targets Revive Adserver instances exposing installer endpoints through two common installation wizard paths.
Both templates were submitted by DhiyaneshGeek and were described as validated against vulnerable and non-vulnerable targets to improve true-positive accuracy and reduce false positives. Automated review reported no security issues in the Revive Adserver template, and the ModX template was marked Done and Ready to merge, while the Revive Adserver detection remained open pending human review from theamanrawat.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
A GitHub pull request (#15785) was opened by pussycat0x to add an icinga-installer.yaml Nuclei template for detecting exposed Icinga installer pages. The submission states it was validated against vulnerable and patched hosts to confirm true positives and reduce false positives, and it was marked ready to merge.
A GitHub pull request (#15759) was opened by DhiyaneshGeek to add a Nuclei template for detecting exposed Revive Adserver installer pages. The template targeted common installation wizard paths and was described as validated against vulnerable and patched configurations.
A GitHub pull request (#15758) was opened by DhiyaneshGeek to add a Nuclei template for detecting unfinished AzuraCast installation pages. The submission was described as a detection template contribution and was marked ready to merge pending human review.
A GitHub pull request (#15757) was opened by DhiyaneshGeek to add a Nuclei template that detects unfinished installation pages in ModX CMS. The submission states it was validated against both vulnerable or misconfigured and patched or non-vulnerable hosts to reduce false positives.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ProjectDiscovery's `nuclei-templates` repository received new pull requests adding exposure-detection templates for **BaGet** and **Devtron**. One submission, opened by DhiyaneshGeek, adds a template for detecting BaGet exposure and was marked `verified:true`, configured with `max-request: 1`, and validated with a Shodan query. The pull request carried a verified GitHub signature, was labeled **Ready to merge**, and automated review reported no security issues in the template. A separate pull request by johnk3r adds two Devtron-focused templates: one to identify an exposed **Devtron panel** and another to detect an exposed `env-config` JavaScript file. The author said the templates were tested against both vulnerable and patched targets to improve accuracy and reduce false positives, while ProjectDiscovery's automated checks also found no security issues. Together, the submissions expand Nuclei coverage for identifying publicly exposed package management and DevOps administration assets.
Jun 29, 2026
ProjectDiscovery's `nuclei-templates` repository received community pull requests to add detection coverage for two separate product exposures: an **unauthenticated device registration** issue in **Dell Wyse Management Suite** and an exposed **MistServer Installation Wizard**. Both submissions were opened by DhiyaneshGeek and describe templates intended to help defenders identify internet-facing systems affected by these weaknesses. The Dell Wyse Management Suite template targets a security flaw that could allow device registration without authentication, while the MistServer template detects instances where the installation wizard remains exposed. In both cases, the contributor said the templates were validated against vulnerable and patched targets to improve true-positive accuracy and reduce false positives, and the MistServer submission was marked ready to merge in the repository workflow.
Jun 29, 2026
ProjectDiscovery's `nuclei-templates` repository received several pull requests adding or refining detection logic for newly disclosed web vulnerabilities. Proposed templates covered **CVE-2026-0561** for cross-site scripting, **CVE-2025-69411** for a high-severity path traversal/local file read in the WordPress plugin `ioncube-tester-plus`, **CVE-2026-1405** for a critical SSRF issue in a WordPress REST API endpoint, and an unauthenticated remote command execution flaw in **Synway SMG Gateway** via `9-2radius.php`. The submissions generally reported validation against vulnerable and patched targets to reduce false positives, with several marked ready for merge pending maintainer review. The WordPress `ioncube-tester-plus` template demonstrated file disclosure through `loader-wizard.php` by abusing the `ininame` parameter to retrieve `/etc/passwd`, while the `slider-future` WordPress template showed SSRF by sending an external `image_url` to `/wp-json/slider-future/v1/upload-image/` and confirming outbound DNS interaction through OAST. The Synway SMG Gateway submission described command injection through the `radius_address` parameter reaching a `system()` call, but automated review flagged template quality problems including weak matching logic and missing metadata. Separately, a fix was proposed for the **CVE-2025-71243** template after reports of frequent false positives, replacing reflection-based checks with `md5`-based proof of code execution to improve accuracy.
Jun 29, 2026