Loading story…
ProjectDiscovery has updated its Nuclei template set to reduce false positives in flow-based vulnerability checks by marking precondition matchers as internal. The change prevents intermediate fingerprinting and login steps from producing standalone findings, so scans report only the step that actually verifies a vulnerability. The update was submitted in pull request #16719 and affects 27 template files across multiple CVE-tracking and named detection templates.
The revised templates include checks such as wp-livechat-stored-xss, tongdaoa-auth-bypass, ektron-blog-xmlrpc-xxe, puppetdb-dashboard-unauth, doccano-default-login, vbulletin-path-disclosure, and leantime-stored-xss. ProjectDiscovery’s template documentation describes Nuclei templates as the mechanism used to define detection logic, and the pull request states the modified templates were validated against both vulnerable and patched hosts to preserve true positives while suppressing erroneous alerts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
ProjectDiscovery contributor princechaddha opened pull request #16719 to mark precondition matchers as internal in Nuclei flow templates, so fingerprint and login steps do not generate standalone findings. The PR updates 27 template files and states the changes were validated against both vulnerable and patched hosts to preserve true positives while reducing false positives.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcedocs.projectdiscovery.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ProjectDiscovery's `nuclei-templates` repository received several pull requests adding or refining detection logic for newly disclosed web vulnerabilities. Proposed templates covered **CVE-2026-0561** for cross-site scripting, **CVE-2025-69411** for a high-severity path traversal/local file read in the WordPress plugin `ioncube-tester-plus`, **CVE-2026-1405** for a critical SSRF issue in a WordPress REST API endpoint, and an unauthenticated remote command execution flaw in **Synway SMG Gateway** via `9-2radius.php`. The submissions generally reported validation against vulnerable and patched targets to reduce false positives, with several marked ready for merge pending maintainer review. The WordPress `ioncube-tester-plus` template demonstrated file disclosure through `loader-wizard.php` by abusing the `ininame` parameter to retrieve `/etc/passwd`, while the `slider-future` WordPress template showed SSRF by sending an external `image_url` to `/wp-json/slider-future/v1/upload-image/` and confirming outbound DNS interaction through OAST. The Synway SMG Gateway submission described command injection through the `radius_address` parameter reaching a `system()` call, but automated review flagged template quality problems including weak matching logic and missing metadata. Separately, a fix was proposed for the **CVE-2025-71243** template after reports of frequent false positives, replacing reflection-based checks with `md5`-based proof of code execution to improve accuracy.
Jun 29, 2026
ProjectDiscovery's `nuclei-templates` repository received two new vulnerability detection submissions: one for an **Odoo website information disclosure** issue and another for **`CVE-2026-3055`**. The Odoo template, submitted in pull request `#15693` by `aushack`, adds a check intended to identify exposed information on Odoo websites. The contributor said the template was validated against both a vulnerable target and a patched or non-vulnerable target to confirm detection accuracy and reduce false positives. A separate pull request, `#15721`, submitted by `shaikhyaser`, proposes a Nuclei template for `CVE-2026-3055`, a flaw discussed as potentially requiring a **SAML-enabled environment** and possibly involving **memory leakage**. Review comments in the repository show maintainers questioned whether the memory leak had been successfully reproduced, indicating the template's effectiveness and exploitability were still being evaluated and that the submission had not yet been merged at the time of review.
Jun 29, 2026
ProjectDiscovery's `nuclei-templates` repository received two new detection-template pull requests from contributor **pussycat0x**: one for **OpenText Filr guest access exposure** and another for **`CVE-2024-8252`**. The OpenText Filr submission proposes a template named `opentext-filr-guest-access.yaml` aimed at identifying instances where guest access is exposed, indicating a configuration or exposure check rather than a clearly documented CVE-based issue. A second pull request adds `CVE-2024-8252.yaml`, expanding Nuclei coverage for a separate vulnerability identified by CVE. In both submissions, the contributor stated the templates were validated against vulnerable and patched targets to improve detection accuracy and reduce false positives, while repository automation assigned reviewers and labels; the CVE template remained open, and automated review tooling was unable to complete analysis on at least one of the submissions during the captured review cycle.
Jun 29, 2026