ProjectDiscovery Stories

CVE-2025-29927: Next.js Middleware Authorization Bypass - Technical Analysis

Next.js is an open-source web framework built by Vercel that powers React-based apps with features like server-side and static rendering. Recently, a critical vulnerability (CVE) was disclosed that lets attackers bypass middleware-based authorization checks. The issue was originally discovered and analyzed by Rachid Allam (zhero). In this blog, we’ll break down the vulnerability and walk through their research and will create a Nuclei template to help you detect it across your assets. The vulne

Vulnerability Research

CVE-2024-53991 - Discourse Backup Disclosure: Rails send_file Quirk

Introduction Modern web applications rely on middleware and web server configurations to efficiently handle file delivery while maintaining security. In the Ruby ecosystem, the send_file method in Rack and Rails is a widely used mechanism that can offload file serving to web servers like Nginx and Apache, improving performance and scalability. However, when used in conjunction with Nginx’s internal directive, a feature designed to restrict access to sensitive resources, unexpected security flaw

Vulnerability Research

Introducing Nuclei Templates Labs: A Hands-on Security Testing Playground

🚀 What is Nuclei Templates Labs? At ProjectDiscovery, we are always looking for ways to make security testing more accessible and practical. Nuclei Templates Labs is a collection of vulnerable environments bundled with ready-to-use Nuclei templates, designed for both security researchers and learners. This repository serves as a real-world security testing playground, allowing users to explore vulnerabilities, understand their impact, and learn how to detect them using Nuclei. By combining v

Amplify automates security testing with ProjectDiscovery’s precision

Amplify automated security testing with ProjectDiscovery, reducing workload, improving vulnerability management, and enabling scalable scans. By converting bug bounty reports into tests, they ensure patched issues don’t return, empowering QA teams to enhance security across applications.

Case Studies

CSP Bypass (DAST) - Nuclei Templates v10.1.5 🎉

We're excited to introduce our new CSP Bypass (DAST) Templates designed to enhance security testing capabilities. This release enables comprehensive evaluation of Content Security Policy vulnerabilities and misconfigurations. In this post, we'll explore automating CSP Bypass Testing, creating custom security checks, and sharing results through the PDCP Cloud for efficient team collaboration. For those specifically interested in using the CSP Bypass templates, you can jump directly to the end of

How ConnectWise streamlined vulnerability detection with ProjectDiscovery

ConnectWise chose ProjectDiscovery over Tenable Cloud to streamline vulnerability detection across 20,000+ AWS instances. By leveraging ProjectDiscovery’s automation and scalability, they achieved efficient, high-volume security monitoring without operational overhead.

Case Studies

February 2025 Newsletter

First, we’re so excited to announce that we’ve reached 100,000 GitHub stars across our OSS projects! This wouldn’t have been possible without everyone who’s contributed, used our tools, and offered their support along the way. Thank you, and we can’t wait to keep building with you! 🎉

Announcements

Reinventing custom detections and vulnerability management

We’re making custom vulnerability detection easier with an AI-powered template editor, full-text search, and auto-regressions. These additions help security teams create, refine, and validate detections faster, staying ahead of threats with less manual work.

Announcements

Engineering the future of vulnerability detection

We’re building the future of Nuclei-powered scanning - 35x faster, with automated scheduling, smart alerts, and streamlined triaging. With built-in internal scanning, it’s designed for modern security teams who need speed, scale, and precision.

Announcements

Scaling for the enterprise

Large organizations manage a complex web of internet exposures, spanning subsidiaries, multi-cloud environments, and distributed deployments. Security teams need visibility, collaboration, and control to manage their digital footprint at scale. With this launch, we’re introducing a suite of new enterprise-focused features: an improved free experience, streamlined onboarding, advanced reporting, and essential controls like SAML SSO and audit logs. These updates make it easier for enterprises to

Announcements

The new way to discover your exposure

We've completely rebuilt our infrastructure for exposure discovery and management at the internet level, introducing new tools and AI workflows. This major update is designed for our entire community - from individual users to large security teams.

Announcements

DeepSeek’s Data Breach: Could ProjectDiscovery’s Cloud Have Prevented the Hack?

Last week, DeepSeek made headlines with R1, an open-source model positioned as a competitor to OpenAI’s Model o1. What set R1 apart wasn’t just its capabilities - it was the claim that DeepSeek trained it with significantly fewer GPUs. It challenged conventional wisdom around the compute requirements for large-scale model training and even caused a small stock market selloff. Amid the hype, a security incident surfaced: researchers gained access to DeepSeek’s internal databases. The breach repo

Vulnerability Research

ProjectDiscovery Stories

CVE-2025-29927: Next.js Middleware Authorization Bypass - Technical Analysis

CVE-2024-53991 - Discourse Backup Disclosure: Rails send_file Quirk

Introducing Nuclei Templates Labs: A Hands-on Security Testing Playground

Amplify automates security testing with ProjectDiscovery’s precision

CSP Bypass (DAST) - Nuclei Templates v10.1.5 🎉

How ConnectWise streamlined vulnerability detection with ProjectDiscovery

February 2025 Newsletter

Reinventing custom detections and vulnerability management

Engineering the future of vulnerability detection

Scaling for the enterprise

The new way to discover your exposure

DeepSeek’s Data Breach: Could ProjectDiscovery’s Cloud Have Prevented the Hack?

Monitor your infrastructure

Talk to sales

Platform

Open Source

Resources

Company