ProjectDiscovery Stories

March 2025 Newsletter

Our highlight this month? A massive addition of 359 brand-new Nuclei templates—all thanks to our incredible community contributors. Dive into the details of this impressive milestone in our dedicated newsletter and find out exactly what's new!

Announcements

CrushFTP Authentication Bypass - CVE-2025-2825

Enterprise file transfer solutions are critical infrastructure for many organizations, facilitating secure data exchange between systems and users. CrushFTP, a widely used multi-protocol file transfer server, offers an extensive feature set including Amazon S3-compatible API access. However, a critical vulnerability (CVE-2025-2825) was discovered in versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 that allows unauthenticated attackers to bypass authentication and gain unauthorized access

Vulnerability Research

IngressNightmare: Unauth RCE in Ingress NGINX (CVE-2025-1974)

A critical vulnerability (CVE-2025-1974) was recently discovered in the Kubernetes Ingress-NGINX Controller that allows unauthenticated remote code execution (RCE) on the ingress controller pod. Originally discovered by the Wiz research team (Nir Ohfeld, Ronen Shustin, Sagi Tzadik, Hillai Ben-Sasson) in late 2024 and disclosed in March 2025, CVE-2025-1974 is part of a series of vulnerabilities collectively called IngressNightmare. If you’re specifically looking to use the IngressNightmare dete

Vulnerability Research

CVE-2025-29927: Next.js Middleware Authorization Bypass - Technical Analysis

Next.js is an open-source web framework built by Vercel that powers React-based apps with features like server-side and static rendering. Recently, a critical vulnerability (CVE) was disclosed that lets attackers bypass middleware-based authorization checks. The issue was originally discovered and analyzed by Rachid Allam (zhero). In this blog, we’ll break down the vulnerability and walk through their research and will create a Nuclei template to help you detect it across your assets. The vulne

Vulnerability Research

CVE-2024-53991 - Discourse Backup Disclosure: Rails send_file Quirk

Introduction Modern web applications rely on middleware and web server configurations to efficiently handle file delivery while maintaining security. In the Ruby ecosystem, the send_file method in Rack and Rails is a widely used mechanism that can offload file serving to web servers like Nginx and Apache, improving performance and scalability. However, when used in conjunction with Nginx’s internal directive, a feature designed to restrict access to sensitive resources, unexpected security flaw

Vulnerability Research

Introducing Nuclei Templates Labs: A Hands-on Security Testing Playground

🚀 What is Nuclei Templates Labs? At ProjectDiscovery, we are always looking for ways to make security testing more accessible and practical. Nuclei Templates Labs is a collection of vulnerable environments bundled with ready-to-use Nuclei templates, designed for both security researchers and learners. This repository serves as a real-world security testing playground, allowing users to explore vulnerabilities, understand their impact, and learn how to detect them using Nuclei. By combining v

Amplify automates security testing with ProjectDiscovery’s precision

Amplify automated security testing with ProjectDiscovery, reducing workload, improving vulnerability management, and enabling scalable scans. By converting bug bounty reports into tests, they ensure patched issues don’t return, empowering QA teams to enhance security across applications.

Case Studies

CSP Bypass (DAST) - Nuclei Templates v10.1.5 🎉

We're excited to introduce our new CSP Bypass (DAST) Templates designed to enhance security testing capabilities. This release enables comprehensive evaluation of Content Security Policy vulnerabilities and misconfigurations. In this post, we'll explore automating CSP Bypass Testing, creating custom security checks, and sharing results through the PDCP Cloud for efficient team collaboration. For those specifically interested in using the CSP Bypass templates, you can jump directly to the end of

How ConnectWise streamlined vulnerability detection with ProjectDiscovery

ConnectWise chose ProjectDiscovery over Tenable Cloud to streamline vulnerability detection across 20,000+ AWS instances. By leveraging ProjectDiscovery’s automation and scalability, they achieved efficient, high-volume security monitoring without operational overhead.

Case Studies

February 2025 Newsletter

First, we’re so excited to announce that we’ve reached 100,000 GitHub stars across our OSS projects! This wouldn’t have been possible without everyone who’s contributed, used our tools, and offered their support along the way. Thank you, and we can’t wait to keep building with you! 🎉

Announcements

Reinventing custom detections and vulnerability management

We’re making custom vulnerability detection easier with an AI-powered template editor, full-text search, and auto-regressions. These additions help security teams create, refine, and validate detections faster, staying ahead of threats with less manual work.

Announcements

Engineering the future of vulnerability detection

We’re building the future of Nuclei-powered scanning - 35x faster, with automated scheduling, smart alerts, and streamlined triaging. With built-in internal scanning, it’s designed for modern security teams who need speed, scale, and precision.

Announcements

ProjectDiscovery Stories

March 2025 Newsletter

CrushFTP Authentication Bypass - CVE-2025-2825

IngressNightmare: Unauth RCE in Ingress NGINX (CVE-2025-1974)

CVE-2025-29927: Next.js Middleware Authorization Bypass - Technical Analysis

CVE-2024-53991 - Discourse Backup Disclosure: Rails send_file Quirk

Introducing Nuclei Templates Labs: A Hands-on Security Testing Playground

Amplify automates security testing with ProjectDiscovery’s precision

CSP Bypass (DAST) - Nuclei Templates v10.1.5 🎉

How ConnectWise streamlined vulnerability detection with ProjectDiscovery

February 2025 Newsletter

Reinventing custom detections and vulnerability management

Engineering the future of vulnerability detection

Monitor your infrastructure

Talk to sales

Platform

Open Source

Resources

Company