Changelog

The Subdomain Finder now integrates getallurls (GAU) in the External APIs test, pulling in subdomain data from archived URLs and Wayback content.

This adds another layer to your discovery workflows, especially valuable for:

✅ Early-stage engagement scoping

✅ In-depth attack surface mapping

✅ Historical asset continuous monitoring with scheduled scans

SonicWall’s Secure Mobile Access 1000 Series has a newly disclosed RCE — CVE-2025-23006 (CVSSv3 9.8) that allows an unauthenticated attacker to run arbitrary code on the target.

Our Network Vulnerability Scanner can now specifically target and detect this CVE, so you can:

• Flag affected assets in external infrastructure reviews

• Stay ahead of exposure with your continuous monitoring flows

• Deliver remediation-ready reports for stakeholders

Sniper: Auto-Exploiter now supports three high-risk CVEs, helping you validate exploitability with just a few clicks — no manual scripting needed:

✅ CVE-2024-11635 (CVSSv3 9.8) – an RCE in WordPress File Upload plugin using the require-once PHP statement, with attacker controllable data as an argument.

✅ CVE-2025-0890 (CVSSv3 9.8) – insecure default credentials for the Telnet function in Zyxel devices allowing an attacker to fully compromise your server.

✅ CVE-2024-40891 (CVSSv3 8.8) – a post-authentication command injection vulnerability in Zyxel via Telnet.

For consultants, this means stronger deliverables and faster turnaround. For internal teams, actionable exploitability validation without time-consuming setup.

Bonus reminder: all these CVEs can be detected with our Network Scanner.

Our Network Scanner now provides fast, reliable detection for the critical Next.js vulnerability, CVE-2025-29927, so you can quickly identify affected applications.

We've streamlined the detection process to help you pinpoint and address this risk effectively.

How it works:

✅ Run a CVE-focused network vulnerability scan against your Next.js applications.

✅ The scanner will automatically check for CVE-2025-29927, highlighting vulnerable instances.

✅ Get clear, actionable results to prioritize patching and mitigation.

Dive deeper: understand and fix CVE-2025-29927

For a comprehensive understanding of the CVE-2025-29927 vulnerability, its impact, and detailed remediation steps, read our in-depth article.

This write-up includes:

• A technical breakdown of the vulnerability.

• Affected Next.js versions.

• Practical exploitation scenarios.

• Business impact examples.

• Step-by-step mitigation guidance.

This month’s Website Scanner updates help you uncover hard-to-spot web app issues faster:

📌 Redirects buried in JavaScript can slip past traditional scans. Now our scanner checks for DOM-based open redirects, giving you deeper visibility into vulnerable behavior inside the browser.

📌 See emails as standalone findings for faster review and better reporting.

📌 Found an XSS? No need to manually recreate your payload - just click “Exploit with XSS Exploiter” in the Website Scanner and capture screenshots, cookies, and request data every time it gets triggered.

Need to add a new teammate, client, or just more recipients to scan notifications or change your alerts settings? We heard you loud and clear!

Now you can edit notification settings for Scheduled Scans without recreating them from scratch.

✅ Adjust on the fly
✅ Keep your workflow flexible

Misconfigured buckets can leak versioned objects, exposing sensitive data. Our Cloud Scanner has a new finding for public AWS S3 bucket version listings, so you can:

✅ Spot dangerous misconfigs fast and remediate
✅ Support continuous secure cloud hygiene

Proof of exploitation is what separates noise from real risk. Sniper: Auto-Exploiter, our proprietary offensive tool, now supports:

• CVE-2024-50498 (CVSSv3 9.8) – an RCE in WP Query Console that affects all WordPress versions and can allow code injection.
  

Use Sniper to confirm impact and cut straight to remediation.

As always, remember that if Sniper can exploit it, our Network Scanner can detect it.

Plus, Sniper is now giving you a clearer view of payloads, responses, and proof of exploitation with the latest in our scan results UI makeover.

Our pentest robots are becoming increasingly popular for handling large-scale vulnerability assessments. And now, they're even easier to use, especially for those of you who need customized automation.

We’ve made it simpler to keep track of pentest robots scans: instead of listing all scans individually, the Scans section now displays one entry per pentest robot, making it easier to map your actions to what you see in our product.

How it works:

✅ Each pentest robot now has a single log entry, reducing clutter

✅ You can access all scan resulting from a single pentest robot accessed within its own log block

✅ Improved clarity helps you focus on results - not on tracking individual scans.

Need to prove exploitability for highly targeted CVEs beyond a shadow of a doubt?

Our proprietary offensive tool, Sniper: Auto-Exploiter, is now even more powerful, helping you get proof of exploitation for critical vulnerabilities in popular content management systems:

• CVE-2024-10924 (CVSSv3 9.8) - an RCE in the Really Simple Security WordPress plugin that can let an attacker leverage an authentication bypass and compromise your server.

• CVE-2023-41892 (CVSSv3 9.8) - a Craft CMS Unauthenticated RCE classified as a high-impact, low-complexity attack vector.

And remember: if it’s exploitable with Sniper, it’s a confirmed risk you can also detect with our Network Vulnerability Scanner.

We ran Hydra, a pentester’s favourite, and our proprietary Password Auditor against 26 web applications — including Microsoft Exchange, WordPress, and Joomla.

The comparison criteria? Their ability to:

• Identify login credentials, endpoints and parameters

• Recognize error messages & protection mechanisms

• Detect defensive measures like IP blacklisting, CAPTCHA, account lockout, and rate limiting.

The results make choosing a tool for password auditing much easier: Hydra might be a classic, but our Password Auditor is the real match for modern security defenses.

Also included in this benchmark: a step-by-step guide to bruteforcing all 26 tested apps, from WordPress to Exchange.

The UI facelift continues!

We’ve upgraded the look and feel of scan results for another important part of your security toolbox:

📌 WAF Scanner

📌 SQLi Exploiter

📌 People Hunter

📌 Subdomain Takeover

📌 Joomla Scanner

📌 ICMP Ping

📌 Whois Lookup

This means clearer findings and a better organization across the board.

To help you get eyes on the most burning security issues as fast as possible, we’ve updated the Website Scanner and the API Scanner to classify the most severe risks as Critical if their CVSSv3 score is over 9.0.

This means:

📌 More time to realistically assess business impact

📌 More accurate risk and mitigation prioritization.

Plus, this month comes with even more improvements in our Website Scanner:

• You can now test authentication with headers with the Authentication functionality, before starting a new scan for a better setup configuration.

• The Find Login Interfaces passive test now detects Basic HTTP/NTLM Authentication — helping you map authentication entry points with greater accuracy.

Surfacing critical findings with high precision is our goal with the Network Vulnerability Scanner.

That’s why it now generates critical findings if the CVSSv3 score is over 9.0, to help you prioritize and address the most urgent vulnerabilities more efficiently.

Of course, both coverage and depth are important!

Discover our latest network detections in our Vulnerability & Exploit Database, including one for CVE-2025-0282, a Remote Code Execution vulnerability in Ivanti Connect Secure.

You can now see exactly when your last scheduled scan didn’t run successfully — right from Scheduled Scans.

To help you troubleshoot, we’ve created a support article with all the common causes and how to fix them. It’s quicker to understand what happened.

Sniper: Auto-Exploiter, our proprietary offensive tool, comes with an expanding arsenal for proving exploitability for high-risk, widespread CVEs.

Just look at these new vulns for which you can get proof of exploitation:

• CVE-2024-51567  and CVE-2024-51378 (CVSSv3 9.8) — two CyberPanel RCEs that can let an attacker gain root access on a target machine.

• CVE-2024-50623 (CVSSv3 9.8) — Arbitrary File Read and Write vulnerabilities in Cleo Harmony, VLTrader, and LexiCom.

• CVE-2024-11680 (CVSSv3 9.8) — a ProjectSand Authentication Bypass vulnerability

As always, don’t forget: if it’s exploitable with Sniper, you can detect it with our Network Scanner!

We first developed Pentest Robots so you can chain multiple tools into custom, automatic testing flows.

Now, they just got simpler.

You can start a scan directly from the Pentest Robots page, targeting multiple assets in one go. Effortless and efficient!

People Hunter lets you discover email addresses and social media profiles starting from a web application — for a more accurate attack surface assessment.

Now it’s faster with these two key optimizations:

• Get results in real-time as the crawler works its ways through the target

• See external query results when the scan starts.

We’ve made one of the top 3 Pentest-Tools.com favorites even faster! 50% faster for deep scans!

Without compromising on quality, our Subdomain Finder gets results much quicker thanks to this latest improvement: loading fingerprinting tools in a more efficient way.