Release Notes

🚀 New Features

• Performance Improvement: Faster and more efficient scans

🔄 Updates

• Redesign internal componenets: Improved core components for better memory and CPU management.

• Detection Rule Enhancements: Updated vulnerability checks for:

  • Vulnerable PHP Versions
  • Vulnerable Apache Tomcat Versions
  • Vulnerable Tomcat Versions
• Updated Vulnerability Definitions: Refreshed and expanded definitions to include broader test coverage.

🐛 Bug Fixes

• Fixed missed vulnerabilities:
  • XSS in Headers
  • XSS in URI
  • Open redirection
  • Path traversal in URI
• Fixed errors in dynamic JavaScript evaluation
• Fixed a rare crash that could occur during scans.
• Fixed a bug causing testing POST requests with wrong GET method

🚀 New Features

• URL Inventory CSV Export: Export all discovered URLs into a structured CSV file for easier analysis, reporting, and integration with external tools.
• Crawl Coverage Insights: Added detailed crawl coverage information to scan reports, giving better visibility into scanned vs. discovered endpoints.
• SSRF via Host Header Detection: Introduced a new test for Server-Side Request Forgery (SSRF) through manipulation of the HTTP request host header.
• Possible SSRF Detection (Host Header): Added a secondary heuristic-based test to identify potential SSRF cases in host header handling.
• Unvalidated Redirect (Host Header): New test to detect unsafe redirection behavior via host header injection.
• Cloud Metadata Disclosure Test: Detects exposure of sensitive cloud instance metadata (e.g., AWS, Azure, GCP).

🔄 Updates

• CLI Improvements: Replaced the deprecated --no-crawl option with more granular controls:

  • --crawl-depth
  • --no-discovery
  • --no-follow

  These changes provide finer control over scan behavior and crawling strategies.

• Detection Rule Enhancements: Updated vulnerability checks for:

  • Vulnerable Nginx Versions
  • Vulnerable OpenSSL Versions
  • Vulnerable Apache Tomcat Versions
  • Vulnerable WordPress Versions

• Internal Refactoring: Improved core components for better performance, maintainability, and scalability.

🐛 Bug Fixes

• Fixed an issue in the default scan configuration where the Fingerprint Detection test was not executed correctly.
• General stability improvements and minor fixes across the scanning engine.

🚀 New Features

• XML External Entity (XXE) Injection Test: Added a new test to detect XXE vulnerabilities in XML parsers and endpoints.
• React2Shell (CVE-2025-55182) Detection: Introduced a dedicated test for the React2Shell vulnerability, helping identify critical RCE risks in affected React setups.
• CLI Test Selection (sms.exe): Added a new CLI argument to explicitly specify which tests to run, enabling more targeted and efficient scans.
• Single Script Execution Mode: New capability to run a single scanning script against a list of input URLs—ideal for focused testing and research use cases.

🔄 Updates

• Detection Rule Enhancements: Updated vulnerability checks for:

  • Vulnerable OpenSSL Versions
  • Vulnerable WordPress Versions
  • Vulnerable Apache Versions
  • Vulnerable PHP Versions

• Updated Vulnerability Definitions: Refreshed and expanded definitions to include broader test coverage.

🐛 Bug Fixes

• Fixed an issue that could cause incorrect license invalidation due to system date/time changes.
• Fixed a false positive for Subresource Integrity Missing when the URL was not a network resource.

🚀 New Features

• Simplified License Transfer: You can now easily remove your SmartScanner license from one device and activate it on another.
• Request Rate Limiting: Added a configurable maximum requests per second option, giving you full control over scan intensity and reducing the risk of overwhelming target servers.
• CLI Scan Configuration Support: The CLI (sms.exe) now supports loading scan configuration file, enabling more consistent, repeatable, and automated scan setups.

⚡ Improvements

• Chromium Evaluation Performance: Significant optimizations to page evaluation using Chromium for faster and more efficient scanning.
• Enhanced JavaScript Library Detection: Improved accuracy and recognition of client-side libraries for better vulnerability coverage.

🔄 Updates

• Detection Rule Enhancements: Updated vulnerability checks for:
  • Vulnerable Tomcat Versions
  • Vulnerable OpenSSL Versions
  • Vulnerable WordPress Versions
• Updated Vulnerability Definitions: Refreshed and expanded definitions to include more tests

🚀 New Features

• Vulnerable JavaScript Library Detection: SmartScanner can now identify JavaScript libraries in use and test them against 1,000+ client-side vulnerabilities sourced from the GitHub Advisory Database.
• No-Crawl Option in CLI (sms.exe): You can now disable crawling entirely when running scans via the CLI, perfect for predefined URL lists and focused assessments.
• Manual Scope in CLI (sms.exe): Define custom scan scopes using regular expressions directly in the CLI, giving you greater control over scan boundaries.

• Report Enhancements:

  • JSON reports now include vulnerability references and classifications.
  • PDF reports now include classifications for easier analysis and compliance tracking.

⚡ Improvements

• Faster JavaScript Evaluation:
  • Pages with identical script sets are evaluated only once.
  • Pages containing only analytics scripts (e.g., Google Analytics) are skipped, avoiding unnecessary overhead.
• Refined Sensitive Unreferenced Resource Test: Improved accuracy and detection.
• Resilient JavaScript Handling: Better recovery from failures when evaluating complex JavaScript-heavy pages.
• Optimized CPU Usage: SmartScanner now dynamically adapts to available CPU cores for more efficient resource usage.

🔄 Updates

• Detection Rule Enhancements: Updated vulnerability checks for:
  • Vulnerable Nginx Versions
  • Vulnerable Tomcat Versions
• Bug Fixes:
  • Fixed duplicate reporting of the same secret across multiple URLs.
  • Fixed false positives in Sensitive Data Disclosure detection.
  • Fixed false positives in Web Server and CMS detections.
  • Fixed false positives in Old/Backup or Hidden Resource detections.
  • Fixed false positives in OS Command Execution detection.
  • Fixed a rare crash that could occur during scans.

🚀 New Features

• Sensitive Data Disclosure Test: Added a new test for detecting Sensitive Data Disclosure, helping you identify exposed information like API keys, credentials, or internal paths.
• No-Crawl Option: You can now disable crawling entirely when providing a predefined list of URLs—ideal for targeted scans.
• JavaScript File Scanning: SmartScanner can now analyze standalone JavaScript files, expanding coverage for client-side vulnerabilities.

⚡ Improvements

• User Experience: The manual login browser now auto-fills the target URL, saving time and improving usability during authenticated scans.

🔄 Updates

• Detection Rule Enhancements: Updated vulnerability checks for:
  • Vulnerable Apache Version
  • Vulnerable Tomcat Versions
  • Vulnerable PHP Versions
  • Vulnerable OpenSSL Versions
• Bug Fixes:
  • Fixed a crash that could occur during scans in rare cases.
  • Fixed an issue where HTTP responses were improperly truncated in reports, causing the proof of concept to be partially hidden.

🚀 New Features

• Renamed Vulnerability: Remote URL Disclosure has been renamed to Server-Side Request Forgery (SSRF), now with a dedicated toggle in the test settings.
• Multi-URL Input Support: You can now input multiple target URLs directly in the target field.
• File-Based Scanning: Upload and scan a file containing a list of URLs.
• Extended Payload Testing: Deeper vulnerability tests using a broader range of payloads for user-defined URLs.
• Manual Crawl Scope: Define manual crawl scope in scan configurations.
• JavaScript Evaluation Toggle: Option to disable Chromium-based JavaScript evaluation in scan settings.

⚡ Improvements

• Enhanced Crawler Performance: Improved handling of AJAX-driven content and dynamic web pages.
• Smarter URL Handling: Better recognition and support for SEO-friendly and complex URL structures.
• Improved HTTP Response Detection: More accurate identification of custom 200 OK and 404 Not Found pages.

🔄 Updates

• Detection Rule Enhancements: Updated vulnerability checks for:
  • Vulnerable Tomcat Versions
  • Vulnerable PHP Versions
  • Vulnerable WordPress Versions
• Bug Fixes:
  • Resolved an issue with license registration in the Pro version.
  • General stability and compatibility improvements through backend updates.

New Features

• Command-Line Interface (CLI): Introduced sms, a CLI version of SmartScanner for automation and scripting.
• IDOR Detection: Added tests for Insecure Direct Object Reference (IDOR) vulnerabilities.
• Fuzzing Tests: Enabled fuzzing in scan configurations for better vulnerability discovery.
• Crawl Depth Control: Setting crawl depth to 0 now scans only the input URL without crawling additional pages.
• Subdomain Scanning Control: Subdomains are no longer scanned by default, reducing unnecessary requests.

Improvements

• Reduced False Positives: Enhanced passive tests to minimize incorrect vulnerability detections.
• Performance Boost: Optimized scanning speed and resource usage.
• Enhanced Crawling: Improved accuracy and efficiency in web crawling.
• Manual Login Fixes: Resolved bugs affecting manual authentication workflows.
• Stronger Input Validation: Improved input URL validation to prevent scanning errors.
• UI Enhancements: Made subtle UI adjustments for a better user experience.

Updates

• Vulnerability Detection Enhancements: Updated detection rules for:
  • Vulnerable OpenSSL Versions.
  • Vulnerable Nginx Versions.
  • Vulnerable Tomcat Versions.
• System Requirements Update:
  • Dropped support for 32-bit systems.
  • Windows 10 versions older than 1809 are no longer supported.
• Chromium Update: Upgraded embedded Chromium to version 122 for better compatibility and security.

New Features:

• Refreshed User Interface: Experience a cleaner design and improved usability for a smoother workflow.
• Custom HTTP Requests: You can now specify custom HTTP requests to start a scan, offering more flexibility.

Improvements:

• Enhanced detection of database errors for more accurate and actionable insights.

Updates:

• Updated rules for detecting vulnerabilities in the following tests:
  • Vulnerable OpenSSL Version.
  • Vulnerable Tomcat Version.
  • Vulnerable PHP Version.

New Features:

• Added Proof of Concept (POC) for XSS and SQL injection vulnerabilities.
• SQL Injection for MemSQL database
• Test for PHP CGI Argument Injection RCE (CVE-2024-4577 and CVE-2012-1823)
• Separate classification section in vulnerability details

Improvements:

• Better XSS detection in script tags
• Improved error detection

Bug Fixes:

• Fixed incorrect PHP error detection

Updates:

• Updated Vulnerable OpenSSL Version.
• Updated Vulnerable Nginx Version.
• Updated Vulnerable Apache Version.
• Updated Vulnerable Tomcat Version.
• Updated Vulnerable PHP Version.
• Updated Vulnerable WordPress Version.

• Added support for the following technologies in scan configurations: Apache, Nginx, IIS, Tomcat, WordPress, Joomla, and Drupal.
• Separated Path Traversal tests from File Inclusion tests.
• Updated vulnerability descriptions and recommendations for greater clarity.

Improvements:

• Enhanced Microsoft SQL Server error-based SQL injection detection.
• Improved File Inclusion detection.
• Enhanced PHP Remote File Inclusion detection.
• Improved database error detection.

Bug Fixes:

• Corrected PHP version detection.
• Fixed missed XSS vulnerabilities on 404 pages.
• Fixed missed XSS vulnerabilities on pages without query parameters.

Updates:

• Updated Vulnerable OpenSSL Version.
• Updated Vulnerable Nginx Version.
• Updated Vulnerable Apache Version.
• Updated Vulnerable Tomcat Version.
• Updated Vulnerable PHP Version.
• Updated Vulnerable WordPress Version.

• New:
  • New option in scan configurations to identify the target’s utilized technologies for enhancing the efficiency of the scan
  • Detailed scan statistics by hovering on the Requests count in the scan window
  • Support for manipulation of non-quoted JSON data
• Improvements:
  • Improved Time-Based SQL Injection accuracy for MySQL database
  • BugFix: False positive XSS detection in HTML attributes
  • BugFix: Not loading of some sites when using the manual login option in the scan configurations
  • Updated Vulnerable OpenSSL Version, Vulnerable Tomcat Version, and Vulnerable WordPress Version

• New:
  • Html report format
  • Option for adding custom cookies in scan configurations
  • Option for adding custom headers in scan configurations
  • Option for using HTTP basic and HTTP form login methods together
  • Manual login in configurations now respects the proxy
• Improvements:
  • Limit log display to last 150 logs to manage memory usage
  • Some UX improvements in scan configurations
  • BugFix: False positive in hidden resource test
  • BugFix: Broken manual authentication in case of localStorage usage
  • Updated Vulnerable OpenSSL Version, Vulnerable Apache Version, Vulnerable PHP Version, Vulnerable Tomcat Version, and Vulnerable WordPress Version

• New:
  • XSS detection in URI
  • XSS detection in 404 not found pages
  • Support for detection of Lucee errors
• Improvements:
  • Improved evaluation of AJAX links and testing dynamic contents
  • Improved hidden resource detection
  • Improved unix path disclosure detection
  • Improved PHP error detection
  • Improved XSS detection in HTTP headers
  • Updated Vulnerable OpenSSL Version, Vulnerable PHP Version , and Vulnerable WordPress Version

• Improvements:
  • Faster evaluation and testing of dynamic pages with JavaScript
  • Improved AJAX processing and testing
  • Updated Vulnerable Apache Version, Vulnerable Nginx Version, Vulnerable Tomcat Version, Vulnerable OpenSSL Version, and Vulnerable WordPress Version

• New:
  • Insecure Inline Frame
  • Unicode Transformation Issue
  • User Controllable URL
  • Microsoft IIS Tilde Directory Enumeration
  • Finding injection vulnerabilities (e.g XSS, SQLI) in hidden and backup resources
• Improvements:
  • Better exception handling and more log details
  • Increased crawler speed and accuracy
  • Improved Possible SQL Injection detection
  • BugFix: missed PHP errors
  • BugFix: Crash in testing known SQL injections
  • BugFix: missed Blind SQL Injection vulnerabilities
  • BugFix: missed known SQL Injections
  • BugFix: missed Drupal RCE
  • BugFix: missed Drupal SQL Injection vulnerability
  • BugFix: WordPress user enumeration warning error
  • BugFix: missed Java Object Insecure Deserialization vulnerability
  • Improved WordPress 4.6 Blind OS Command Execution for none admin users
  • Improved detection of XSS in various vectors
  • Improved detection of XSS in edge cases when input is filtered
  • Improved detection of XSS in redirected pages
  • Improved hidden resource detection
  • Updated Vulnerable Apache Version, Vulnerable Nginx Version, Vulnerable OpenSSL Version, and Vulnerable WordPress Version

• BugFix: Crash during scanning WordPress sites
• BugFix: Crash during scan

• BugFix: Crash during scan

• BugFix: Crash during scan

• New:
  • Testing of JSON parameters (number and string types)
• Improvements:
  • Optimzied memory usage
  • Enhanced UI vulnerability list display
  • BugFix: TLS initialization failed
  • Minor improvements in error detection issues

• New:
  • Support for all HTTP Verbs (POST,DELETE, PATCH, …) and custom headers in AJAX API (XMLHttpRequest)
  • Smoother progress bar on the scan page
  • Support for detection of errors in Ruby programming language
  • Lazy load tests to optimize memory consumption
• Improvements:
  • Updated Vulnerable PHP Version
  • Updated Vulnerable WordPress Version
  • Enhanced MySql database detection
  • BugFix: False positive hidden resource detection

• New:
  • Support for all HTTP Verbs (POST,DELETE, PATCH, …) and custom headers in JavaScript Fetch API
  • Exporting vulnerability scan results in JSON format
• Improvements:
  • Updated Vulnerable PHP Version
  • Updated Vulnerable Apache Version to include CVE-2022-26377, CVE-2022-28330, CVE-2022-28614, CVE-2022-28615, CVE-2022-29404, CVE-2022-30522, CVE-2022-30556, CVE-2022-31813
  • Updated Vulnerable Tomcat Version to include CVE-2022-34305
  • Updated Vulnerable OpenSSL Version to include CVE-2022-2068, CVE-2022-2097, CVE-2022-2274
  • Updated Vulnerable WordPress Version

• New:
  • Apache Tomcat and Apache Struts detection
  • Java runtime error detection
  • Apache mod_jk Access Control Bypass - CVE-2018-11759
  • Apache Struts 2 Forced double OGNL evaluation S2-059 - CVE-2019-0230
  • Apache Struts 2 RCE S2-045 - CVE-2017-5638
  • Apache Struts 2 REST plugin XStream RCE S2-052 - CVE-2017-9805
  • Apache Struts OGNL expression RCE S2-057 - CVE-2018-11776
  • Apache Tomcat JSP Upload RCE - CVE-2017-12615, CVE-2017-12617
  • Vulnerable Tomcat Version
  • Split the Server Version Disclosure based on Web server:
    • Apache Tomcat Manager Login Found
    • Apache Version Disclosure
    • Nginx Version Disclosure
    • Tomcat Version Disclosure
• Improvements:
  • Updated Vulnerable WordPress Version
  • Updated Vulnerable OpenSSL Version to include CVE-2022-1473, CVE-2022-1434, CVE-2022-1343 and, CVE-2022-1292

• New:
  • Scan logs during scan
  • Support for sitemaps in robots.txt
  • Missing or Insecure Cache-Control Header
  • Joomla! Component Advertisement Board 3.1.0 ‘catname’ SQLI - CVE-2018-5982
  • Joomla! Component Aist 2.0 ‘id’ SQLI - CVE-2018-5993
  • Joomla! Component AllVideos Reloaded 1.2.x ‘divid’ SQLI - CVE-2018-5990
  • Joomla! Component CcNewsletter 2.x.x ‘id’ SQLI - CVE-2018-5989
  • Joomla! Component Com_cbcontact ‘contact_id’ SQLI
  • Joomla! Component Com_rsgallery2 2.0 ‘catid’ SQLI
  • Joomla! Component Com_shop ‘editid’ SQLI
  • Joomla! Component Com_shop ‘id’ SQLI
  • Joomla! Component DT Register 3.2.7 ‘id’ SQLI - CVE-2018-6584
  • Joomla! Component Fastball 2.5 ‘season’ SQLI - CVE-2018-6373
  • Joomla! Component Google Map Landkarten 4.2.3 SQLI - CVE-2018-6396
  • Joomla! Component InviteX 3.0.5 ‘invite_type’ SQLI - CVE-2018-6394
  • Joomla! Component JB Bus 2.3 ‘order_number’ SQLI - CVE-2018-6372
  • Joomla! Component JCK Editor 6.4.4 ‘parent’ SQLI - CVE-2018-17254
  • Joomla! Component JEXTN Video Gallery 3.0.5 ‘id’ SQLI - CVE-2017-17872
  • Joomla! Component JGive 2.0.9 SQLI - CVE-2018-5970
  • Joomla! Component Jobs Factory 2.0.4 SQLI - CVE-2018-17382
  • Joomla! Component JomEstate PRO 3.7 ‘id’ SQLI - CVE-2018-6368
  • Joomla! Component Music Collection 3.0.3 SQLI - CVE-2018-17375
  • Joomla! Component NextGen Editor 2.1.0 ‘plname’ SQLI
  • Joomla! Component Odudeprofile 2.8 ‘profession’ SQLI
  • Joomla! Component Reverse Auction Factory 4.3.8 SQLI - CVE-2018-17376
  • Joomla! Component Timetable Responsive Schedule For Joomla! 1.5 ‘alias’ SQLI - CVE-2018-6583
  • Joomla! Pinterest Clone Social Pinboard 2.0 SQLI - CVE-2018-5987
• Improvements:
  • BugFix: Fix wrong SubResource Integrity checking
  • Improvement of testing for Content Security Policy
  • BugFix: Disabled authentication options in scan config
  • Updated Vulnerable PHP Version
  • Updated Vulnerable WordPress Version
  • Updated Vulnerable Apache Version to include CVE-2022-22719, CVE-2022-22720, CVE-2022-22721, CVE-2022-23943
  • Updated Vulnerable OpenSSL Version to include CVE-2022-0778

• New:
  • 64-bit version for Windows
  • CRLF Injection in URL
  • Open Redirection In URL
  • Nginx Code Execution due to Misconfiguration
  • Nginx Integer Overflow
  • WordPress 4.6 Blind OS Command Execution
  • Support for detection of errors in NodeJs
• Improvements:
  • BugFix: A crash error
  • BugFix: False positives in BREACH attack, Email Address Disclosure and, Source Code Disclosure
  • Improvement of Header manipulation
  • Optimization for Hidden/Backup resource tests
  • Updated Vulnerable PHP Version
  • Updated Vulnerable WordPress Version

• New:
  • Host Header Injection
  • WordPress Plugin Wpfilemanager 6.8 RCE
  • Serialized Object Found
  • Drupal7 Pre Auth SQLI
  • Werkzeug Interactive Debugging is Active
  • Apache mod_proxy 2.4.48 SSRF
  • X-XSS-Protection Header is Missing retired and X-XSS-Protection Header is Set added
  • Support for detection of errors in Python libraries like Django, Flask and Werkzeug
  • Support for PHP and Java objects in Insecure Deserialization
  • Support for using system’s proxy in the scan configurations
• Improvements:
  • Minor bug fixes
  • Drupal detection enhanced
  • Improvement on multiple passive tests like error and source code detection,
  • Updated Vulnerable PHP Version
  • Updated Vulnerable WordPress Version

• New:
  • Nginx Restriction Bypass via Space Character in URI (CVE-2013-4547)
  • Apache 2.4.49 Path Traversal and RCE (CVE-2021-41773, CVE-2021-42013)
  • Web Server Path Traversal (CVE-2017-14849)
  • Insecure Deserialization
  • Insecure Deserialization Remote Code Execution
  • Cookie Accessible for Subdomains
  • Session Cookie Accessible for Subdomains
  • All issues mapped to OWASP Top 10 2021
• Improvements:
  • Updated Vulnerable OpenSSL Version to include CVE-2021-3711 and CVE-2021-3712
  • Updated Vulnerable Apache Version to include CVE-2021-40438, CVE-2021-39275, CVE-2021-36160, CVE-2021-34798, CVE-2021-33193, CVE-2021-41773, CVE-2021-41524, CVE-2021-41773 and CVE-2021-42013
  • Updated Vulnerable PHP Version
  • Updated Vulnerable WordPress Version

• Improvements:
  • BugFix: Wrong emails in target information

• New:
  • CSRF bypass support for weak password issues
  • Tests for 12 known Joomla! vulnerabilities and one test for Drupal
  • Cross-Site Scripting test generalized for easy adding of any known vulnerabilities in CMSs like WordPress, Drupal, Joomla, etc.
  • Subresource Integrity is Missing
• Improvements:
  • Enhanced passive tests for 404 pages
  • BugFix: Bypassing weak password test in case of too many inputs in the login form
  • BugFix: Duplicate login form detection

• New:
  • SQL injection test generalized for easy adding of any known vulnerabilities in CMSs like WordPress, Drupal, Joomla, etc.
  • Tests for 44 known WordPress SQL Injection vulnerabilities
  • Passive Mixed Content
• Improvements:
  • WordPress user identification improved
  • BugFix: WordPress brute force
  • BugFix: Scan doesn’t proceed when starting url contains unicode characters

• New:
  • ViewState is not Encrypted
  • Redirection with Body
  • HTTP Protocol Stack Remote Code Execution Vulnerability (DOS) - CVE-2021-31166
  • File Upload Functionality
• Improvements:
  • Improved Fuzzing tests
  • BugFix: False-positive XSS
  • Updated SQL Injection tests for MySQL and PostgreSQL
  • Updated Vulnerable Apache Version, Vulnerable Nginx Version, Vulnerable PHP Version and Vulnerable WordPress Version

• New:
  • Test for the ShellShock Bug
  • Enhanced application error detection. Detailed Application Error and Detailed Application and Database Error
  • Fuzzing parameter names like URL query, Cookie or HTTP form Post parameter names
  • Automatic detection of ineffective parameters like those used in the query to bypass browser cache. This will prevent unnecessary tests on such parameters and increase scan speed.
• Improvements:
  • Add support for .NET error detection in Application Error

• New:
  • New fuzzer script
  • Buffer Overflow
• Improvements:
  • Enhanced Application Error and Database Error
  • Enhanced custom 404 page detector

• New:
  • Automatic Drupal and Joomla! detection
  • Joomla! ‘J2Store < 3.3.7’ SQL Injection
  • Drupal ‘Drupalgeddon2’ Remote Code Execution
• Improvements:
  • Updated Vulnerable OpenSSL Version to include CVE-2021-23840, CVE-2021-23841, CVE-2021-3449 and, CVE-2021-3450 OpenSSL advisories

• New:
  • TRACK Method Allowed and TRACE Method Allowed
• Improvements:
  • Updated Vulnerable OpenSSL Version to include CVE-2021-23841, CVE-2021-23840 and CVE-2021-23839 OpenSSL advisories
  • Improved Crawler Performance: Faster processing of pages
  • BugFix: False-negative Unreferenced resource detection
  • BugFix: Broken PDF report layout

• New:
  • Unreferenced Repository Found
• Improvements:
  • Improved Crawler Performance: Automatic detection & limitation of content pages like ecomerce product pages.
  • New “Requested URL” attribute for unreferenced/old file issue reports
  • Minor improvements on Form Brute Force and unreferenced login page tests
  • BugFix: False-negative & False-positive Unreferenced resource detection
  • BugFix: Broken link issue for sitemap

• New:
  • Expression Language Injection test
  • WordPress User Enumeration test
  • Sitemap test
  • Test profiles in scan configs with predefined and custom profiles
• Improvements:
  • Support for WordPress in Form Brute Force test
  • Support for PHP 8.0 in phpinfo() test
  • CVE-2020-1971 added to “Vulnerable OpenSSL Version” test
  • Better detection of session cookies
  • Minor enhancements in “Breach Attack”, “X-Frame-Options Header is Missing”, “Referrer-Policy Header is Missing”, “Basic Authentication Over HTTP”, “Robots.txt” tests
  • Support for MariaDB in “Database Error” and SQLi tests
  • BugFix: False-positive Source Code disclosure detection
  • BugFix: Wrong results in Form Brute Force test
  • BugFix: Wrong URL detection in crawler
  • BugFix: Random crash

• Initial version