Correct the phpunit rule origin

cve.json

@@ -1,5 +1,5 @@
 {
-  "build_datetime": "2026-11-08T22:58:47Z",
+  "build_datetime": "2026-11-08T23:18:12Z",
   "rulesets": [
     {
       "id": "edgeguard-cve",
@@ -28,7 +28,8 @@
             "https://cwiki.apache.org/confluence/display/WW/S2-032",
             "https://nvd.nist.gov/vuln/detail/CVE-2016-3081"
           ],
-          "origin": "hand-written. The imported pattern was the Nuclei probe's entire OGNL expression, ending in \"\u0026cmd=cat /etc/passwd\", so it only matched an attacker who chose that command with those parameters in that order. This is the 60-character prefix every S2-032 payload shares: the method: prefix plus the _memberAccess assignment that unlocks OGNL. No legitimate request carries it, and every variant does."
+          "origin": "hand-written. The imported pattern was the Nuclei probe's entire OGNL expression, ending in \"\u0026cmd=cat /etc/passwd\", so it only matched an attacker who chose that command with those parameters in that order. This is the 60-character prefix every S2-032 payload shares: the method: prefix plus the _memberAccess assignment that unlocks OGNL. No legitimate request carries it, and every variant does.",
+          "coverage": "class"
         },
         {
           "id": "CVE-2017-9841-N1",
@@ -46,7 +47,8 @@
             "https://nvd.nist.gov/vuln/detail/CVE-2017-9841",
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2017/CVE-2017-9841.yaml"
           ],
-          "origin": "imported from the Nuclei template by tools/nuclei-importer, then promoted to block by hand. Its path is a file that should never be web-reachable, so a request for it is the attack and there is nothing legitimate to refuse. The other rules in this channel carry action \"log\": the engine records those and adds nothing to the anomaly score, so they cannot refuse anything on their own."
+          "origin": "imported from the Nuclei template by tools/nuclei-importer, then promoted to block by hand. Its path is a file that should never be web-reachable, so a request for it is the attack and there is nothing legitimate to refuse. The other rules in this channel carry action \"log\": the engine records those and adds nothing to the anomaly score, so they cannot refuse anything on their own.",
+          "coverage": "class"
         },
         {
           "id": "CVE-2026-0770-N1",
@@ -64,7 +66,8 @@
             "https://nvd.nist.gov/vuln/detail/CVE-2026-0770",
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-0770.yaml"
           ],
-          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation",
+          "coverage": "exploit"
         },
         {
           "id": "CVE-2026-104935-N1",
@@ -82,7 +85,8 @@
             "https://nvd.nist.gov/vuln/detail/CVE-2026-104935",
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-104935.yaml"
           ],
-          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation",
+          "coverage": "class"
         },
         {
           "id": "CVE-2026-105134-N1",
@@ -100,7 +104,8 @@
             "https://nvd.nist.gov/vuln/detail/CVE-2026-105134",
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-105134.yaml"
           ],
-          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation",
+          "coverage": "class"
         },
         {
           "id": "CVE-2026-10520-N1",
@@ -118,7 +123,8 @@
             "https://nvd.nist.gov/vuln/detail/CVE-2026-10520",
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-10520.yaml"
           ],
-          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation",
+          "coverage": "exploit"
         },
         {
           "id": "CVE-2026-110447-N1",
@@ -136,7 +142,8 @@
             "https://nvd.nist.gov/vuln/detail/CVE-2026-110447",
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-110447.yaml"
           ],
-          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation",
+          "coverage": "class"
         },
         {
           "id": "CVE-2026-21589-N1",
@@ -154,7 +161,8 @@
             "https://nvd.nist.gov/vuln/detail/CVE-2026-21589",
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-21589.yaml"
           ],
-          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation",
+          "coverage": "class"
         },
         {
           "id": "CVE-2026-34908-N1",
@@ -172,7 +180,8 @@
             "https://nvd.nist.gov/vuln/detail/CVE-2026-34908",
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-34908.yaml"
           ],
-          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation",
+          "coverage": "class"
         },
         {
           "id": "CVE-2026-63077-N1",
@@ -190,12 +199,13 @@
             "https://nvd.nist.gov/vuln/detail/CVE-2026-63077",
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-63077.yaml"
           ],
-          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation",
+          "coverage": "class"
         },
         {
-          "id": "CVE-2026-72898-N1",
+          "id": "CVE-2026-72898-M1",
           "name": "Metabase - Unauthenticated SQL Injection",
-          "pattern": "(?i)Aa1!\",\"user-id\":\\{\"select\":\\[\"id\"\\],\"from\":\\[\"core_user\"\\],\"where\":\\[\"=\",\"is_superuser\",true\\],\"limit\":1\\}\\}",
+          "pattern": "(?i)\"user-id\":\\{\"select\":\\[\"id\"\\],\"from\":\\[\"core_user\"\\],\"where\":\\[\"=\",\"is_superuser\",true\\]",
           "targets": [
             "body"
           ],
@@ -208,7 +218,8 @@
             "https://nvd.nist.gov/vuln/detail/CVE-2026-72898",
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-72898.yaml"
           ],
-          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+          "origin": "hand-written. The imported pattern began \"Aa1!\", the suffix of the probe's own password, so it matched that probe and no attacker who chose a different one. What remains is the SQL query serialised into the user-id field, which is the vulnerability itself.",
+          "coverage": "class"
         },
         {
           "id": "CVE-2026-75650-N1",
@@ -226,7 +237,8 @@
             "https://nvd.nist.gov/vuln/detail/CVE-2026-75650",
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-75650.yaml"
           ],
-          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation",
+          "coverage": "class"
         },
         {
           "id": "CVE-2026-8037-N1",
@@ -244,7 +256,8 @@
             "https://nvd.nist.gov/vuln/detail/CVE-2026-8037",
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-8037.yaml"
           ],
-          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation",
+          "coverage": "exploit"
         },
         {
           "id": "CVE-2026-87902-N1",
@@ -262,7 +275,8 @@
             "https://nvd.nist.gov/vuln/detail/CVE-2026-87902",
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-87902.yaml"
           ],
-          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation",
+          "coverage": "class"
         },
         {
           "id": "CVE-2026-93616-N1",
@@ -280,7 +294,8 @@
             "https://nvd.nist.gov/vuln/detail/CVE-2026-93616",
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-93616.yaml"
           ],
-          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation",
+          "coverage": "class"
         },
         {
           "id": "CVE-2026-9586-N1",
@@ -298,7 +313,8 @@
             "https://nvd.nist.gov/vuln/detail/CVE-2026-9586",
             "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-9586.yaml"
           ],
-          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
+          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation",
+          "coverage": "exploit"
         }
       ]
     }