{
  "build_datetime": "2026-11-04T00:54:59Z",
  "rulesets": [
    {
      "id": "edgeguard-cve",
      "name": "EdgeGuard CVE Virtual Patches",
      "version": "1",
      "source": "edgeguard-cve",
      "description": "Virtual patches for named vulnerabilities",
      "enabled": true,
      "priority": 1,
      "rules": [
        {
          "id": "CVE-2017-9841-N1",
          "name": "PHPUnit - Remote Code Execution",
          "pattern": "(?i)/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin\\.php",
          "targets": [
            "uri"
          ],
          "action": "log",
          "severity": "high",
          "category": "cve",
          "cve": "CVE-2017-9841",
          "enabled": true,
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2017-9841",
            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2017/CVE-2017-9841.yaml"
          ],
          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
        },
        {
          "id": "CVE-2025-64500-01",
          "name": "Symfony debug profiler reachable",
          "pattern": "(?i)/_profiler/",
          "targets": [
            "uri"
          ],
          "action": "log",
          "severity": "high",
          "category": "cve",
          "cve": "CVE-2025-64500",
          "enabled": true,
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2025-64500"
          ],
          "origin": "written by hand: the importer skipped it because the literal is ten characters, and that threshold is right in general. Here the path IS the fault \u2014 a reachable profiler leaks routes, config and request history \u2014 so a request for it is never ordinary traffic."
        }
      ]
    }
  ]
}