AndreandClaude Opus 5
d8426a1d6c
A CVE record describes a vulnerability, not a request, which is why this channel is written by hand. A Nuclei template contains the request — path, query, headers, body — because that is what it sends, so for thousands of CVEs the shape a virtual patch needs is already written down. What cannot come across is the template's matchers: they read the RESPONSE to decide whether the target was actually vulnerable, and a WAF decides before a response exists. So an imported rule is strictly weaker than the template it came from — it recognises the attempt, not the exploitation. That is why they land as action "log", which the engine now honours: observed, recorded as an event, scoring nothing. Also records what the importer skips rather than guesses: a CVE already patched in compiled code, a request that is entirely template variables, a literal under twelve characters, the site root. And what it corrects: one leading path segment, because a template is written against a laboratory where the application is mounted somewhere — /laravel52/vendor/phpunit/... would have been published unable to match a real attack at /vendor/phpunit/... Documentation only. cve.json is untouched. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N5fpE6Gu4W6JoFMXyb7t7r