XnoleXDocs

Vulnerabilities & Findings

Vulnerabilities are security findings discovered by nuclei during the VALIDATE stage of a scan. Each finding represents a specific issue detected at a specific endpoint.

Severity Levels

Each vulnerability is classified into one of five severity levels based on the nuclei template metadata:

Critical — Severe vulnerabilities requiring immediate attention. Remote code execution, authentication bypass, data exposure.
High — Significant security issues that should be addressed quickly. Privilege escalation, known CVEs with public exploits.
Medium — Moderate issues that should be planned for remediation. Misconfigurations, information disclosure, outdated software.
Low — Minor issues with limited security impact. Missing headers, verbose error messages.
Info — Informational findings. Technologies detected, default pages, non-security-related observations.
Note
Vulnerabilities with unrecognized severity values are automatically classified as "info".

Finding Structure

Each vulnerability finding includes the following fields:

name — Human-readable name of the vulnerability (e.g., "Apache Struts RCE"). Sourced from the nuclei template info.name field.
severity — Classification: critical, high, medium, low, or info.
status — Current status. All findings are initially set to "open" when discovered.
template_id — The nuclei template identifier (e.g., "CVE-2023-1234", "misconfigured-cors"). Maps directly to the nuclei template repository.
host — The affected subdomain or service (e.g., "api.example.com").
matched_at — The specific URL or endpoint where the finding was detected (e.g., "https://api.example.com/admin/config").
description — Detailed description of the vulnerability. Sourced from the nuclei template info.description field.
remediation — Guidance for fixing the issue. Sourced from the nuclei template info.remediation field.

Deduplication

Findings are deduplicated by a composite key of template_id and matched_at. If the same template detects the same issue at the same URL, only the first occurrence is recorded. This prevents duplicate entries when nuclei retries requests.

Deduplication key
vuln_key = f"{template_id}:{matched_at}"

# Example:
# "CVE-2023-1234:https://api.example.com/admin"
# Second detection of same template at same URL is skipped

Filtering & Prioritization

Vulnerabilities are presented in the UI with client-side severity filtering. The intel endpoint returns results pre-sorted by severity (critical first, info last). The correlated host-vulnerability map groups findings by affected host, making it easy to assess which services have the most issues.

Severity sort order
ORDER BY CASE severity
  WHEN 'critical' THEN 1
  WHEN 'high'     THEN 2
  WHEN 'medium'   THEN 3
  WHEN 'low'      THEN 4
  ELSE                 5
END

Database Schema

vulnerabilities table
vulnerabilities
  ├── id            UUID (primary key)
  ├── scan_id       UUID (foreign key to scans)
  ├── name          TEXT (vulnerability name)
  ├── severity      TEXT (critical|high|medium|low|info)
  ├── status        TEXT (initially "open")
  ├── template_id   TEXT (nuclei template identifier)
  ├── host          TEXT (affected subdomain/service)
  ├── matched_at    TEXT (specific URL where finding was detected)
  ├── description   TEXT (vulnerability details)
  └── remediation   TEXT (fix guidance)

API Response Example

Vulnerabilities are returned as part of the scan detail response and the intel endpoint:

GET /api/v1/scans/{id}
{
  "vulnerabilities": [
    {
      "id": "a1b2c3d4-...",
      "name": "Apache Struts Remote Code Execution",
      "severity": "critical",
      "status": "open",
      "template_id": "cve-2023-50164",
      "host": "api.example.com",
      "matched_at": "https://api.example.com/upload",
      "description": "Apache Struts before 2.5.33 is vulnerable to RCE via file upload.",
      "remediation": "Upgrade Apache Struts to version 2.5.33 or later."
    },
    {
      "id": "e5f6g7h8-...",
      "name": "CORS Misconfiguration",
      "severity": "medium",
      "status": "open",
      "template_id": "misconfigured-cors",
      "host": "app.example.com",
      "matched_at": "https://app.example.com/api/data",
      "description": "The application allows requests from untrusted origins.",
      "remediation": "Restrict CORS origins to trusted domains only."
    }
  ]
}

Automated Detection Only

Security
XnoleX performs automated vulnerability detection only. It does not attempt exploitation, privilege escalation, or any form of active penetration testing. Findings are based on nuclei template matching, which identifies known vulnerability signatures and misconfigurations.