/missing-cve-nuclei-templates

Weekly updated list of missing CVEs in nuclei templates official repository. Mainly built for bug bounty, but useful for penetration tests and vulnerability assessments too.

Primary LanguageShellMIT LicenseMIT

Weekly updated list of missing CVEs in nuclei templates official repository


Note This repository is 100% automated so there can be errors, but in general is pretty accurate. Go to section "How it works" to understand how data is collected.

Stats 📊

CVEs analyzed: 109379

CVEs missing: 30372

Dropdown by vuln type:

Type Count Data
XSS 13569 xss.txt
RCE 4777 rce.txt
SQL Injection 7796 sqli.txt
Local File Inclusion 200 lfi.txt
Server Side Request Forgery 238 ssrf.txt
Prototype Pollution 224 proto-pollution.txt
Request Smuggling 78 req-smuggling.txt
Open Redirect 303 open-redirect.txt
XML External Entity 365 xxe.txt
Path Traversal 2772 path-traversal.txt
Server Side Template Injection 50 ssti.txt

Dropdown by year:

Year Count Data
1999 1 1999.txt
2000 2 2000.txt
2001 9 2001.txt
2002 23 2002.txt
2003 29 2003.txt
2004 101 2004.txt
2005 342 2005.txt
2006 1017 2006.txt
2007 1026 2007.txt
2008 1938 2008.txt
2009 752 2009.txt
2010 649 2010.txt
2011 242 2011.txt
2012 455 2012.txt
2013 385 2013.txt
2014 801 2014.txt
2015 814 2015.txt
2016 544 2016.txt
2017 1343 2017.txt
2018 1947 2018.txt
2019 1544 2019.txt
2020 2248 2020.txt
2021 2580 2021.txt
2022 3200 2022.txt
2023 2915 2023.txt
2024 5465 2024.txt

Why 🤔

  • Bug bounty: the CVE templates in the official nuclei-templates repo are completely useless for bug bounty. This because everyone is using those templates looking for low hanging fruit. Build your own templates for new (and old!) CVEs, scan all the possible targets and don't forget to share them in the official nuclei-templates repo.
  • General Security: Security people can write their own templates for missing CVEs and use them to secure products during pentests, vuln assessments, red team ops and so on... every user will benefit from these actions. If they are very good security people they'll share the templates in official nuclei-templates repo helping the whole infosec community.
  • Stats & Data lover: I love data and statistics and I hope people like me will enjoy.

How it works 🖥️

Automated Logic:

for each cve in trickest/cve:
    if this cve not present in nuclei-templates:
        if it contains one of the words we are looking for:
            if it is a CVE suitable for nuclei:
                print it
  • Which are the "words we are looking for"? reflected, rce, local file inclusion, server side request forgery, ssrf, remote code execution, remote command execution, command injection, code injection, ssti, template injection, lfi, xss, Cross-Site Scripting, Cross Site Scripting, SQL injection, Prototype pollution, XML External Entity, Request Smuggling, XXE, Open redirect, Path Traversal and Directory Traversal.

  • This means the tracked vulnerability types are: XSS, RCE, SQL injection, Local File Inclusion, Server Side Request Forgery, Prototype Pollution, Request Smuggling, Open Redirect, XML Enternal Entity, Path Traversal and Server Side Template Injection; but new vuln types will be supported.

  • Why there can be errors in categorizing CVEs? Because when grepping for these words there can be false positives, meaning that an XXE vulnerability can be categorized as RCE because e.g. it says "in certain situations can be escalated to rce".

  • Why if I subtract the "CVEs missing" from the "CVEs analyzed" I don't get the exact official nuclei templates count? Because as said before the tracked vuln types are just 10 (the most famous ones), but a lot of other types are reported as well (and they will be supported).

  • What does it mean a CVE is suitable for Nuclei? Basically a remote web or network vulnerability (e.g. a CVE on Android is not suitable).

Contributing 🛠

Just open an issue / pull request.

Thanks 💝

License 📝

This repository is under MIT License.
edoardoottavianelli.it to contact me.