@zerothreatai/vulnerability-registry 3.0.0 → 5.0.0

package/src/categories/ssrf.ts

@@ -9,11 +9,12 @@ import type { VulnerabilityDefinition } from '../types.js';
 
 export const SSRF_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     [VulnerabilityCode.SSRF_CLOUD_METADATA]: {
-        id: 46,
+        id: 450,
         code: VulnerabilityCode.SSRF_CLOUD_METADATA,
         title: 'Server-Side Request Forgery - Cloud Metadata Access',
         description: 'Critical SSRF vulnerability enabling access to cloud provider metadata services (AWS IMDSv1, GCP, Azure) which expose sensitive information including IAM credentials, API tokens, and instance configuration that can lead to full cloud account compromise and lateral movement.',
         severity: 'critical',
+        levelId: 1,
         category: 'ssrf',
         scanner: 'ssrf',
         cvss: {
@@ -31,11 +32,12 @@ export const SSRF_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.SSRF_INTERNAL_SERVICE]: {
-        id: 47,
+        id: 451,
         code: VulnerabilityCode.SSRF_INTERNAL_SERVICE,
         title: 'Server-Side Request Forgery - Internal Service Access',
         description: 'SSRF vulnerability allowing attackers to access internal network services that should not be reachable from the internet, including databases, admin panels, cache servers, and other infrastructure components protected only by network segmentation without authentication.',
         severity: 'high',
+        levelId: 2,
         category: 'ssrf',
         scanner: 'ssrf',
         cvss: {
@@ -53,11 +55,12 @@ export const SSRF_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.SSRF_PROTOCOL_SMUGGLING]: {
-        id: 48,
+        id: 452,
         code: VulnerabilityCode.SSRF_PROTOCOL_SMUGGLING,
         title: 'Server-Side Request Forgery - Protocol Smuggling',
         description: 'SSRF vulnerability exploiting non-HTTP protocol handlers like file://, gopher://, dict://, or ftp:// to read local files, interact with internal services using raw TCP, or perform attacks that would not be possible through HTTP requests alone, significantly expanding impact scope.',
         severity: 'high',
+        levelId: 2,
         category: 'ssrf',
         scanner: 'ssrf',
         cvss: {
@@ -75,11 +78,12 @@ export const SSRF_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.SSRF_BLIND_OOB]: {
-        id: 49,
+        id: 453,
         code: VulnerabilityCode.SSRF_BLIND_OOB,
         title: 'Server-Side Request Forgery - Blind OOB',
         description: 'Blind SSRF vulnerability confirmed through out-of-band DNS or HTTP callbacks indicating the server makes requests to attacker-controlled destinations even though responses are not reflected, enabling internal network scanning and data exfiltration through DNS or timing side channels.',
         severity: 'medium',
+        levelId: 3,
         category: 'ssrf',
         scanner: 'ssrf',
         cvss: {
@@ -100,11 +104,12 @@ export const SSRF_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     // OPEN REDIRECT
     // ========================================
     [VulnerabilityCode.REDIRECT_HEADER_INJECTION]: {
-        id: 50,
+        id: 454,
         code: VulnerabilityCode.REDIRECT_HEADER_INJECTION,
         title: 'Open Redirect - HTTP Header Injection',
         description: 'Open redirect vulnerability through Location header manipulation allowing attackers to redirect victims to malicious websites after authenticating or interacting with the legitimate application, facilitating phishing attacks that abuse user trust in the original domain.',
         severity: 'medium',
+        levelId: 3,
         category: 'business_logic',
         scanner: 'redirect-route',
         cvss: {
@@ -122,11 +127,12 @@ export const SSRF_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.REDIRECT_JS_NAVIGATION]: {
-        id: 51,
+        id: 455,
         code: VulnerabilityCode.REDIRECT_JS_NAVIGATION,
         title: 'Open Redirect - JavaScript Navigation',
         description: 'Client-side open redirect vulnerability through JavaScript navigation methods like window.location or location.href being set to user-controlled values, allowing attackers to redirect users to malicious sites through specially crafted URLs that bypass server-side validation.',
         severity: 'medium',
+        levelId: 3,
         category: 'business_logic',
         scanner: 'redirect-route',
         cvss: {
@@ -147,11 +153,12 @@ export const SSRF_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     // HOST HEADER INJECTION
     // ========================================
     [VulnerabilityCode.HOST_CACHE_POISONING]: {
-        id: 52,
+        id: 456,
         code: VulnerabilityCode.HOST_CACHE_POISONING,
         title: 'Host Header Injection - Cache Poisoning',
         description: 'Host header injection vulnerability where manipulated Host headers are reflected in cached responses, allowing attackers to poison web caches and CDNs with malicious content that is then served to all users, potentially enabling widespread defacement or malware distribution.',
         severity: 'high',
+        levelId: 2,
         category: 'configuration',
         scanner: 'host-header',
         cvss: {
@@ -169,11 +176,12 @@ export const SSRF_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.HOST_PASSWORD_RESET]: {
-        id: 53,
+        id: 457,
         code: VulnerabilityCode.HOST_PASSWORD_RESET,
         title: 'Host Header Injection - Password Reset Poisoning',
         description: 'Critical host header injection vulnerability in password reset functionality where the injected Host header is used to generate password reset URLs, allowing attackers to receive password reset tokens when victims click the manipulated links in legitimate reset emails.',
         severity: 'high',
+        levelId: 2,
         category: 'configuration',
         scanner: 'host-header',
         cvss: {
@@ -191,11 +199,12 @@ export const SSRF_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.SSRF_FILTER_BYPASS]: {
-        id: 54,
+        id: 458,
         code: VulnerabilityCode.SSRF_FILTER_BYPASS,
         title: 'Server-Side Request Forgery - Filter Bypass',
         description: 'SSRF vulnerability that bypasses security filters through encoding tricks (URL encoding, IPv6 representation, decimal IP notation), DNS rebinding, or using alternative representations of blocked addresses to reach internal resources despite URL validation controls.',
         severity: 'high',
+        levelId: 2,
         category: 'ssrf',
         scanner: 'ssrf',
         cvss: {
@@ -213,11 +222,12 @@ export const SSRF_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.REDIRECT_META_REFRESH]: {
-        id: 55,
+        id: 459,
         code: VulnerabilityCode.REDIRECT_META_REFRESH,
         title: 'Open Redirect - Meta Refresh',
         description: 'Open redirect vulnerability through HTML meta refresh tags where user input controls the redirect target URL, enabling phishing attacks by sending victims to malicious sites after a brief delay on the legitimate domain, bypassing some security controls.',
         severity: 'low',
+        levelId: 4,
         category: 'business_logic',
         scanner: 'redirect-route',
         cvss: {
@@ -235,11 +245,12 @@ export const SSRF_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.HOST_REDIRECT]: {
-        id: 56,
+        id: 460,
         code: VulnerabilityCode.HOST_REDIRECT,
         title: 'Host Header Injection - Open Redirect',
         description: 'Host header injection leading to open redirect where the application uses the Host header to generate redirect URLs, allowing attackers to redirect users to malicious domains by manipulating the Host header in their requests.',
         severity: 'medium',
+        levelId: 3,
         category: 'configuration',
         scanner: 'host-header',
         cvss: {

package/src/categories/xss.ts

@@ -9,11 +9,12 @@ import type { VulnerabilityDefinition } from '../types.js';
 
 export const XSS_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     [VulnerabilityCode.XSS_REFLECTED]: {
-        id: 31,
+        id: 400,
         code: VulnerabilityCode.XSS_REFLECTED,
         title: 'Cross-Site Scripting - Reflected',
         description: 'Reflected XSS vulnerability where user input is immediately returned by the server in the response without proper encoding, allowing attackers to inject malicious scripts that execute in the victim browser when they click a crafted link or submit a manipulated form.',
         severity: 'medium',
+        levelId: 3,
         category: 'xss',
         scanner: 'xss',
         cvss: {
@@ -31,11 +32,12 @@ export const XSS_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.XSS_STORED]: {
-        id: 32,
+        id: 401,
         code: VulnerabilityCode.XSS_STORED,
         title: 'Cross-Site Scripting - Stored',
         description: 'Critical stored XSS vulnerability where malicious scripts are permanently saved in the application database and served to all users who view the affected content, enabling widespread session hijacking, credential theft, and malware distribution without requiring victim interaction beyond normal usage.',
         severity: 'high',
+        levelId: 2,
         category: 'xss',
         scanner: 'xss',
         cvss: {
@@ -53,11 +55,12 @@ export const XSS_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.XSS_DOM_BASED]: {
-        id: 33,
+        id: 402,
         code: VulnerabilityCode.XSS_DOM_BASED,
         title: 'Cross-Site Scripting - DOM Based',
         description: 'DOM-based XSS vulnerability where the attack payload is processed entirely in the client-side JavaScript code without being sent to the server, typically through dangerous sinks like innerHTML, document.write(), or eval() that process URL fragments or user-controlled DOM elements.',
         severity: 'medium',
+        levelId: 3,
         category: 'xss',
         scanner: 'xss',
         cvss: {
@@ -75,11 +78,12 @@ export const XSS_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.XSS_SVG_INJECTION]: {
-        id: 34,
+        id: 403,
         code: VulnerabilityCode.XSS_SVG_INJECTION,
         title: 'Cross-Site Scripting - SVG Injection',
         description: 'SVG-based XSS vulnerability where malicious JavaScript is embedded within SVG image files using script elements or event handlers like onload, which execute when the browser renders the SVG file as an image or inline element, bypassing image upload security controls.',
         severity: 'high',
+        levelId: 2,
         category: 'xss',
         scanner: 'xss',
         cvss: {
@@ -97,11 +101,12 @@ export const XSS_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.XSS_CSTI_ANGULAR]: {
-        id: 35,
+        id: 404,
         code: VulnerabilityCode.XSS_CSTI_ANGULAR,
         title: 'Cross-Site Scripting - Angular Template Injection',
         description: 'AngularJS client-side template injection vulnerability where user input containing Angular expressions like {{constructor.constructor("alert(1)")()}} is evaluated by the Angular template engine, leading to arbitrary JavaScript execution in the user browser context.',
         severity: 'high',
+        levelId: 2,
         category: 'xss',
         scanner: 'xss',
         cvss: {
@@ -120,11 +125,12 @@ export const XSS_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.XSS_CSP_BYPASS]: {
-        id: 36,
+        id: 405,
         code: VulnerabilityCode.XSS_CSP_BYPASS,
         title: 'Cross-Site Scripting - CSP Bypass',
         description: 'XSS vulnerability that bypasses Content Security Policy protections through techniques like JSONP endpoints on whitelisted domains, base tag injection, Angular.js libraries on CDN, or other CSP bypass gadgets that allow script execution despite CSP controls being in place.',
         severity: 'high',
+        levelId: 2,
         category: 'xss',
         scanner: 'xss',
         cvss: {
@@ -142,11 +148,12 @@ export const XSS_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.XSS_JS_CONTEXT]: {
-        id: 37,
+        id: 406,
         code: VulnerabilityCode.XSS_JS_CONTEXT,
         title: 'Cross-Site Scripting - JavaScript Context',
         description: 'XSS vulnerability where user input is injected directly into JavaScript code blocks, allowing attackers to break out of string contexts and execute arbitrary JavaScript by injecting quote characters and script code, or modify application logic by injecting new statements.',
         severity: 'high',
+        levelId: 2,
         category: 'xss',
         scanner: 'xss',
         cvss: {
@@ -164,11 +171,12 @@ export const XSS_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.XSS_EVENT_HANDLER]: {
-        id: 38,
+        id: 407,
         code: VulnerabilityCode.XSS_EVENT_HANDLER,
         title: 'Cross-Site Scripting - Event Handler Injection',
         description: 'XSS vulnerability through injection into HTML event handler attributes like onclick, onerror, onload, or onmouseover, allowing attackers to execute JavaScript when users interact with or simply view the affected page elements without requiring script tags.',
         severity: 'high',
+        levelId: 2,
         category: 'xss',
         scanner: 'xss',
         cvss: {
@@ -186,11 +194,12 @@ export const XSS_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.XSS_SCRIPT_INJECTION]: {
-        id: 39,
+        id: 408,
         code: VulnerabilityCode.XSS_SCRIPT_INJECTION,
         title: 'Cross-Site Scripting - Script Tag Injection',
         description: 'XSS vulnerability where attackers can inject complete script tags into the HTML response, enabling arbitrary JavaScript execution. This is often the most straightforward XSS exploitation when input is not properly sanitized before rendering.',
         severity: 'high',
+        levelId: 2,
         category: 'xss',
         scanner: 'xss',
         cvss: {
@@ -208,11 +217,12 @@ export const XSS_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.XSS_HTML_INJECTION]: {
-        id: 40,
+        id: 409,
         code: VulnerabilityCode.XSS_HTML_INJECTION,
         title: 'Cross-Site Scripting - HTML Injection',
         description: 'HTML injection vulnerability where attackers can inject arbitrary HTML elements that modify page structure, enabling phishing attacks through fake login forms, content spoofing, or combination with CSS to overlay malicious content over legitimate page elements.',
         severity: 'medium',
+        levelId: 3,
         category: 'xss',
         scanner: 'xss',
         cvss: {
@@ -230,11 +240,12 @@ export const XSS_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.XSS_ATTRIBUTE_INJECTION]: {
-        id: 41,
+        id: 410,
         code: VulnerabilityCode.XSS_ATTRIBUTE_INJECTION,
         title: 'Cross-Site Scripting - Attribute Injection',
         description: 'XSS vulnerability where user input is placed in HTML attributes without proper encoding, allowing attackers to break out of the attribute context and inject new attributes or event handlers by using quote characters and spaces.',
         severity: 'medium',
+        levelId: 3,
         category: 'xss',
         scanner: 'xss',
         cvss: {
@@ -252,11 +263,12 @@ export const XSS_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.XSS_CSS_INJECTION]: {
-        id: 42,
+        id: 411,
         code: VulnerabilityCode.XSS_CSS_INJECTION,
         title: 'Cross-Site Scripting - CSS Injection',
         description: 'CSS injection vulnerability where attackers can inject malicious CSS rules to exfiltrate data through CSS selectors and background URLs, modify page appearance for phishing, or in older browsers achieve JavaScript execution through CSS expressions.',
         severity: 'medium',
+        levelId: 3,
         category: 'xss',
         scanner: 'xss',
         cvss: {
@@ -274,11 +286,12 @@ export const XSS_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.XSS_TEMPLATE_LITERAL]: {
-        id: 43,
+        id: 412,
         code: VulnerabilityCode.XSS_TEMPLATE_LITERAL,
         title: 'Cross-Site Scripting - Template Literal Injection',
         description: 'XSS vulnerability through JavaScript template literals (backtick strings) where user input can break out of the template context or inject expressions using ${} syntax, executing arbitrary JavaScript in the client browser context.',
         severity: 'high',
+        levelId: 2,
         category: 'xss',
         scanner: 'xss',
         cvss: {
@@ -296,11 +309,12 @@ export const XSS_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.XSS_MUTATION_BASED]: {
-        id: 44,
+        id: 413,
         code: VulnerabilityCode.XSS_MUTATION_BASED,
         title: 'Cross-Site Scripting - Mutation XSS',
         description: 'Mutation-based XSS (mXSS) vulnerability exploiting browser HTML parser quirks and DOM mutations where seemingly safe HTML is transformed into executable script through browser parsing behaviors, bypassing traditional sanitization.',
         severity: 'high',
+        levelId: 2,
         category: 'xss',
         scanner: 'xss',
         cvss: {
@@ -318,11 +332,12 @@ export const XSS_VULNERABILITIES: Record<string, VulnerabilityDefinition> = {
     },
 
     [VulnerabilityCode.XSS_CSTI_VUE]: {
-        id: 45,
+        id: 414,
         code: VulnerabilityCode.XSS_CSTI_VUE,
         title: 'Cross-Site Scripting - Vue.js Template Injection',
         description: 'Vue.js client-side template injection vulnerability where user input containing Vue expression syntax like {{}} or v-bind directives is evaluated by the Vue template compiler, leading to arbitrary JavaScript execution in the browser context.',
         severity: 'high',
+        levelId: 2,
         category: 'xss',
         scanner: 'xss',
         cvss: {

package/src/category.ts

@@ -0,0 +1,16 @@
+/**
+ * Category registry - human-friendly titles for categories.
+ */
+
+export const CATEGORY_REGISTRY: Record<string, { title: string }> = {
+  "injection": { title: "Injection" },
+  "xss": { title: "Cross-Site Scripting" },
+  "authentication": { title: "Authentication" },
+  "access_control": { title: "Access Control" },
+  "configuration": { title: "Configuration" },
+  "information_disclosure": { title: "Information Disclosure" },
+  "cryptographic": { title: "Cryptographic" },
+  "business_logic": { title: "Business Logic" },
+  "ssrf": { title: "Server-Side Request Forgery" },
+  "file_inclusion": { title: "File Inclusion" },
+};

package/src/error-codes.ts

@@ -182,11 +182,31 @@ export enum VulnerabilityCode {
     HOST_PASSWORD_RESET = 'HOST_PASSWORD_RESET',
     HOST_REDIRECT = 'HOST_REDIRECT',
 
-    // ========================================
-    // DIRECTORY BROWSING (DIRBROWSE_*)
-    // ========================================
-    DIRBROWSE_ENABLED = 'DIRBROWSE_ENABLED',
-    DIRBROWSE_SENSITIVE = 'DIRBROWSE_SENSITIVE',
+    // ========================================
+    // DIRECTORY BROWSING (DIRBROWSE_*)
+    // ========================================
+    DIRBROWSE_GENERIC = 'DIRBROWSE_GENERIC',
+    DIRBROWSE_GENERIC_SENSITIVE = 'DIRBROWSE_GENERIC_SENSITIVE',
+    DIRBROWSE_APACHE = 'DIRBROWSE_APACHE',
+    DIRBROWSE_APACHE_SENSITIVE = 'DIRBROWSE_APACHE_SENSITIVE',
+    DIRBROWSE_NGINX = 'DIRBROWSE_NGINX',
+    DIRBROWSE_NGINX_SENSITIVE = 'DIRBROWSE_NGINX_SENSITIVE',
+    DIRBROWSE_IIS = 'DIRBROWSE_IIS',
+    DIRBROWSE_IIS_SENSITIVE = 'DIRBROWSE_IIS_SENSITIVE',
+    DIRBROWSE_TOMCAT = 'DIRBROWSE_TOMCAT',
+    DIRBROWSE_TOMCAT_SENSITIVE = 'DIRBROWSE_TOMCAT_SENSITIVE',
+    DIRBROWSE_CADDY = 'DIRBROWSE_CADDY',
+    DIRBROWSE_CADDY_SENSITIVE = 'DIRBROWSE_CADDY_SENSITIVE',
+    DIRBROWSE_WEBDAV = 'DIRBROWSE_WEBDAV',
+    DIRBROWSE_WEBDAV_SENSITIVE = 'DIRBROWSE_WEBDAV_SENSITIVE',
+    DIRBROWSE_S3 = 'DIRBROWSE_S3',
+    DIRBROWSE_S3_SENSITIVE = 'DIRBROWSE_S3_SENSITIVE',
+    DIRBROWSE_GCS = 'DIRBROWSE_GCS',
+    DIRBROWSE_GCS_SENSITIVE = 'DIRBROWSE_GCS_SENSITIVE',
+    DIRBROWSE_AZURE_BLOB = 'DIRBROWSE_AZURE_BLOB',
+    DIRBROWSE_AZURE_BLOB_SENSITIVE = 'DIRBROWSE_AZURE_BLOB_SENSITIVE',
+    DIRBROWSE_ENABLED = 'DIRBROWSE_ENABLED',
+    DIRBROWSE_SENSITIVE = 'DIRBROWSE_SENSITIVE',
 
     // ========================================
     // MASS ASSIGNMENT (MASSASSIGN_*)