{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_vex","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR"}},"lang":"en","notes":[{"category":"summary","text":"A Nuclei v3.8.0 scan of the nvulnlookup vl-web binary v0.1.31 against https://localhost:8080 produced nine medium-severity findings. Exactly one (CVE-2023-0057, missing clickjacking protection) is a genuine hardening gap and is fixed in this advisory by installing a baseline security-headers middleware on every outgoing response. The other eight findings are confirmed false positives: the Nuclei templates match on generic HTTP response shapes (404, 405, 200 without a specific product banner) that coincide with unrelated product vulnerabilities we do not run. This advisory documents both the remediation and the per-finding false-positive disposition so operators can reconcile their own Nuclei reports.","title":"Summary"},{"category":"description","text":"Nuclei templates are string-matching probes against HTTP responses. When run against a server that is NOT the scanned product, the template will still fire if the response shape happens to match the detection signature (e.g., a 404 body that does not contain a specific string, a 200 body without a specific header). This advisory catalogs the nine findings from the 2026-04-22T17-25-55Z scan of vl-web v0.1.31:\n\nReal (fixed): CVE-2023-0057 (clickjacking — missing X-Frame-Options and Content-Security-Policy frame-ancestors directives).\n\nFalse positives (product mismatch or signature artefact):\n  * CVE-2021-44155 — Reprise License Manager user enumeration. vl-web returned 404 to /goform/login_process because that endpoint does not exist; template fired on the 404 body not containing 'Login Failed'. vl-web is not Reprise License Manager.\n  * CVE-2020-11453 — MicroStrategy Web 10.4 SSRF. vl-web returned 404 to /MicroStrategyWS/ because that endpoint does not exist. vl-web is not MicroStrategy.\n  * CVE-2021-22939 — Node.js HTTPS rejectUnauthorized handling. vl-web is a Rust (hyper + rustls) binary, not Node.js. Template fired on a 200 OK response shape.\n  * CVE-2023-0055 — missing `Secure` attribute on Set-Cookie over HTTPS. vl-web does not set any cookies on GET / and does not issue Set-Cookie headers. Template fired on the absence of the attribute in the absence of the header.\n  * ASVS-4-0-3-V13-2-2 — JSON schema validation. vl-web rejects unknown POST targets at `/` with 405 Method Not Allowed. The handler-less root does not read a JSON body, so schema validation is vacuous at that endpoint; JSON-bearing API routes under /api/v1/ DO validate schemas via serde's #[serde(deny_unknown_fields)] contract.\n  * ASVS-4-0-3-V13-3-1 — XSD (XML Schema) validation. vl-web does not accept XML input anywhere; every content-type handler is JSON, form-urlencoded, or empty. Template fired on a 405 response to an XML POST.\n  * ASVS-4-0-3-V13-2-3 — Access Restriction Bypass via Origin spoof (CSRF). vl-web is a read-only public vulnerability aggregator; the GET / surface is cookie-less and has no authenticated session to hijack. The POST / PATCH / DELETE surface IS protected by API-key middleware (see ndaal-sa-2026-017 for the related design discussion).\n  * some-PIIs — a generic template whose extracted-match field is empty ('- ') in the report. No PII regex matched; template produced a finding on the bare fact that a 200 OK was returned.","title":"Vulnerability Description"},{"category":"general","text":"vl-web is the HTTP front-end of the nvulnlookup vulnerability aggregator. It is explicitly designed as a read-mostly public service: anonymous clients can browse CVE records, Debian tracker entries, CNA scorecards, and KEV enrichment. The POST / PATCH / DELETE surface (annotations, sightings, KEV upload, operator actions) is gated by API-key middleware. Cookies are not used for session state anywhere in v0.1.x. The security posture for public-read endpoints therefore focuses on defence-in-depth for browser-based clients: HTTPS enforcement (HSTS), clickjacking protection (X-Frame-Options + CSP frame-ancestors), MIME-sniffing lock-down (X-Content-Type-Options), referrer minimisation (Referrer-Policy), and permission-surface reduction (Permissions-Policy).","title":"Context"},{"category":"other","text":"Disposition: ONE finding is fixed (CVE-2023-0057); EIGHT findings are known_not_affected (confirmed false positives per the reasoning above). Operators running the same Nuclei template set against v0.1.32-or-later binaries should see CVE-2023-0057 disappear; the other eight will continue to fire until the upstream ProjectDiscovery templates add a product fingerprint check.","title":"Disposition"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","issuing_authority":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG Security Team","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory in CSAF 2.1 format","url":"https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/csaf/2026/018/ndaal-sa-2026-018.json"},{"category":"external","summary":"Nuclei DAST artefacts from the 2026-04-22 run that produced these findings","url":"https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/tree/main/documentation/vulnerabilities/nuclei/2026-04-22T17-25-55Z"},{"category":"external","summary":"vl-web source — router pipeline where the security headers are injected","url":"https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/vulnerability-lookup-rs/crates/vl-web/src/router.rs"},{"category":"external","summary":"OWASP Secure Headers Project — rationale for the X-Frame-Options / CSP / HSTS / etc. bundle","url":"https://owasp.org/www-project-secure-headers/"},{"category":"external","summary":"MDN reference — Content-Security-Policy frame-ancestors","url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors"},{"category":"external","summary":"Related advisory — /api/v1 unauthenticated-read is by design","url":"https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/csaf/2026/017/ndaal-sa-2026-017.json"}],"title":"ndaal Security Advisory: vl-web Nuclei scan 2026-04-22 — clickjacking header gap fixed; 8 findings confirmed false positives","tracking":{"current_release_date":"2026-04-22T18:00:00.000Z","generator":{"engine":{"name":"ndaal CSAF Generator","version":"1.0.0"}},"id":"ndaal-sa-2026-018","initial_release_date":"2026-04-22T18:00:00.000Z","revision_history":[{"date":"2026-04-22T18:00:00.000Z","number":"1.0.0","summary":"Initial advisory: install baseline security-headers middleware (fixes CVE-2023-0057); document per-finding false-positive disposition for the other eight Nuclei findings from the 2026-04-22T17-25-55Z scan."}],"status":"final","version":"1.0.0"}},"product_tree":{"branches":[{"category":"vendor","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG","branches":[{"category":"product_name","name":"nvulnlookup","branches":[{"category":"product_version","name":"0.1.31","product":{"name":"nvulnlookup vl-web 0.1.31 — pre-security-headers","product_id":"CSAFPID-0001"}},{"category":"product_version","name":"0.1.31-sec-hdrs","product":{"name":"nvulnlookup vl-web 0.1.31 with the router-level security-headers middleware (this advisory's fix)","product_id":"CSAFPID-0002"}}]}]}]},"vulnerabilities":[{"cve":"CVE-2023-0057","ids":[{"system_name":"ndaal","text":"ndaal-sa-2026-018#clickjacking"},{"system_name":"nuclei-template","text":"clickjacking-check (pyload/pyload signature, fires on absence of X-Frame-Options)"}],"notes":[{"category":"description","text":"vl-web v0.1.31 served every HTML response (including the home dashboard at /) without an X-Frame-Options header and without a Content-Security-Policy frame-ancestors directive. A malicious page could therefore iframe the dashboard and trick an authenticated admin into clicking UI elements (the dashboard's stats / CNA-scorecard / annotation links) by overlaying deceptive chrome. The Nuclei 'clickjacking-check' template matched against pyload/pyload signatures but the underlying risk is generic — any HTML response without frame controls is clickjacking-susceptible.","title":"Technical Description"},{"category":"details","text":"Fix: every response emitted by Router::handle_parts() now flows through apply_security_headers(), which injects a comprehensive baseline: X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Strict-Transport-Security: max-age=63072000; includeSubDomains; preload, Referrer-Policy: no-referrer, Content-Security-Policy (including frame-ancestors 'none', base-uri 'none', form-action 'self', object-src 'none'), Permissions-Policy (deny camera/mic/geolocation/payment/usb/interest-cohort), Cross-Origin-Opener-Policy: same-origin, Cross-Origin-Resource-Policy: same-origin, Cross-Origin-Embedder-Policy: require-corp. This is defence-in-depth — X-Frame-Options is the legacy header that pre-CSP browsers honour, frame-ancestors is the CSP3 directive that modern browsers honour.","title":"Remediation Detail"}],"product_status":{"known_affected":["CSAFPID-0001"],"fixed":["CSAFPID-0002"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to vl-web 0.1.31 with the security-headers middleware (or to v0.1.32-or-later once tagged). The fix is a single ~60-line function in crates/vl-web/src/router.rs that runs unconditionally at the tail of handle_parts(); no configuration is required.","product_ids":["CSAFPID-0001"],"url":"https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/commit/HEAD","date":"2026-04-22T18:00:00.000Z"}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001"]}],"title":"Missing X-Frame-Options and Content-Security-Policy frame-ancestors headers allow clickjacking (CVE-2023-0057)"},{"cve":"CVE-2021-44155","ids":[{"system_name":"ndaal","text":"ndaal-sa-2026-018#fp-reprise"}],"notes":[{"category":"description","text":"Nuclei POSTed to https://localhost:8080/goform/login_process and received HTTP 404 'Not Found' (the endpoint does not exist in vl-web). The template's detection is 'the body does not contain Login Failed' — trivially true for our 9-byte 'Not Found' body. vl-web is not Reprise License Manager; the 404 is the router's default no-match response applied uniformly to every unknown path."}],"product_status":{"known_not_affected":["CSAFPID-0001","CSAFPID-0002"]},"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001","CSAFPID-0002"]}],"title":"Nuclei false-positive: Reprise License Manager 14.2 user enumeration (CVE-2021-44155)","flags":[{"label":"vulnerable_code_not_present","product_ids":["CSAFPID-0001","CSAFPID-0002"]}]},{"cve":"CVE-2020-11453","ids":[{"system_name":"ndaal","text":"ndaal-sa-2026-018#fp-microstrategy"}],"notes":[{"category":"description","text":"Nuclei GET /MicroStrategyWS/ returned HTTP 404 'Not Found'. vl-web is not MicroStrategy Web and does not ship the /MicroStrategyWS/ endpoint. The 404 is the router's default."}],"product_status":{"known_not_affected":["CSAFPID-0001","CSAFPID-0002"]},"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001","CSAFPID-0002"]}],"title":"Nuclei false-positive: MicroStrategy Web 10.4 SSRF (CVE-2020-11453)","flags":[{"label":"vulnerable_code_not_present","product_ids":["CSAFPID-0001","CSAFPID-0002"]}]},{"cve":"CVE-2021-22939","ids":[{"system_name":"ndaal","text":"ndaal-sa-2026-018#fp-nodejs"}],"notes":[{"category":"description","text":"vl-web is a Rust binary built on hyper + rustls, not Node.js. The Nuclei template fired on the bare fact that a 200 OK HTML response was returned for GET /. No Node.js runtime is present; CVE-2021-22939 is a Node core bug that cannot apply to a process that does not link the Node HTTPS library."}],"product_status":{"known_not_affected":["CSAFPID-0001","CSAFPID-0002"]},"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001","CSAFPID-0002"]}],"title":"Nuclei false-positive: Node.js HTTPS rejectUnauthorized undefined handling (CVE-2021-22939)","flags":[{"label":"vulnerable_code_not_present","product_ids":["CSAFPID-0001","CSAFPID-0002"]}]},{"cve":"CVE-2023-0055","ids":[{"system_name":"ndaal","text":"ndaal-sa-2026-018#fp-set-cookie"}],"notes":[{"category":"description","text":"vl-web does not set any cookies on GET /; the response carries no Set-Cookie header at all. The template's matcher ('Set-Cookie without Secure') fired on the absence of the attribute in a header that does not exist. v0.1.x has no cookie-based session state anywhere in the codebase."},{"category":"details","text":"If a future release ever needs cookies, the response-header middleware added by this advisory is the single chokepoint and will enforce Secure; HttpOnly; SameSite=Strict at that time."}],"product_status":{"known_not_affected":["CSAFPID-0001","CSAFPID-0002"]},"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001","CSAFPID-0002"]}],"title":"Nuclei false-positive: Missing Secure attribute on Set-Cookie over HTTPS (CVE-2023-0055)","flags":[{"label":"vulnerable_code_not_present","product_ids":["CSAFPID-0001","CSAFPID-0002"]}]},{"ids":[{"system_name":"ndaal","text":"ndaal-sa-2026-018#fp-asvs-13-2-2"},{"system_name":"asvs","text":"ASVS-4-0-3-V13-2-2"}],"notes":[{"category":"description","text":"Nuclei POSTed a JSON body to https://localhost:8080/ (the dashboard root, GET-only) and received HTTP 405 Method Not Allowed. The template expected either a 200 ok with the body echoed back or a schema-validation error body; the 405 response fooled the matcher. JSON-bearing API routes under /api/v1/ validate their inputs via serde's strict-field deserialisation; every request handler that reads a JSON body uses #[serde(deny_unknown_fields)] on the struct."}],"product_status":{"known_not_affected":["CSAFPID-0001","CSAFPID-0002"]},"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001","CSAFPID-0002"]}],"title":"Nuclei false-positive: ASVS V13.2.2 — JSON schema validation does not take place","flags":[{"label":"vulnerable_code_not_present","product_ids":["CSAFPID-0001","CSAFPID-0002"]}]},{"ids":[{"system_name":"ndaal","text":"ndaal-sa-2026-018#fp-asvs-13-3-1"},{"system_name":"asvs","text":"ASVS-4-0-3-V13-3-1"}],"notes":[{"category":"description","text":"Nuclei POSTed an XML body to https://localhost:8080/. vl-web has no XML content-type handler anywhere in the code base — every endpoint consumes JSON or application/x-www-form-urlencoded. The server returned 405 Method Not Allowed; the template interpreted that as 'no schema validation'. XSD validation is not applicable because there is no XML input surface to validate."}],"product_status":{"known_not_affected":["CSAFPID-0001","CSAFPID-0002"]},"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001","CSAFPID-0002"]}],"title":"Nuclei false-positive: ASVS V13.3.1 — XSD schema validation does not take place","flags":[{"label":"vulnerable_code_not_present","product_ids":["CSAFPID-0001","CSAFPID-0002"]}]},{"ids":[{"system_name":"ndaal","text":"ndaal-sa-2026-018#fp-asvs-13-2-3"},{"system_name":"asvs","text":"ASVS-4-0-3-V13-2-3"}],"notes":[{"category":"description","text":"vl-web is a read-only public vulnerability aggregator. GET endpoints carry no cookies and no authenticated session state — an attacker who successfully spoofs the Origin header still retrieves the same anonymous data any user could retrieve directly. The POST / PATCH / DELETE surface (annotations, sightings, KEV upload, operator routes) IS gated by the API-key middleware documented in ndaal-sa-2026-017, which takes the key from the X-API-Key header rather than from a cookie — Origin spoofing does not bypass that check. The Nuclei template fired because the GET / response lacks an Origin-validating 403, which is correct behaviour for an unauthenticated public read."}],"product_status":{"known_not_affected":["CSAFPID-0001","CSAFPID-0002"]},"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001","CSAFPID-0002"]}],"title":"Nuclei false-positive: ASVS V13.2.3 — Access restriction bypass via Origin spoof","flags":[{"label":"vulnerable_code_not_present","product_ids":["CSAFPID-0001","CSAFPID-0002"]}]},{"ids":[{"system_name":"ndaal","text":"ndaal-sa-2026-018#fp-some-piis"}],"notes":[{"category":"description","text":"The Nuclei template 'some-PIIs' (author: ax01sec) reports 'Extracted results: - ' — an empty match string, i.e. no PII regex actually matched. The template emits a finding on every 200 OK HTML response regardless of whether any PII-shaped string was extracted. The dashboard's served HTML is Bootstrap chrome, Askama-rendered vulnerability metadata, and public CVE / advisory data — none of which contains PII. This is a known-noisy template; upstream ProjectDiscovery has not quality-gated it."}],"product_status":{"known_not_affected":["CSAFPID-0001","CSAFPID-0002"]},"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001","CSAFPID-0002"]}],"title":"Nuclei false-positive: some-PIIs (empty-match PII template)","flags":[{"label":"vulnerable_code_not_present","product_ids":["CSAFPID-0001","CSAFPID-0002"]}]}]}