Templates that carry the CNVD tag. It is not a CNCERT product and not a live Chinese national vulnerability database. Treat it as another matcher tag, not a feed.

Is this the ten-stack scan?

No. [Scan for Technology-Specific Vulnerabilities](/library/modules/scan-for-technology-specific-vulnerabilities) runs curated checks for ten named stacks and needs fingerprint output. This module is stack-agnostic CVE and CNVD matchers on a URL list.

No. This is not a dependency-tree scan and not a JavaScript library inventory. retire.js inventories outdated JS libraries; this module runs HTTP matchers against live URLs for CVE and CNVD tagged issues.

Does it exploit the CVEs?

No. The matchers prove the ID is present. Exploitation is a separate step you run yourself. "PoC scanning" in the README means matcher-based HTTP checks.

Is this a live CVE feed or a daily plugin drop?

No. A finding means a matcher fired for a published ID. Coverage is the template pack at scan time, not a live NVD query, not CISA KEV, and not a daily feed. Treat CNVD as another matcher tag, not a live national database.

Does it scan nested paths under the origin?

Only if you seed them. A root-only URL list misses nested instances. v1.2.0 added recursive scanning at every level of the input URL path; use it, and know recursion explodes request counts. Feed deeper URLs from crawling or directory brute force when the app lives under a prefix.

2026-08-13

Vulnerability Scanning

Scan for Outdated Software

CVE scanning for known CVE and CNVD issues on a URL list. Matcher-based checks flag outdated software with published IDs. Not a live feed, not SCA.

What Scan for Outdated Software does

CVE scanning for outdated software asks a focused question: does this running version have a public, matcher-proven vulnerability ID? This module runs HTTP matcher templates tagged CVE or CNVD against a URL list and reports the IDs that fire. It is not a live NVD feed, not SCA, and not setup hardening.

You feed a URL list. This module runs HTTP matcher templates tagged CVE or CNVD against those live URLs. A finding is a matcher hit for a published ID, not a live NVD query and not an SCA inventory. Coverage is the template pack at scan time.

Where it fits in the pipeline

Illustrative excerpt. Each node is a Trickest module.

Pipeline guidance

Upstream: live URLs from Probe for Web Servers. Nested path seeds from Discover Paths via Crawling, Discover Paths via Directory Brute Force, or Discover Paths via OSINT Sources.
Downstream: findings into Generate Scan Report.
Parallel: the other five URL-list scanners on the same urls face. Same contract, different artifact class, unswappable H1s. Scan for Technology-Specific Vulnerabilities is not a sixth row here; it consumes fingerprint output, not this urls face.

This family sits on the web tail after probe (hosts -> probe-web -> this family). The named-stack checks sit later: hosts -> probe-web -> web FP -> tech-specific. Do not cross-wire into hosts -> open-ports -> network FP.

When to use this

Nest this after you have live web URLs and you want to know which of those URLs hit a published CVE or CNVD matcher. A root-only URL list misses nested instances; seed deeper paths from crawling or directory brute force when the vulnerable app lives under a prefix. This is stack-agnostic matching on urls. If you already named a stack and want the closed ten-stack checks, that is a different module.

Inputs and outputs

Required: urls (FILE): live web server URLs, one per line. Example: https://foo.example.com, https://bar.example.com.
Optional: header (STRING): header(s) to include in HTTP requests.
header-file (FILE): file of header(s) to include.
rate-limit (STRING): max requests per second per machine. Default 300.
findings: JSONLines rows. Published fields: finding, location, severity, hostname, domain_name, method, description, and the triggering request. Example rows: WordPress HTML5 Video Player SQL Injection (critical), Citrix Gateway and Citrix ADC Cross-Site Scripting (medium).

Data

The tables this module produces. Sample rows are illustrative.

findings10 columns · 3 sample rows

Matcher hits for published CVE and CNVD IDs against the live URL list.

	findingtext	locationurl	severitytext	matchestext	descriptiontext	hostnametext	domain_nametext	ip_addresstext	methodtext	fieldtext
1	WordPress HTML5 Video Player SQL Injection	https://blog.example.com/wp-content/plugins/html5-video-player/	critical	CVE-2024-1234	HTML5 Video Player plugin below 1.2 is vulnerable to SQL injection.	blog.example.com	example.com	203.0.113.10	GET
2	Citrix Gateway Cross-Site Scripting	https://gateway.example.com/	medium	CVE-2024-5678	Citrix Gateway and Citrix ADC cross-site scripting.	gateway.example.com	example.com	198.51.100.25	GET
3	Apache Struts Remote Code Execution	https://legacy.example.com/struts.action	critical	CVE-2024-9012	Apache Struts 2.5.x RCE via OGNL injection.	legacy.example.com	example.com	203.0.113.40	POST	action

How it differs from similar modules

Misconfigured software

Artifact class it owns

Insecure setup: APIs, debug, default-state takeover

Upstream it needs

live urls

Scan for Outdated Software

Artifact class it owns

Known CVE/CNVD HTTP matchers

Upstream it needs

live urls

Sensitive files

Artifact class it owns

Configs, logs, .git, .env

Upstream it needs

live urls

Exposed admin panels

Artifact class it owns

Upstream it needs

live urls

Exposed backups

Artifact class it owns

Hostname-named .bak/.sql/archives

Upstream it needs

live urls

Exposed secrets

Artifact class it owns

Token patterns in the live HTTP response

Upstream it needs

live urls

Do not 301 any of these six onto each other. Do not 301 this page onto /tools/nuclei (different object: flags and the full catalog, not this URL-list job).

questions