/scan-cves

description: Run a focused nuclei CVE sweep against a host or recon directory, optionally filtered by year. Runs log4j-scan in parallel when installed for legacy enterprise stacks. Usage: /scan-cves <host-or-file> [--year 2024] | /scan-cves --recon <recon-dir>

/scan-cves

Targeted nuclei scan of the `cve/` template directory plus optional log4j-scan.

Usage

/scan-cves https://target.com
/scan-cves --recon recon/target.com
/scan-cves --year 2024 recon/target.com/live/urls.txt

Why a separate command

`/recon` already runs a broad nuclei phase across every severity — this command narrows to **known CVEs only**, which:

• Cuts the runtime by an order of magnitude (high/critical CVE templates only).
• Surfaces signals that pay even on dormant programs (CVE-2021-44228 still hits

on legacy enterprise hosts).

• Lets you re-scan one or two URLs without rerunning the full pipeline.

Set `NUCLEI_NO_UPDATE=1` to skip the template update on each run when iterating quickly.

Output

`findings/cve/<timestamp>/`:

• `nuclei_cve.jsonl` — one finding per line (template ID, host, severity)
• `log4j.txt` — optional log4j-scan output when the scanner is installed

After a hit

1. Confirm the version manually (don't trust the template — show the response). 2. Check program scope and reward table; many CVEs are explicitly out-of-scope if the program already disclosed them or is mid-patch. 3. Provide a non-destructive PoC: a single request that proves the version is vulnerable, not a working exploit chain.