Bulletdev · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026
diff --git a/README.md b/README.md
@@ -103,13 +103,13 @@
 
 ```bash
 ./gradlew shadowJar
-java -jar build/libs/anarcry-1.3.jar
+java -jar build/libs/anarcry-1.4.1.jar
 ```
 
 With `.env.local` for pre-configured targets:
 
 ```bash
-java -jar build/libs/anarcry-1.3.jar --env .env.local
+java -jar build/libs/anarcry-1.4.1.jar --env .env.local
 ```
 
 ---
@@ -243,7 +243,7 @@ Two operational modes: **Target** (main scan interface) and **Repeater** (HTTP r
 ## 06 - Testing
 
 ```bash
-./gradlew test              # unit + harness (no network) -- 113 tests
+./gradlew test              # unit + harness (no network) -- 125 tests
 ./gradlew integrationTest   # tests with external hosts (badssl.com, etc.)
 ```
 
@@ -334,6 +334,19 @@ ScanRunner.run(ScanContext)
 
 ## 09 - Changelog
 
+### v1.4.1
+
+- **Knowledge base CVE enrichment**: 71 real-world CVEs added across 7 vulnerability classes (JWT, SQLi, SSRF, XSS, XXE, SSTI, LFI) sourced from MITRE CVE List v5
+
+### v1.4
+
+- **Intra-module parallelism**: ProbeExecutor with virtual threads (bounded concurrency, default 12) -- SQLi, XSS, LFI, CmdInjection, SSRF, SSTI, OpenRedirect, Crawler refactored for parallel payload dispatch
+- **Severity from CVSS**: `Severity.fromScore()` using NIST NVD ranges -- severity is now always derived from the CVSS score, not hardcoded per module
+- **Per-finding CVSS vectors**: JWT (6 finding types, LOW to CRITICAL) and CORS (4 finding types, MEDIUM to CRITICAL) carry per-finding vectors instead of flat module-level severity
+- **WAF/403 detection**: HeadersModule detects known WAFs (Cloudflare, Akamai, etc) on HTTP 403, emits single INFO finding instead of false positive header findings
+- **Register orphaned modules**: SQLi, XSS, LFI, CmdInjection wired into ScanRunner + both UIs
+- **GUI fixes**: RepeaterView catch-all error handling + button re-enable; SiteMapView selection with full URL + click-to-copy; FindingDetailDialog multi-step repro split
+
 ### v1.3
 
 - **Swing GUI migration**: full Swing + FlatLaf GUI replacing Lanterna TUI (Dashboard, Scan, Target, Findings, Repeater, Report, SiteMap tabs)

diff --git a/anarchrypto b/anarchrypto
@@ -1,5 +1,5 @@
 #!/bin/bash
-JAR="$(dirname "$(realpath "$0")")/build/libs/anarcry-1.4.jar"
+JAR="$(dirname "$(realpath "$0")")/build/libs/anarcry-1.4.1.jar"
 SELF="$(realpath "$0")"
 
 if [ ! -f "$JAR" ]; then
@@ -21,7 +21,7 @@ if [ "$TUI_MODE" = true ]; then
             exec kitty \
                 --override initial_window_width=180c \
                 --override initial_window_height=82c \
-                --title "AnarCry v1.4" \
+                --title "AnarCry v1.4.1" \
                 bash "$SELF" "$@"
         fi
         printf '\e[8;54;220t'

diff --git a/build.gradle b/build.gradle
@@ -8,7 +8,7 @@ plugins {
 }
 
 group = 'gg.effront'
-version = '1.4'
+version = '1.4.1'
 
 java {
     toolchain {

diff --git a/knowledge-base/jwt_signature_bypass.md b/knowledge-base/jwt_signature_bypass.md
@@ -102,6 +102,24 @@ Casos reais e mentalidade de ataque (RWBH): em APIs mobile e SSO de programas co
 - **Paths comuns:** `/api/me`, `/api/v1/user`, `/oauth/token`, `/oauth/introspect`, `/.well-known/jwks.json`, `/login`, `/admin`, `/graphql`.
 - **Sinais:** JWT em cookies (`access_token`, `session`), header `alg` refletido, JWKS público, `kid` previsível, ausência de `exp`/`aud`.
 
+## Notable CVEs
+
+| CVE | Produto | Ano | Descricao | Tecnica |
+|-----|---------|-----|-----------|---------|
+| CVE-2018-0114 | Cisco node-jose | 2018 | Atacante re-assina tokens usando chave embarcada no proprio token | JWK Injection |
+| CVE-2018-1000539 | Nov json-jwt (Ruby) | 2018 | Verificacao incorreta de assinatura em AES-GCM JWE | Signature Bypass |
+| CVE-2019-7644 | Auth0 WCF-Service-JWT | 2019 | Assinatura esperada vazada em mensagem de erro | Signature Disclosure |
+| CVE-2019-20933 | InfluxDB | 2020 | Bypass de autenticacao via SharedSecret vazio no JWT | Empty Secret |
+| CVE-2020-15084 | Auth0 express-jwt | 2020 | Campo algorithms nao enforced -- fallback para none | alg:none Bypass |
+| CVE-2020-28042 | ServiceStack | 2020 | Verificacao de assinatura aceita tokens com signature de tamanho zero | Null Signature |
+| CVE-2021-46743 | Firebase PHP-JWT | 2022 | Confusao de algoritmo RS256/HS256 via kid em key ring misto | Algorithm Confusion |
+| CVE-2022-21449 | Oracle Java SE 17/18 | 2022 | "Psychic Signatures" -- ECDSA aceita assinatura (0,0) como valida | ECDSA Bypass |
+| CVE-2022-23540 | Auth0 jsonwebtoken | 2022 | jwt.verify() sem algoritmo definido faz fallback para none | alg:none Bypass |
+| CVE-2022-39227 | python-jwt | 2022 | Spoofing de identidade por manipulacao de claims verificados | Token Forgery |
+| CVE-2024-21664 | lestrrat-go/jwx | 2024 | Campo signature presente em payload JSON causa parsing incorreto | Signature Bypass |
+| CVE-2024-37568 | Authlib (Python) | 2024 | Confusao de algoritmo -- HMAC verificado com chave publica assimetrica | Algorithm Confusion |
+| CVE-2024-54150 | xmidt-org cjwt (C) | 2024 | Confusao de tipo de assinatura permite bypass completo | Algorithm Confusion |
+
 ## Recommendation
 1. Fixar o algoritmo esperado por endpoint; nunca confiar no `alg` do token. Rejeitar `none` explicitamente.
 2. Usar bibliotecas maduras e atualizadas (jjwt, Nimbus JOSE+JWT, Spring Security OAuth2 Resource Server) e validar `iss`, `aud`, `exp`, `nbf`, `iat`, `sub`.

diff --git a/knowledge-base/lfi.md b/knowledge-base/lfi.md
@@ -99,6 +99,20 @@ Bypasses de filtros:
 
 Casos reais e mentalidade de ataque (RWBH): Yahoo e Uber (downloads/templates) mostram leitura de arquivos e log poisoning; o atacante testa `../`, wrappers PHP, upload + LFI e caminhos absolutos.
 
+## Notable CVEs
+
+| CVE | Produto | Ano | Descricao | Tipo |
+|-----|---------|-----|-----------|------|
+| CVE-2019-19781 | Citrix ADC/Gateway | 2019 | Path traversal sem autenticacao -- leitura de config e RCE via template injection encadeado | Path traversal + RCE |
+| CVE-2020-5410 | Spring Cloud Config | 2020 | Path traversal via symlink permite leitura de arquivos arbitrarios do servidor | Path traversal |
+| CVE-2021-21972 | VMware vCenter | 2021 | Path traversal + upload no plugin vSphere Client -- RCE pre-auth | Upload + path traversal |
+| CVE-2021-41773 | Apache HTTP Server 2.4.49 | 2021 | Normalizacao de path quebrada permite directory traversal com %2e -- leitura de arquivo e CGI RCE | Path traversal |
+| CVE-2021-42013 | Apache HTTP Server 2.4.50 | 2021 | Bypass do fix de CVE-2021-41773 com double-encoding (%%32%65) -- mesma exploracao | Double-encoding bypass |
+| CVE-2023-25690 | Apache HTTP Server | 2023 | Request smuggling via mod_proxy com RewriteRule -- manipulacao de path interno | Smuggling + path traversal |
+| CVE-2024-4577 | PHP (Windows CGI) | 2024 | Arg injection em PHP-CGI via Best-Fit encoding no Windows -- leitura de arquivo e RCE | Arg injection + file read |
+| CVE-2024-21887 | Ivanti Connect Secure | 2024 | Command injection em componente web -- encadeado com auth bypass para RCE pre-auth | Command injection |
+| CVE-2024-23897 | Jenkins CLI | 2024 | Leitura arbitraria de arquivo via parser de argumentos com '@' -- expandsAtFiles | File read via CLI |
+
 ## Target Context (Crawler Hints)
 - **Parâmetros comuns:** `file`, `path`, `page`, `template`, `lang`, `locale`, `include`, `require`, `view`, `doc`, `folder`, `download`, `filename`, `image`, `attachment`, `module`, `theme`, `layout`.
 - **Paths comuns:** `/download`, `/file`, `/view`, `/include`, `/template`, `/locale`, `/lang`, `/export`, `/attachment`, `/image`, `/api/files`, `/render`.

diff --git a/knowledge-base/sql_injection.md b/knowledge-base/sql_injection.md
@@ -117,6 +117,25 @@ Casos reais e mentalidade de ataque (RWBH): Yahoo (busca/filtros) e Uber (APIs i
 - **Paths comuns:** `/api/*`, `/login`, `/search`, `/products`, `/reports`, `/admin`, `/graphql`, `/export`, `/filter`.
 - **Sinais:** erros SQL; diferença de resposta entre `1=1` e `1=2`; atraso com `SLEEP`; `ORDER BY` com erro; parâmetros numéricos sem validação.
 
+## Notable CVEs
+
+| CVE | Produto | Ano | Descricao | Tipo |
+|-----|---------|-----|-----------|------|
+| CVE-2023-34362 | MOVEit Transfer | 2023 | SQLi em endpoint de transferencia -- explorado em massa pelo grupo Cl0p, comprometeu centenas de organizacoes | Blind SQLi (pre-auth) |
+| CVE-2023-48788 | Fortinet FortiClientEMS | 2023 | SQLi no servico de gerenciamento de endpoints -- permite execucao remota via DBA | SQLi to RCE (pre-auth) |
+| CVE-2020-12271 | Sophos XG Firewall | 2020 | SQLi em SFOS explorado in-the-wild (Asnarok campaign) -- atacantes injetaram trojan via interface de gerenciamento | In-band SQLi (pre-auth) |
+| CVE-2024-50330 | Ivanti Endpoint Manager | 2024 | SQLi remoto sem autenticacao no EPM -- permite comprometimento total do servidor de gerenciamento | Unauth SQLi |
+| CVE-2024-1597 | PostgreSQL JDBC (pgjdbc) | 2024 | SQLi no driver JDBC quando PreferQueryMode=SIMPLE -- afeta qualquer app Java usando pgjdbc com essa config | Driver-level SQLi |
+| CVE-2023-34991 | Fortinet FortiWLM | 2023 | SQLi no gerenciador wireless -- permite acesso nao autenticado a dados da rede | Unauth SQLi |
+| CVE-2024-45387 | Apache Traffic Control | 2024 | SQLi no Traffic Ops -- usuario privilegiado executa queries arbitrarias (CVSS 9.9) | Auth SQLi |
+| CVE-2023-0016 | SAP BPC MS 10.0 | 2023 | SQLi no Business Planning and Consolidation -- execucao de queries arbitrarias por atacante nao autenticado | Unauth SQLi |
+| CVE-2023-0620 | HashiCorp Vault | 2023 | SQLi no backend de storage MSSQL do Vault -- permite manipulacao de secrets armazenados | Config-dependent SQLi |
+| CVE-2024-27304 | pgx (Go PostgreSQL driver) | 2024 | SQLi no driver pgx para Go -- single query ou bind message permite injecao (CVSS 9.8) | Driver-level SQLi |
+| CVE-2024-8275 | The Events Calendar (WordPress) | 2024 | SQLi via parametro 'order' -- plugin com 800k+ instalacoes ativas | Unauth SQLi |
+| CVE-2024-12727 | Sophos Firewall | 2024 | SQLi pre-auth no email protection feature -- permite code execution remoto | SQLi to RCE (pre-auth) |
+
+Fonte: cvelistV5 (MITRE CVE List v5 dataset)
+
 ## Recommendation
 1. Usar queries parametrizadas/prepared statements em todas as consultas, incluindo `IN`, `ORDER BY`, `LIMIT` e relatórios.
 ```java

diff --git a/knowledge-base/ssrf.md b/knowledge-base/ssrf.md
@@ -111,6 +111,23 @@ Casos reais e mentalidade de ataque (RWBH): Uber (fetch de imagens/avatares), Fa
 - **Paths comuns:** `/api/fetch`, `/api/proxy`, `/api/image`, `/upload`, `/avatar`, `/webhook`, `/import`, `/preview`, `/screenshot`, `/render`, `/pdf`, `/integrations`, `/graphql`.
 - **Sinais:** URL completa aceita; parâmetro `url` refletido em requisição server-side; funcionalidades de importação, preview, avatar, webhook, geração de PDF/screenshot; SSRF cego via DNS/HTTP OOB.
 
+## Notable CVEs
+
+| CVE | Produto | Ano | Descricao | Tipo |
+|-----|---------|-----|-----------|------|
+| CVE-2021-26855 | Microsoft Exchange Server | 2021 | ProxyLogon -- SSRF pre-auth via endpoint /owa/auth/x.js permite acessar mailboxes arbitrarias e pivotar para RCE | Pre-auth SSRF |
+| CVE-2021-21975 | VMware vRealize Operations | 2021 | SSRF na API permite ator com acesso de rede ler dados internos sem autenticacao | Pre-auth SSRF |
+| CVE-2021-21973 | VMware vCenter Server | 2021 | SSRF via validacao impr. de URLs em plugin do vSphere Client (porta 443) -- permite scan de rede interna | Pre-auth SSRF |
+| CVE-2021-40438 | Apache HTTP Server (mod_proxy) | 2021 | URI crafted faz mod_proxy encaminhar request para origin server escolhido pelo atacante -- afeta <= 2.4.48 | Proxy SSRF |
+| CVE-2022-22947 | Spring Cloud Gateway | 2022 | Code injection via Gateway Actuator endpoint exposto permite RCE e SSRF em versoes < 3.1.1+ e < 3.0.7+ | Actuator SSRF |
+| CVE-2022-41040 | Microsoft Exchange Server | 2022 | ProxyNotShell -- SSRF autenticada combinada com CVE-2022-41082 para RCE; bypass do patch do ProxyLogon | Auth SSRF + RCE |
+| CVE-2024-21893 | Ivanti Connect Secure / Policy Secure | 2024 | SSRF no componente SAML permite acessar recursos restritos sem autenticacao | SAML SSRF |
+| CVE-2020-13379 | Grafana 3.0.1 -- 7.0.1 | 2020 | SSRF na feature de avatar permite qualquer usuario nao autenticado forcar Grafana a enviar HTTP requests para URLs arbitrarias | Avatar SSRF |
+| CVE-2020-26258 | XStream < 1.4.15 | 2020 | SSRF ativada durante unmarshalling de XML -- permite leitura de recursos internos via desserializacao | Deserialization SSRF |
+| CVE-2020-28168 | Axios NPM 0.21.0 | 2020 | Bypass de proxy via URL que responde com redirect para host restrito -- permite SSRF client-side | Redirect SSRF |
+
+**Fontes**: CVE List v5 (cvelistV5), NVD, advisories dos vendors.
+
 ## Recommendation
 1. Preferir allowlist de hosts, portas e esquemas necessários; nunca aceitar URL arbitrária.
 2. Resolver o DNS no servidor, validar todos os IPs retornados e bloquear faixas privadas, loopback, link-local, multicast e metadata. Repetir a validação após cada redirect.

diff --git a/knowledge-base/ssti.md b/knowledge-base/ssti.md
@@ -101,6 +101,20 @@ Bypasses de WAF/filtros:
 
 Casos reais e mentalidade de ataque (RWBH): Uber (templates de e-mail/notificação) e outros programas mostram que o bug aparece em previews, relatórios e mensagens; o atacante identifica o engine por `{{7*7}}`/`${7*7}` e escala para reflexão e RCE.
 
+## Notable CVEs
+
+| CVE | Produto | Ano | Descricao | Tipo |
+|-----|---------|-----|-----------|------|
+| CVE-2019-3396 | Confluence Server | 2019 | SSTI via Widget Connector macro -- path traversal + RCE sem autenticacao | Velocity (RCE) |
+| CVE-2019-11581 | Jira Server | 2019 | SSTI em ContactAdministrators e SendBulkMail -- RCE via template Velocity | Velocity (RCE) |
+| CVE-2019-8341 | Jinja2 | 2019 | SSTI em from_string() quando source vem de input do usuario -- RCE em Python | Jinja2 (RCE) |
+| CVE-2019-10074 | Apache OFBiz | 2019 | RCE via Freemarker markup em campo textarea de Form Widget | Freemarker (RCE) |
+| CVE-2020-11994 | Apache Camel | 2020 | SSTI nos componentes de templating -- file disclosure e RCE | Multi-engine (RCE) |
+| CVE-2020-1961 | Apache Syncope | 2020 | SSTI em mail templates -- injeccao de template em notificacoes | Multi-engine (RCE) |
+| CVE-2021-39115 | Jira Service Management | 2021 | RCE via template injection para usuarios Jira Administrators | Velocity (RCE) |
+| CVE-2022-22954 | VMware Workspace ONE | 2022 | RCE pre-auth via server-side template injection -- explorado in-the-wild | Server-side (RCE) |
+| CVE-2023-22527 | Confluence Data Center | 2024 | Template injection pre-auth em versoes antigas -- RCE sem credenciais | OGNL (RCE) |
+
 ## Target Context (Crawler Hints)
 - **Parâmetros comuns:** `name`, `message`, `subject`, `template`, `preview`, `content`, `body`, `title`, `email`, `username`, `comment`, `description`, `lang`, `theme`.
 - **Paths comuns:** `/preview`, `/render`, `/email/preview`, `/template`, `/report`, `/invoice`, `/notification`, `/admin/templates`, `/api/render`.

diff --git a/knowledge-base/xss.md b/knowledge-base/xss.md
@@ -110,6 +110,23 @@ Casos reais e mentalidade de ataque (RWBH): Twitter (stored XSS em perfis/tweets
 - **Paths comuns:** `/search`, `/login`, `/profile`, `/comments`, `/messages`, `/upload`, `/error`, `/redirect`, `/api/*`, `/admin`, `/support`.
 - **Sinais:** entrada refletida sem escape; `innerHTML`/`document.write`; `eval`; `postMessage` sem validação; CSP ausente ou permissiva; resposta com `text/html` para entrada do usuário.
 
+## Notable CVEs
+
+| CVE | Produto | Ano | Descricao | Tipo |
+|-----|---------|-----|-----------|------|
+| CVE-2020-11022 | jQuery 1.12.0 -- 3.5.0 | 2020 | HTML de fontes nao confiaveis passado para .html()/.append() pode executar XSS mesmo apos sanitizacao | DOM XSS |
+| CVE-2020-11023 | jQuery 1.0.3 -- 3.5.0 | 2020 | Elementos option em HTML nao confiavel passado para metodos de manipulacao DOM causam XSS | DOM XSS |
+| CVE-2021-41184 | jQuery UI < 1.13.0 | 2021 | Opcao `of` do .position() aceita input nao confiavel que executa codigo arbitrario | DOM XSS |
+| CVE-2023-29489 | cPanel < 11.109.9999.116 | 2023 | XSS refletido na pagina de erro do cpsrvd via webcall ID invalido -- pre-auth, afeta milhoes de servidores | Reflected XSS |
+| CVE-2024-4367 | Mozilla PDF.js (Firefox < 126) | 2024 | Type check ausente no handling de fontes em PDF.js permite execucao de JavaScript arbitrario no contexto do viewer | DOM XSS |
+| CVE-2023-44389 | Zope | 2023 | Propriedade title de objetos Zope aceita script code que executa ao visualizar o objeto no Zope Management Interface | Stored XSS |
+| CVE-2024-25600 | WordPress Bricks Builder <= 1.9.6 | 2024 | Code injection via builder permite RCE sem autenticacao -- vetor inicial via XSS em templates | Stored XSS / RCE |
+| CVE-2022-29078 | EJS 3.1.6 (Node.js) | 2022 | Server-side template injection via settings[view options][outputFunctionName] permite execucao de codigo arbitrario | SSTI / XSS |
+| CVE-2023-6553 | WordPress Backup Migration <= 1.3.7 | 2023 | RCE via /includes/backup-heart.php sem autenticacao -- frequentemente encadeado com XSS para persistence | RCE via injection |
+| CVE-2022-35914 | GLPI <= 10.0.2 (htmlawed) | 2022 | PHP code injection via htmLawedTest.php exposto -- modulo de sanitizacao HTML exploitavel | Stored XSS / RCE |
+
+**Fontes**: CVE List v5 (cvelistV5), NVD, advisories dos vendors.
+
 ## Recommendation
 1. Codificar a saída conforme o contexto (HTML entity, attribute, JavaScript, URL, CSS) usando funções nativas do framework.
 2. Nunca inserir entrada do usuário em `innerHTML`, `document.write`, `eval`, `Function`, `setTimeout(string)`; usar `textContent` e APIs seguras.

diff --git a/knowledge-base/xxe.md b/knowledge-base/xxe.md
@@ -108,6 +108,19 @@ Billion Laughs:
 
 Casos reais e mentalidade de ataque (RWBH): Yahoo (parsers XML em mail/upload) e Facebook (DOCX/XLSX) mostram que o vetor não é só SOAP; o atacante testa SVG, DOCX, SAML e OOB quando a resposta não reflete o arquivo.
 
+## Notable CVEs
+
+| CVE | Produto | Ano | Descricao | Tipo |
+|-----|---------|-----|-----------|------|
+| CVE-2018-17247 | Elasticsearch | 2018 | XXE no find_file_structure API do ML -- leitura de arquivo e SSRF se policy de rede permitir | File disclosure |
+| CVE-2018-20843 | libexpat | 2019 | Billion Laughs via nomes XML com muitos colons -- DoS exponencial no parser | DoS (entity expansion) |
+| CVE-2019-12415 | Apache POI | 2019 | XXE ao converter documentos Excel via XSSFExportToXml -- leitura de arquivo local | File disclosure |
+| CVE-2018-11788 | Apache Karaf | 2019 | XXE via features deployer no hot deploy -- permite resolver entidades externas | File disclosure |
+| CVE-2020-26258 | XStream | 2020 | SSRF via XXE em deserializacao XML -- atacante controla URL de entidade externa | SSRF via XXE |
+| CVE-2020-26259 | XStream | 2020 | Delecao arbitraria de arquivo via deserializacao XML maliciosa | File manipulation |
+| CVE-2021-23926 | Apache XMLBeans | 2021 | Parser XML sem properties de seguranca -- Billion Laughs e XXE out-of-band | OOB + DoS |
+| CVE-2021-29505 | XStream | 2021 | RCE via desserializacao de objeto embarcado em XML | RCE via XML |
+
 ## Target Context (Crawler Hints)
 - **Parâmetros comuns:** `xml`, `data`, `document`, `file`, `upload`, `content`, `body`, `payload`, `svg`, `feed`, `soap`, `saml`, `config`.
 - **Paths comuns:** `/api/import`, `/upload`, `/xml`, `/soap`, `/saml`, `/parse`, `/convert`, `/preview`, `/avatar`, `/invoice`, `/export`.