BUG : No CVEids only OSV AND fake results

[4FunAndProfit]

Hello @prabhu ,

EDIT: I think it comes from NVD source: search for example cve-2025-47453 from vdb it will result no result! EDIT2: wrong example sorry

A strange behavior for the last days:

when I search for cpe:2.3:a:php:php:*:*:*:*:*:*:*:* I have no more CVE which are found only OSV ones:

It is very very problematic as the big big majority of users will search to get cve

ALSO : no results for : vdb --search "cpe:2.3:a:php:php:5.2.6:*:*:*:*:*:*:*"

             ___
  /\  ._  ._  | |_  ._ _   _. _|_
 /--\ |_) |_) | | | | (/_ (_|  |_
      |   |

No results found! 

I think it is related to the above bug

[prabhu]

https://github.com/AppThreat/vuln-list/blob/main/nvd/2025/CVE-2025-47453.json

It says Awaiting Analysis without any CPE strings or PURLs. I am unable to find this CVE in the VDB from any source, even when querying with SQLite directly.

The results shown for cpe:2.3:a:php:php:*:*:*:*:*:*:*:*:* while not useful are actually correct. This is because the search string says show me all vulnerabilities across all versions of PHP.

Are there other sources for PHP?

[4FunAndProfit]

Effectively sorry for cve-2025-47453 wrong example, it seems to work with CVE-2022-4900 for example, my bad!

Why NVD is not used for PHP ?

[4FunAndProfit]

Because here with OSV, the search by version etc does not work, only *
With NVD ones it works with version check

[4FunAndProfit]

@prabhu I really think it is NVD source correlation which is broken, until few days it was working with php version x and reporting CVEs
Now it is only OSV and there is a lot of missing CVEs and search by cpe with version does not work anymore

[4FunAndProfit]

See here: https://www.cvedetails.com/version-list/74/128/1/PHP-PHP.html 702 vulns for PHP -> 67 with vdb
See here: https://www.cvedetails.com/version/404989/PHP-PHP-5.2.6.html 302 vulns for PHP 5.2.6 -> 0 with vdb

[pombredanne]

IMHO the CVE is borderline like many from patchstack, I think they are abusing the system with 10,000+ CVEs submitted https://nvd.nist.gov/vuln/cvmap/report/19834

As the most active CNA, this looks suspect https://cnascorecard.org/cna/index.html ... this is a not a highly rated CNA either. (See also that wordfence and patchstack are both in the top CNAs)

So they are likely trying to inflate the issues as a marketing engine by crying wolf! That's a core issue wrt CVE ...

Either that, or all the wordfence and patchstack CVEs are legit and the world should fall apart just now.

They are held in such a high respect that some tools (like this from SUSE) entirely ignore these references:

• https://github.com/neuvector/vul-source/blob/317feb10cc54544f7e544edea1bfa8e159e9b77e/ubuntu-cve-tracker/scripts/check-cves#L154

That said, we could extract better details from the CVE records they provide

• GHSA-qw6m-wwcp-hjpw has no details
• https://nvd.nist.gov/vuln/detail/CVE-2025-47453 has no details
• https://patchstack.com/database/wordpress/plugin/wp-smart-import/vulnerability/wordpress-wp-smart-import-1-1-3-local-file-inclusion-vulnerability?_s_id=cve has all details, but no API, and the data is under a proprietary license.
• https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/47xxx/CVE-2025-47453.json#L44 has the data and we should squeeze a PURL from that.

[pombredanne]

@prabhu let's start to work and combine all these (e.g. this and vulnerablecode)

[4FunAndProfit]

Thanks @pombredanne for the WIP! :) But I think it might not resolve this bug: https://github.com/AppThreat/vuln-list/blob/main/nvd/2022/CVE-2022-4900.json is complete for example and not shown in vdb search cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

I think it is real pb in vdb or in sql query here @prabhu ?

[4FunAndProfit]

Hello @prabhu , any news on this one? :)

[prabhu]

I revisited this issue today. The particular CVE is still under analysis as per NVD without updates.

https://github.com/AppThreat/vuln-list/blob/main/nvd/2025/CVE-2025-47453.json