> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/vulnerability-classification/cve.md).

# CVE

**CVE** stands for **Common Vulnerabilities and Exposures**.

It’s a **public identifier** (like an ID number) assigned to a specific **security vulnerability** in software or hardware.

Each CVE helps security professionals talk about and track vulnerabilities in a consistent way.

#### **CVE Format**

A CVE ID follows this format:

```
CVE–YYYY–XXXX
```

* **YYYY** → the year the CVE was published or assigned.
* **XXXX** → a unique number for that vulnerability.

**Example:** `CVE-2021-44228` → The famous Log4Shell vulnerability in Apache Log4j.

#### **Who Manages CVE?**

The CVE system is maintained by **MITRE Corporation**, with support from the **U.S. Department of Homeland Security (DHS)** and the **Cybersecurity and Infrastructure Security Agency (CISA)**.

#### **How CVE Works (Simplified Flow)**

1. A researcher finds a vulnerability.
2. They report it to a **CVE Numbering Authority (CNA)**.
3. The CNA verifies it and assigns a **CVE ID**.
4. Details are published on the official CVE website: <https://cve.mitre.org>

### How to request for CVE

First, identify a vulnerability in software or a product (e.g., WordPress plugins, open‑source projects, libraries, etc).

#### Fill the MITRE CVE request form

(<https://cveform.mitre.org/>)

* **Select a request type:** Report Vulnerability / Request CVE ID
* **Enter your e-mail address:** `[redacted@example.com]`
* **Number of vulnerabilities reported or IDs requested (1–10):** 1
* **Vulnerability type:** SQL Injection
* **Vendor of the product(s):** `[vendor name redacted]`
* **Product:** `[product name and URL redacted]`
* **Version:** `[version redacted]`
* **Attack Type:** Remote
* **Impact:** Information Disclosure
* **Suggested description of the vulnerability for use in the CVE:**

  ```
  [REDACTED PRODUCT] [REDACTED VERSION] is vulnerable to SQL Injection (SQLi) attacks, which allow an attacker to manipulate the SQL queries executed by the application. The application fails to properly validate user-supplied input in the login id and password fields during the login process, enabling an attacker to inject malicious SQL code.
  ```

#### Submit & follow up

After submitting, the CNA (CVE Numbering Authority) will acknowledge, may ask for additional details or proof-of-concept, and — if validated — assign a CVE ID you can reference in advisories or reports.

***

* <https://www.cve.org/>
* <https://nvd.nist.gov/vuln/search#/nvd/home?resultType=records>
* <https://www.tenable.com/cve>
* <https://www.cvedetails.com/>