# Fluid Attacks Database

Fluid Attacks Database is a vulnerability knowledge base. It presents CVEs, mapped compliance standards, security requirements, rules, weaknesses, and remediation (fixes). It serves both human readers via HTML pages and machines via JSON APIs.

HTML pages require authentication. JSON API endpoints are public and do not require authentication — prefer these for programmatic access.

## Sections (HTML)

- [Home](/): Landing page with database overview and statistics
- [Vulnerabilities](/vul/): CVE-based vulnerability definitions and metadata
- [Vulnerability detail](/vul/[id]/): Single vulnerability page by flat_id
- [Weaknesses](/wek/): Weakness catalog (CWE-style) with categories
- [Weakness detail](/wek/[id]/): Single weakness page by ID
- [Weaknesses by category](/wek/cat/[category]/): Weakness list filtered by category slug
- [Fixes](/fix/): Remediation and solution content landing page
- [Fixes by type](/fix/[type]/): Fix languages for a given type (type: code | infrastructure | packages)
- [Fixes by language](/fix/[type]/[lang]/): Fix list for a given type and language
- [Fix detail](/fix/[type]/[lang]/[id]/): Single fix by type, language, and vulnerability ID
- [Requirements](/req/): Security and compliance requirements
- [Requirement detail](/req/[id]/): Single requirement page by ID
- [Requirements by category](/req/cat/[category]/): Requirement list filtered by category slug
- [Standards](/std/): Mapped standards and references
- [Standard detail](/std/[id]/): Single standard page by ID
- [Rules](/rul/): Rule definitions and metadata
- [Rule detail](/rul/[id]/): Single rule page by method_id

## Machine-readable APIs (JSON)

All JSON endpoints use GET. List endpoints return paginated results. Detail endpoints return a single object or `{ "error": "... not found" }` with HTTP 404. Default pagination: page=1, pageSize=100.

### Vulnerabilities

- [Vulnerability list](/vul/data.json): Paginated vulnerability list
  - Query params: search, severity, ecosystem, type, cve, epss, kev, fix, detected, age, page, pageSize
  - Returns: { ecosystemNames, totalEcosystems, totalPages, totalVulnerabilities, vulnerabilities }
- [Vulnerability detail](/vul/[id]/data.json): Single vulnerability by flat_id
  - Returns: vulnerability object with affected, aliases, referenceUrls

#### Vulnerability filters explained

- **search**: Free-text search across advisory ID, CVE, package name, details, and vulnerable version
- **severity**: CVSS severity level. Values: `low`, `medium`, `high`, `critical`
- **ecosystem**: Package ecosystem (e.g., npm, PyPI, Maven, Go, crates.io). Valid values are dynamic — the `ecosystemNames` array in the list response contains all available ecosystems
- **type**: `application` (library/package vulnerabilities) or `environment` (platform/OS-level vulnerabilities)
- **cve**: Whether the advisory is a CVE. Values: `y` or `n`
- **epss**: Whether the vulnerability has an EPSS (Exploit Prediction Scoring System) score. Values: `y` or `n`
- **kev**: Whether the vulnerability is in CISA's Known Exploited Vulnerabilities catalog. Values: `y` or `n`
- **fix**: Whether a fix is available. Values: `y` or `n`
- **detected**: Whether Fluid Attacks has detected this vulnerability in the wild. Values: `y` or `n`
- **age**: How recently the advisory was created. Values: `1d` (last day), `1w` (last week), `1m` (last month), `3m` (last 3 months)

### Weaknesses

- [Weakness list](/wek/data.json): Paginated weakness list with filters
  - Query params: category, requirement, search, page, pageSize
  - Returns: { pageNumber, pageSize, total, pages, weaknesses }
- [Weakness detail](/wek/[id]/data.json): Single weakness by ID
- [Weaknesses by category](/wek/cat/[category]/data.json): Weaknesses filtered by category slug

#### Weakness categories

Weaknesses are classified using CAPEC-style attack pattern categories:

- Unexpected Injection
- Functionality Abuse
- Access Subversion
- Information Collection
- Deceptive Interactions
- Data Manipulation
- Protocol Manipulation
- System Manipulation
- Probabilistic Techniques

### Fixes (Remediation)

Fixes provide secure code examples and step-by-step remediation for vulnerabilities, organized by type and language.

Fix types: code, infrastructure, packages.
Code languages: android, csharp, dart, go, java, javascript, kotlin, php, python, ruby, scala, swift, typescript.
Infrastructure languages: aws, azure, cloudformation, docker, docker-compose, helm.
Package languages: maven, npm, pypi.

- [Fix languages](/fix/data.json): All fix languages with metadata
  - Query params: search, weakness
  - Returns: { languages } — each language includes lang, type, fixCount, weaknessIds
- [Fixes by language](/fix/[type]/[lang]/data.json): Fix list for a given type and language
  - Returns: { fixes, lang }
- [Fix detail](/fix/[type]/[lang]/[id]/data.json): Single fix by type, language, and ID
  - Returns: fix object with solution (language, steps, insecure_code_example, secure_code_example) or { error: "Fix not found" } (404)

### Requirements

- [Requirement list](/req/data.json): All requirements
  - Query params: search, standard
  - Returns: { requirements }
- [Requirement detail](/req/[id]/data.json): Single requirement by ID
- [Requirements by category](/req/cat/[category]/data.json): Requirements filtered by category slug
  - Returns: { category, requirements }

#### Requirement categories

- Architecture
- Authentication
- Authorization
- Certificates
- Credentials
- Cryptography
- Data
- Devices
- Emails
- Files
- Legal
- Logs
- Networks
- Privacy
- Services
- Session
- Social
- Source
- System

### Standards

Standards represent compliance frameworks and security references that map to requirements.

- [Standard list](/std/data.json): All standards
  - Query params: search, standard (filter by category)
  - Returns: { standards }
- [Standard detail](/std/[id]/data.json): Single standard by ID

#### Standard categories

- Assessments: SIG, SIG Lite
- Data Protection & Privacy: GDPR, LGPD, CCPA, CPRA, PDPA, PDPO, POPIA, ePrivacy, NY SHIELD, RESOLSB
- Frameworks: BSIMM, CMMC, NIST (SP 800-53, 800-171, 800-115, 800-63, SSDF), ISO 27001, ISO 27002, HITRUST, FedRAMP, SWIFT CSC, SOC 2
- OWASP Risks: OWASP Top 10, OWASP Mobile Top 10, OWASP API, OWASP Risks, OWASP LLM
- Sector Regulations: HIPAA, GLBA, FACTA, FCRA, PCI DSS, PA-DSS, NYDFS, FERPA, NERC CIP, IEC 62443, FISMA
- Secure Coding: CERT C, CERT Java, MISRA C, ASVS, OWASP MASVS, OWASP SCP, OSAMM, Agile, BSAFSS, BIZEC, MVSP, PTES, OSSTMM3, ISSAF
- Vulnerabilities & Taxonomies: CAPEC, CWE, CWE Top 25, SANS Top 25, MITRE ATT&CK, WASC, WASSEC

### Rules

Rules define specific detection methods used to identify vulnerabilities during security testing.

- [Rule list](/rul/data.json): Paginated rule list with filters
  - Query params: search, severity, target, technique, page, pageSize
  - Returns: { pageNumber, pageSize, total, pages, rules }
- [Rule detail](/rul/[id]/data.json): Single rule by method_id

#### Rule filters explained

- **severity**: Rule severity level. Values: `low`, `medium`, `high`
- **target**: Technology being tested. Values: `AWS`, `ANDROID`, `C#`, `Cloudformation`, `Docker Compose`, `Executable Files`, `Go`, `HTTP`, `Html`, `Java`, `Python`, `SSL`, `Terraform`, `Typescript`
- **technique**: Detection technique used. Values in use: `SAST` (Static Application Security Testing), `WEB_DAST` (Web Dynamic Application Security Testing), `API_DAST` (API Dynamic Application Security Testing), `CSPM` (Cloud Security Posture Management), `MAST` (Mobile Application Security Testing), `SS` (Secrets Scanning)

## Auxiliary endpoints

- [Sitemap](/sitemap.xml): XML sitemap with all indexed pages
- [Robots](/robots.txt): Robots directives
- [Search index](/search/index.json): Pre-built search index for client-side search

## Optional

- [Fluid Attacks](https://fluidattacks.com/): Product and company overview