<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Template Severity Classification — API Reference

## Nuclei Severity Levels

| Level | CVSS Range | Use Case |
|-------|------------|----------|
| `critical` | 9.0–10.0 | RCE, auth bypass, data breach |
| `high` | 7.0–8.9 | SQLi, SSRF, file read |
| `medium` | 4.0–6.9 | XSS, CORS misconfig, info disclosure |
| `low` | 0.1–3.9 | Directory listing, version exposure |
| `info` | 0.0 | Technology detection, recon |

## Classification Block Fields

| Field | Type | Description |
|-------|------|-------------|
| `cvss-metrics` | string | CVSS v3.1 vector string |
| `cvss-score` | float | CVSS base score |
| `cve-id` | string | CVE identifier if applicable |
| `cwe-id` | string | CWE weakness identifier |

## CVSS v3.1 Vector Components

| Metric | Values | Description |
|--------|--------|-------------|
| AV | N/A/L/P | Attack Vector |
| AC | L/H | Attack Complexity |
| PR | N/L/H | Privileges Required |
| UI | N/R | User Interaction |
| S | U/C | Scope |
| C | N/L/H | Confidentiality Impact |
| I | N/L/H | Integrity Impact |
| A | N/L/H | Availability Impact |

## Severity Filtering CLI

```bash
# Filter by severity
nuclei -severity critical,high

# Exclude info level
nuclei -exclude-severity info

# Multiple severity with output
nuclei -severity critical,high -json -o critical-findings.json
```

## Info Block Optional Fields

| Field | Purpose |
|-------|---------|
| `impact` | Business impact description |
| `remediation` | Fix recommendation |
| `reference` | External advisory URLs |
| `metadata.verified` | Template tested against live target |
