NATIONAL VULNERABILITY REPORT TEMPLATE
================------------------------------------------------

INSTRUCTIONS:
Fill out the sections below and email this report to cvdreport@ncsc.gov.ie.
It is recommended to send reports encrypted. If submitting encrypted, please use our 
PGP key available at /PGP/cvd-pgp.asc.

----------------------------------------------------------------
1. MANDATORY DECLARATION
----------------------------------------------------------------

Policy Consent: I confirm that I have read and agree to the "CVD Submission Policy and Data Processing" terms on http://localhost/cvdreport/.
[ ] Yes


----------------------------------------------------------------
2. PURPOSE OF REPORTING TO NCSC
----------------------------------------------------------------

[ ] Submitting a new report and requesting the National Coordinator to act as intermediary.
[ ] Researcher has been unable to contact, or received no response from the organisation.
[ ] Researcher is seeking mediation with the organisation as a result of unsatisfactory engagement.
[ ] Multiple organisations are involved or there is a cross border element to the vulnerability.
[ ] The organisation has engaged with the researcher, and this is only to inform the National Coordinator about the report.

----------------------------------------------------------------
3. REPORTER INFORMATION
----------------------------------------------------------------

* Name / Handle: __________________________________________________
* Email Address: __________________________________________________
* Organisation / Team: ____________________________________________
* PGP Fingerprint: ________________________________________________
  (Optional for encrypted replies)
* Hall of Fame Credit: [ ] Yes, list credit    [ ] No, list anonymously
* HoF Display Name: _______________________________________________
  (Text to display if Yes, e.g., "John Doe", "@res_handle", "Team Researchers")
* Request Anonymity?: [ ] Yes    [ ] No


----------------------------------------------------------------
4. TARGET ASSET DETAILS
----------------------------------------------------------------

* Target URL / System: ____________________________________________
* IP Address / Host:   ____________________________________________
* Software / Version:  ____________________________________________


----------------------------------------------------------------
5. VULNERABILITY OVERVIEW
----------------------------------------------------------------

* Vulnerability Type: _____________________________________________
  (e.g., Cross-Site Scripting (XSS), SQL Injection, IDOR)
* Estimated Severity: [ ] Low   [ ] Medium   [ ] High   [ ] Critical
* CVSS v3.1 / v4.0 Score: __________________________________________
  (If calculated)


----------------------------------------------------------------
6. PROOF OF CONCEPT & STEPS TO REPRODUCE
----------------------------------------------------------------

Please provide clear, step-by-step instructions to replicate the finding 
without risking Confidentiality, Integrity or Availability.

Steps to Reproduce:
1. Navigate to...
2. Intercept request to...
3. Inject the following payload into parameter X:
4. Observe response indicating successful exploitation.

Proof of Concept (PoC) / Payloads:

POST /api/v1/user/profile HTTP/1.1
Host: target.yourdomain.ie
Authorisation: Bearer <TOKEN>
Content-Type: application/json

{
  "username": "' OR 1=1 --"
}


----------------------------------------------------------------
7. IMPACT ASSESSMENT
----------------------------------------------------------------

Describe the practical impact of this flaw:

* Confidentiality: ________________________________________________
  (Can an attacker extract PII, credentials, or sensitive data?)

* Integrity: ______________________________________________________
  (Can an attacker modify or delete unauthorised data?)

* Availability: ___________________________________________________
  (Can an attacker cause a denial of service?)


----------------------------------------------------------------
8. RECOMMENDED REMEDIATION (OPTIONAL)
----------------------------------------------------------------
Provide any suggested patches, code fixes, or configuration tweaks:

__________________________________________________________________