nmap-vulners 2.0

One script instead of three, ranked by what is being exploited rather than by
score, and fingerprints that update without a release.

nmap -sV --script vulners <target>

One script. vulners.nse replaces vulners.nse, vulners_enterprise.nse
and http-vulners-regex.nse. There is no mode switch: it works without an API
key, and a key adds detail. The installers remove the 1.x files, and so should
you if you install by hand - a leftover http-vulners-regex.nse still carries
the default category and keeps sweeping targets under a plain -sC.

The fingerprints are not in the script. It downloads three dictionaries at
scan time - 721 product and version rules, 939 swept paths, 6 targeted version
probes - from the catalog branch, in four requests per scan, 40 KB over the
wire. They are rebuilt weekly from Recog, Wappalyzer, WhatWeb, FingerprintHub
and nuclei-templates, so an installed script picks up new fingerprints without
being updated. Nothing is written to your filesystem, and no argument makes it.

Findings are ranked by exploitation. CISA KEV first, then an SSVC active
decision, then a published exploit, then EPSS, then everything else - CVSS
breaks ties inside a band and not across them, because an exploited 7.5 is a
worse problem than an unexploited 9.8. The report is an aligned table that fits
the terminal, with a vulners.com link on every row.

A web port is fingerprinted, not just looked up. The sweep names software
-sV cannot see - the framework, the CMS, the PHP behind a reverse proxy - and
publishes what it recognises onto the port for the rest of the scan. -T sets
how fast those requests go out and never how many;
--script-args vulners.paths=none turns the sweep off.

A service -sV could not name is read from its raw banner, at no extra
request, and looked up like any other identity.

With a key, each finding gains titles, dates, the upstream advisory or
exploit page, the exploit-to-CVE linkage, CISA KEV and - where the licence
grants it - EPSS and SSVC. One credit is spent only where the free path could
not name the software at all. Free keys: https://vulners.com/userinfo

• the script is no longer in the default or safe categories, so -sC no
  longer sweeps a target: ask for it with --script vulners
• the rendered text is a break - the *EXPLOIT* and *HAS EXPLOIT* tokens and
  the tab-delimited layout are gone. -oX consumers are unaffected: the script
  id, both table levels, the CPE group keys and the original element keys are
  unchanged, and the new elements are scalars beside them
• the 1.x argument prefixes vulners_enterprise.* and
  http-vulners-regex.paths still work for this release and print a
  deprecation notice

curl -fsSL https://raw.githubusercontent.com/vulnersCom/nmap-vulners/master/install.sh | sh

PowerShell, as Administrator:

irm https://raw.githubusercontent.com/vulnersCom/nmap-vulners/master/install.ps1 | iex

Both ask nmap where its data directory is, replace the copy nmap ships, remove
the 1.x files, offer to store an API key after checking it works, and then
verify that --script vulners resolves to what they installed.

Full Changelog: v1.5...v2.0