fankh/vulnerability-pocCVE proof-of-concept labs, exploit scripts, and detection/prevention rules (Nginx, Apache, Snort, YARA) for high-severity CVEs. Authorized security testing & research only.
Reproducible CVE labs with detection-only proof-of-concept (PoC) code and ready-to-deploy detection & prevention rules — Snort, YARA, Nginx, and Apache — for high-severity CVEs. Built for defenders: authorized security testing, penetration testing, blue-team detection engineering, CTF challenges, and security research.
Looking for the PoC and how to detect or block a given CVE? Each flagship entry pairs a Docker test lab (vulnerable + patched app) with network IDS signatures (Snort), file/memory patterns (YARA), and web-server mitigations (Nginx / Apache), plus bilingual (English / 한국어) documentation. Maintained by the SeekersLab team.
Each flagship entry answers, on one page, the questions defenders search for:
CVE-XXXX-YYYY detection rule / snort rule / yara rule — ready-to-deploy IDS and file/memory signatures.CVE-XXXX-YYYY prevention / nginx mitigation / waf rule / apache mitigation — web-server blocking rules.CVE-XXXX-YYYY poc / proof of concept — a detection-only PoC for validating your rules in the lab.how to detect CVE-XXXX-YYYY / how to block CVE-XXXX-YYYY — the answer-first summary at the top of each entry.CVE-XXXX-YYYY affected versions — vendor, product, and severity, sourced to NVD.This repository is provided for educational purposes, authorized penetration testing, CTF challenges, blue-team detection engineering, and security research only.
Do not run the PoC code against systems you do not own or lack explicit written authorization to test. Unauthorized access to computer systems is illegal. All entries cover already-public CVEs and follow responsible-disclosure practice.
llms.txt lists every entry.data/cve-index.json.6152 CVE entries across 24 years. Every entry ships a detection-only PoC and a Docker test lab (vulnerable + patched). 525 entries also ship ready-to-deploy detection & prevention rules (Snort, YARA, Nginx, Apache) — those are the flagship, defense-complete entries below.
| Year | Entries | With detection & prevention rules |
|---|---|---|
| 2026 | 3755 | 45 |
| 2025 | 1197 | 22 |
| 2024 | 457 | 410 |
| 2023 | 116 | 45 |
| 2022 | 82 | 3 |
| 2021 | 114 | 0 |
| 2020 | 86 | 0 |
| 2019 | 58 | 0 |
| 2018 | 49 | 0 |
| 2017 | 52 | 0 |
| 2016 | 27 | 0 |
| 2015 | 26 | 0 |
| 2014 | 22 | 0 |
| 2013 | 20 | 0 |
| 2012 | 15 | 0 |
| 2011 | 5 | 0 |
| 2010 | 8 | 0 |
| 2009 | 4 | 0 |
| 2008 | 2 | 0 |
| 2007 | 2 | 0 |
| 2006 | 1 | 0 |
| 2005 | 1 | 0 |
| 2000 | 33 | 0 |
| 1999 | 20 | 0 |
The highest-severity entries that pair a PoC lab with ready-to-deploy detection and prevention rules.