cvemapping
A free command-line tool that finds and organizes publicly-published exploit code for known security vulnerabilities (CVEs), so researchers don't have to manually search GitHub one CVE at a time.
🔗 Visit cvemapping
Description
When a new security vulnerability (a "CVE") is disclosed, researchers on GitHub often publish proof-of-concept exploit code for it within days. Finding that code manually means searching GitHub repo by repo for each CVE ID — slow and easy to miss. cvemapping automates that: it collects and aggregates available exploit repositories tied to CVEs so a researcher can search, filter, and export results instead of hunting manually.
It's a free, open-source command-line tool distributed as cross-platform binaries. It supports GitHub authentication tokens to raise API rate limits for larger searches, year-based filtering to narrow results to a specific disclosure window, JSON export for feeding results into other tooling, a web visualization component, and pagination for handling large result sets.
💬 Our review
The short version: for penetration testers and bug bounty hunters, this is a small but genuinely time-saving utility — it turns a repetitive manual search into a one-line command, and it's free.
There isn't a well-known direct competitor doing exactly this (most vulnerability databases like NVD or Vulners list the CVE itself but not the exploit-code aggregation), so the real comparison is "cvemapping vs. doing it by hand," and automation wins easily for anyone doing this regularly. The catch is that it's a narrow utility, not a full vulnerability management platform: it finds exploit code, it doesn't triage, prioritize, or track remediation, and like any tool that surfaces exploit code, it should be used only in contexts you're authorized to test.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Outil en ligne de commande, binaires multiplateformes, aucune restriction de licence indiquée.
Pros
Automatise une recherche autrement fastidieuse (exploit par CVE, repo par repo)
Export JSON et filtrage par année pour intégration dans d'autres outils
Gratuit, binaires multiplateformes prêts à l'emploi
Cons
Outil de recherche seulement — pas de triage ni de gestion des vulnérabilités
Dépend de la disponibilité et fiabilité du code d'exploit publié par la communauté
À utiliser uniquement dans un cadre autorisé (le code trouvé est du code d'exploit réel)