cve-poc-generator
CVE PoC Generator
Research a CVE by ID, generate a standalone Python proof-of-concept script, and produce a detailed vulnerability report.
Workflow
- NVD Lookup - Query NVD API v2.0 for the CVE ID. Extract CVSS v3.1 score/vector, CWE IDs, CPE matches, advisory URLs, and patch links.
- Advisory Research - Deep-dive vendor advisories, GitHub security advisories, Exploit-DB, and published write-ups. Identify root cause, affected versions, and attack vector details.
- PoC Generation - Write a standalone Python script (
poc.py) that demonstrates the vulnerability safely. Follow the script standards inreference/poc-methodology.md. - Report Generation - Write a comprehensive markdown report (
report.md) with metadata, root cause analysis, risk assessment, and remediation guidance.
NVD Data to Collect
| Field | Source | Usage |
|---|---|---|
| CVE ID | NVD | Primary identifier |
| CVSS v3.1 Score + Vector | NVD | Risk scoring |
| CWE ID(s) | NVD | Vulnerability classification |
| CPE Matches | NVD | Affected products and versions |
More from transilienceai/communitytools
hackerone
HackerOne bug bounty automation - parses scope CSVs, deploys parallel pentesting agents per asset, validates PoCs, and generates platform-ready submission reports.
59reconnaissance
Domain assessment and web application mapping - subdomain discovery, port scanning, endpoint enumeration, API discovery, and attack surface analysis.
47social-engineering
Social engineering testing - phishing, pretexting, vishing, and physical security assessment techniques.
45ai-threat-testing
Offensive AI security testing and exploitation framework. Systematically tests LLM applications for OWASP Top 10 vulnerabilities including prompt injection, model extraction, data poisoning, and supply chain attacks. Integrates with pentest workflows to discover and exploit AI-specific threats.
44osint
Open-source intelligence gathering - company repository enumeration, secret scanning, git history analysis, employee footprint, and code exposure discovery.
43source-code-scanning
Security-focused source code review and SAST. Scans for vulnerabilities (OWASP Top 10, CWE Top 25), CVEs in third-party dependencies/packages, hardcoded secrets, malicious code, and insecure patterns. Use when given source code, a repo path, or asked to "audit", "scan", "review" code security, or "check dependencies for CVEs".
42