pocindex aggregates public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub, enriching each entry with CVSS, EPSS and CISA KEV context for authorized assessment and defensive research workflows.
| Tool | 0xMarcio/pocindex — searchable index of 85,056 CVEs with public proof-of-concept exploits, enriched with CVSS, EPSS and CISA KEV data |
| Category | Vulnerability and exploit intelligence aggregation |
| Primary Use | Finding whether a public PoC exists for a given CVE, by vendor, product or keyword, and comparing CVSS severity against EPSS exploitation probability and CISA KEV status during triage |
| Safe Use | Vulnerability prioritization, patch-management research and authorized penetration tests on systems you own or have written permission to assess |
| Telemetry Note | pocindex is a passive index that queries public data sources; it touches no target infrastructure, so defenders observe nothing on their networks — its value to blue teams is as an early-warning signal for which CVEs have weaponized code circulating publicly |
pocindex from 0xMarcio answers one of the most persistent triage questions in vulnerability management: does public exploit code exist for this CVE? Rather than making an analyst bounce between GitHub search, ExploitDB, Nuclei template lists and Metasploit modules, the project consolidates all of those sources — plus Vulhub — into a single searchable corpus covering roughly 85,056 CVEs with public proof-of-concepts, of which 1,236 are flagged as known exploited per CISA KEV context. The repo sits at 1,398 stars, is written in Python, and carries an MIT license, which makes it genuinely useful as a data source and not just a hosted front end.
What the README actually describes is a hybrid between a maintained dataset and a search service. The public interface is pocindex.io, where you search by CVE identifier, vendor, product or free keyword, and each result is presented alongside CVSS severity, EPSS exploitation probability and CISA KEV known-exploited status. That enrichment layer is what distinguishes pocindex from a raw GitHub scrape: seeing that a PoC exists is one signal, but seeing that the same CVE carries a high EPSS score and appears in the KEV catalog converts it from trivia into patch-priority evidence.
The engineering behind it is visible in the repo's own metadata. A hot_cves.yml GitHub Actions workflow runs continuously, and the README badge reports the last sync timestamp — 18 Oct 2026 03:07 UTC in the snapshot reviewed here — which indicates the index is rebuilt on an automated schedule rather than manually curated. Freshness matters enormously in this domain, because the interval between a PoC landing on GitHub and attackers operationalizing it has compressed to hours, and the project's Just landed table shows entries ingested as recently as three hours after publication.
The data delivery model is unusually pragmatic for this category. The README states plainly that every file is plain JSON on a CDN, with no API key and no rate limit, which means defenders and tooling authors can pull the corpus directly and integrate it into their own pipelines — a SIEM enrichment job, a vulnerability-scanner overlay, or a custom prioritization dashboard — without negotiating access or worrying about query quotas. That design choice signals the author intends this as infrastructure for the community, not a walled garden.
Structurally, the README surfaces curated views on top of the raw index. A Just landed section lists newly indexed PoC repositories with star counts and release ages; Trending in 2026 and Trending in 2025 tables rank repositories by community attention and recency of updates; and collapsible sections extend the trending view back through 2024, 2023 and 2022. The trending tables are effectively a crowd-sourced exploit-attention feed, and several entries carry an inline KEV marker graphic flagging CVEs that CISA has confirmed as actively exploited — those are the rows a patch committee should read first.
The scope of what gets indexed deserves attention from a documentary standpoint. The entries span pre-auth remote code execution in web platforms, Android kernel privilege-escalation research such as the work around the Adreno KGSL driver, Windows kernel and driver flaws, and full exploit chains like the published SCCM research. The index does not discriminate by vendor or platform; it mirrors whatever the security-research community publishes, which means the corpus doubles as a longitudinal record of where public exploitation research is concentrating in any given year.
For authorized penetration testers, the operational value is scoping and validation. When an engagement report lists affected software versions, pocindex lets the tester determine in seconds whether a public PoC, Nuclei template or Metasploit module exists for the corresponding CVEs, which shapes both the risk rating in the report and the effort estimate for a proof-of-impact demonstration in a lab. Searching by vendor and product keyword — rather than only by CVE identifier — matters because in real assessments you frequently know the product and version long before you have an enumerated CVE list.
For defenders, the same corpus read in the other direction becomes threat intelligence. A CVSS score tells you how bad a bug could be; an EPSS score tells you how likely it is to be exploited; the presence of indexed public PoC code tells you the barrier to exploitation has already collapsed. Converging all three is exactly the prioritization logic that patch-management frameworks preach, and pocindex is one of the few freely available datasets that operationalizes it without requiring a commercial feed subscription.
There is also a signal-quality angle worth noting for anyone consuming the data programmatically. The star counts attached to each indexed repository are a rough proxy for community vetting — a 477-star PoC has been reviewed by far more eyes than a zero-star one pushed three hours ago — and the recency column distinguishes actively maintained exploits from abandoned ones. Analysts pulling the JSON into automation should treat those fields as first-class ranking inputs rather than decoration.
From a governance perspective, the tool is squarely on the legitimate side of the line. pocindex is an index, not an exploit delivery mechanism: it points at public repositories, enriches them with metadata, and its permissive MIT licensing plus keyless JSON distribution make it closer to a public dataset in the spirit of CISA KEV itself than to an attack toolkit. The repository's own topic list — threat-intelligence, vulnerability-database, security-research — frames it correctly.
Caveats for professional use are the usual ones for aggregated public data. The index reflects what has been published, not what exists privately, so absence of a PoC is not evidence a bug is unexploitable — a point any analyst citing the dataset in a risk decision should state explicitly. And because indexing is automated, the quality of any linked repository varies; the enrichment columns exist precisely to help you weigh that variance rather than treat every row as equally actionable. Used with that discipline, pocindex is a solid, current, and refreshingly open addition to the vulnerability-intelligence toolchain.
0xMarcio/pocindex.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.