About this project

This repository collects proof-of-concept material for high-severity CVEs, organized by year (2022 through 2026) in per-CVE folders. Each entry is described as containing a detection-only PoC script, a Docker test lab with vulnerable and patched applications, bilingual English/Korean documentation, and prevention rules. Coverage listed in the README includes notable vulnerabilities such as Spring Cloud Function SpEL injection (CVE-2022-22963), Spring4Shell (CVE-2022-22965), ManageEngine SAML RCE (CVE-2022-47966), Cisco IOS XE Web UI privilege escalation (CVE-2023-20198), PaperCut authentication bypass RCE (CVE-2023-27350), Apache ActiveMQ RCE (CVE-2023-46604), HTTP/2 Rapid Reset (CVE-2023-44487), SharePoint privilege escalation (CVE-2023-29357), FortiOS SSL VPN RCE (CVE-2024-21762), Apache Traffic Server request smuggling (CVE-2024-45387), Cleo file transfer upload RCE (CVE-2024-50623), PAN-OS GlobalProtect command injection (CVE-2024-3400), TeamCity authentication bypass (CVE-2024-27198), Ivanti Connect Secure buffer overflow (CVE-2025-0282), Windows OLE RCE (CVE-2025-21298), vCenter heap overflow (CVE-2025-22224), Tomcat path equivalence RCE (CVE-2025-24813), Next.js middleware authorization bypass (CVE-2025-29927), and a Kafka JWT validation bypass (CVE-2026-33557). Folder structure: each CVE directory holds README.md (English), README_KO.md (Korean), poc.py, and a prevention/ subfolder with README.md, nginx.conf, httpd.conf, snort.rules and yara.yar. The README states the repository contains 3 entries for 2022, 45 for 2023, 413 for 2024 and 1107 for 2025. Usage: PoC scripts accept a --help flag and a --check mode against a target. Prevention rules are deployed by copying the Nginx or Apache config into the server's conf.d directory, appending Snort rules to local.rules, or running YARA against a target file. The project is licensed under Apache 2.0 and is maintained by the SeekersLab team, which also advertises commercial security services (MSSP, SIEM/SOAR integration, vulnerability management, custom detection rules, threat intelligence). Contributions are asked to include CVE attribution, bilingual documentation, prevention rules and responsible disclosure compliance. The README carries an explicit disclaimer that the code is for educational purposes, authorized penetration testing, CTF challenges and security research only, and warns against use on systems without written authorization.