CVE Feed

Submission & use terms

These terms cover community proofs of concept — submitting them, and using the ones shown here. Plain-language summary first; it is not legal advice.

What you may submit

Proofs of concept for publicly disclosed vulnerabilities only — ones that already have a published CVE. Text only; there are no file uploads. By submitting, you confirm each of the following:

  • This vulnerability is already publicly disclosed (it has a published CVE).
  • This material comes only from testing I was authorised to perform.
  • I have the legal right to publish this content and am not breaching any agreement by doing so.
  • It contains no live credentials, personal data, or anything targeting systems I am not authorised to test.
  • I understand it will be reviewed before it appears publicly and may be rejected.
  • I agree to the submission terms.

Submissions are reviewed before they appear and may be edited for formatting or rejected for any reason. We may remove anything at any time.

Licensing of your contribution

You choose how your PoC may be reused. The options are:

  • CC0 1.0 (public domain dedication)
  • MIT
  • CC BY 4.0 (attribution required)
  • Author retains all rights; shared for education only

You keep ownership; you grant this site a non-exclusive right to host and display the submission under the licence you pick, and to remove it.

What we store, and privacy

We store the submission and a one-way hash of your network address for abuse prevention — not the address itself. A contact you provide is kept private for moderation or credit and is never displayed. Do not submit personal data or live credentials; submissions that contain them are rejected.

Using what is shown here

Community PoCs are unverified and provided for authorised security testing, defence and education. Run them only against systems you own or have explicit permission to test. Unauthorised access to computer systems is a crime in most jurisdictions (for example the US Computer Fraud and Abuse Act and the UK Computer Misuse Act). The material is provided “as is”, without warranty; you are responsible for how you use it.

Earning, and what this is not

This platform does not buy, sell, or broker exploits, and does not pay for submissions. For legitimate ways to be paid for vulnerability research, see earning.

Removal

If you are an affected vendor or the author and want a submission removed, or you believe content here infringes your rights or breaches these terms, contact the site operator and it will be reviewed promptly.