Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

For a web security app I'm working on, I want to list all the exploits that a certain Wordpress version have. (and hopefully the same for other CMSs)

I found some (open) exploits databases that list those kind of exploits:

Unfortunately, their exploits database is not really structured (EDIT: actually the National Vulnerability Database is the perfect fit for what we wanted, check my answer below). CVEDetails gives exploits per application, but it's hard to get the version number from that ; Also they don't give an access to some structured database (XML, JSON, ...) or API to easily fetch the exploits. The 'National Vulnerability Database' doesn't give details about which app and version is vulnerable.

Where could I find some open (and free for commercial use) exploit databases?

share|improve this question
add comment

4 Answers 4

Use the CVE database itself. They have a structured XML where you can extract all vulnerabilities you want.

share|improve this answer
add comment

The OSVDB provides an API for exactly this sort of thing. It's free but limited to 2 queries per day for non-commercial use. You will need to pay for a license if you want more than this.

In the past they have also provided database dumps in various formats however I'm not sure if they still do this.


A word on free-for-commercial-use: No matter where you get your vulnerability information from, you will probably find that if your product is at all successful you will either be contacted with a request for money or your customer's requests will suddenly be blocked.

You should plan accordingly.

share|improve this answer
    
Unless it's state-financed or for non-profit :-) (check my answer !) Thanks for the link btw, I've already found OSVDB, too bad their website is a bit 'obscure' about licensing conditions. –  halflings Jul 22 '13 at 12:55
add comment
up vote 0 down vote accepted

We ended up using the NVD (National Vunlnerability Database) which is based on the SCAP protocol for automating the retrieval of vulnerabilities based on a CPE id (for instance, the CPE id of Joomla! 7.1 beta1 would be: cpe:/a:joomla:joomla%21:7.1:beta1).

Their database is really extensive and gives CVE id and CVSS score for each exploit.

share|improve this answer
add comment

Seems that the only way to use thoses databases is to parse HTML result pages. cvedetails looks the better structured site for this own, but still hard to get product and version IDs

share|improve this answer
    
Please check my answer. The NVD database is available in XML and is actually well structured. You can easily find exploits for a given software by looking up it's CVE code. Something like this: cpe:a/wordpress:wordpress:3.5:beta –  halflings Sep 4 '13 at 17:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.