According to your experience, do you know if a repository of vulnerable apps indexed by CVE exists? Exploit-DB offers vulnerable apps, i.e. for:


it is possible to install the vulnerable app:


I wondered if exists some standardized/non-standardized way to obtain vulnerable packages indexed by CVE / OVAL / CPE / other.

  • Hi @gx1, welcome to the site! Just to double check - you want the actual files themselves?
    – Cowthulhu
    Commented Jun 7, 2019 at 14:33
  • 1
    Hi @Cowthulhu , thank you for the welcome! Yes, an index of absolute url with vulnerable applications. I think about a structure like: {VULN_APP_ID: 2, CVE_ID: 333, vulnerable_app_url:https://url//vulnerable.zip}.
    – gx1
    Commented Jun 7, 2019 at 14:50
  • An API-rest that returns this kind of information could be very useful to test vulnerabilities. It could be very useful to have a standard for the installation steps, but I think that this is a very complex goal...
    – gx1
    Commented Jun 7, 2019 at 14:57
  • Unfortunately, questions of the type "where can I find X?" or "what product/service does X?" is off topic as the list of potential answers could be endless.
    – schroeder
    Commented Jun 7, 2019 at 16:08
  • I don't know if you've thought of it, but Github can be used this way.
    – schroeder
    Commented Jun 7, 2019 at 16:10


Browse other questions tagged .