# PocOrExp_in_Github: an index of public exploits mapped to CVE numbers

> PocOrExp_in_Github crawls GitHub for repositories that mention a given CVE and writes the results into per-year Markdown files, using CVE numbers from the official CVE site and a pool of GitHub API tokens. It is a research index, and the log in the README records that some hits are phishing repos rather than proofs of concept.

**ycdxsb/PocOrExp_in_Github** — Automatically Collect POC or EXP from GitHub by CVE ID.

- Repository: https://github.com/ycdxsb/PocOrExp_in_Github
- Website: https://pocorexp.nsa.im
- Stars: 1,221 · Forks: 240
- Language: Python
- License: MIT
- Published: 2026-10-19 · Updated: 2026-10-19 · Language: en
- Canonical page: https://hysenlabs.com/projects/ycdxsb-pocorexp-in-github

## What the crawler collects and what it leaves out

The stated purpose is aggregating existing PoC or Exp on GitHub, with CVE information coming from the official CVE website. The workflow it automates is the one every vulnerability researcher repeats: you have a CVE identifier, you want to know whether anyone has published a proof of concept for it, and you would rather not page through GitHub search results yourself. The tool answers that question by searching GitHub for the CVE string and writing the matching repositories into a structured file. The scope limitation is stated up front in the README: aggregation is only done through general CVE numbers, so for vulnerabilities with Windows-specific numbers like MS17-010 and famous vulnerabilities with nicknames, it is better to search for them yourself. That single sentence tells you what the tool can and cannot do, and it is the first thing to check before you build a workflow on it.

## exp.py, the year switch and the init and watch flags

The entry point is a single script, exp.py, driven by three flags.

```bash
python3 exp.py -y 2021 -i y
python3 exp.py -y all -i y
```bash

The -y flag selects the year of CVEs to process, and the accepted values run from 1999 through 2021 with an all option, which is what the usage text shows even though the repository directories now run to 2026. The -i flag controls initialisation: y means initial and will not process already handled CVEs, n means no and will process already handled CVEs, which is the flag you want when re-running to refresh. The -w flag monitors PoC changes, and the current strategy is described as updating known CVEs with PoC from previous years plus all CVEs from the current year. A separate asynchronous script, exp_async.py, is offered for speed, and the log records that the asynchronous script was later updated to a v2, which is why exp_async_v2.py also sits in the tree.

## Three steps: install, drop a token in TOKENS, then run

The setup is three steps. First the dependencies, which are pinned in requirements.txt to aiohttp_requests, tqdm, loguru and requests.

```bash
pip3 install -r requirements.txt
```bash

Second, you apply for a GitHub API token and write it into the TOKENS file in the project directory, and the format is one line per token.

```bash
token:your_token
```bash

Multiple tokens can be used, and the log explains why that matters: after the first round of crawling the project was using 20 GitHub API tokens to poll all CVEs within 12 hours and update. The TOKENS file is present in the repository tree, and there is also a token_rate.py file, which is the place where the rate budget is likely tracked. Third, you process CVE information with the exp.py command shown earlier. The repository also contains a daily update script, today.py, whose results are written to Today.md, and the README notes you can modify it to send the get_today_update results to yourself through services like Dingding or wxpusher.

## The output is a set of Markdown files, one directory per year

The output structure is visible in the repository itself rather than described in prose. The top level holds one directory per year, from 1999 through 2026, each with a README.md holding that year's findings, plus a PocOrExp.md file acting as the all-years index. That layout is the point of the project as much as the crawler is: the result is browsable on GitHub, so a researcher can read the year they care about without running anything locally. The per-year link structure in the README lists the same set of years, and Today.md is the rolling file for the daily update. The reason the results are committed rather than generated on demand is stated in the log, where a 2021-04-30 entry notes a download.py script added to download all PoC/Exp to prevent repo deletion by publishers. In other words, the archive exists as a hedge against upstream removal.

## Ranking by star count, and why results appeared out of nowhere

The log is the most instructive part of the project, because it records the design decisions and their consequences in plain language. A 2021-04-12 entry describes fixing an issue where GitHub search returned results like CVE-2020-36184 when searching for CVE-2020-3618, a prefix matching problem inherent to searching a string. A 2021-04-13 entry records switching to the official CVE data because of missing CVE numbers on the NVD website, and releasing the asynchronous script. A 2021-04-23 entry explains a false-positive source: the query strategy takes the top 30 results by star count, so when more repositories mention the same CVE, they enter that list and appear as newly added. The fix was to take the top 100 results by star count each time, and the entry notes that only CVE-2019-0708 has more than 100 search results, so pagination was not used to crawl everything. The consequence for a user is clear: the index is a star-count-ranked slice of the top matches, not a complete enumeration.

## Phishing repos and non-PoC repositories both ended up in the results

Two entries in the log describe the noise the crawler picks up, and they are the reason to treat the output with care. The 2021-04-20 entry says some non-PoC repos were found and removed by adding a blacklist, and that the asynchronous script was updated to v2 at the same time, with a blacklist.txt file in the tree. The 2021-05-19 entry is blunter: phishing attempts using CVE on GitHub were found, one account being named, with no special handling and a request to be cautious. There is also a privacy check, since the collection respects repository visibility states. The practical reading is that a URL in this index proves only that a repository mentioned a CVE identifier at some point. It does not prove the repository contains a working exploit, and it does not prove the repository is benign. A blacklist and a star-count ranking reduce noise; they do not establish trust.

## No releases, no package, and the clone safety note in the log

The maintenance picture is thin and the shape of the project explains it. The repository is not archived and the last push was on 2026-10-15, but there are no GitHub releases and it is not packaged on PyPI, so there is no version to pin and no changelog to read beyond the log section of the README. The code is a small set of scripts, exp.py, exp_async.py, exp_async_v2.py, today.py and download.py, and the requirements are pinned to old versions, requests 2.22.0 among them, which suggests the environment was set up once and not revisited. The licence on the repository is MIT, with a LICENSE file at the root, which permits reuse of the code and the collected indexes, though it says nothing about the licences of the exploit repositories being pointed at, and that is a question worth asking separately if you intend to redistribute a curated list. The README also carries a concrete security warning in the log, noting that git should be updated to the latest version to prevent attacks when cloning on Windows, referring to CVE-2020-27955, since the download.py step clones repositories you do not control.

## Conclusion

PocOrExp_in_Github fits a vulnerability researcher who already knows the CVE number they want and needs the public exploit references in one place, and it does not fit someone hunting by product name or by nickname, because the README says aggregation runs only through general CVE numbers and advises searching those yourself. Before you trust the output, read the 2021-05-19 log entry, which records phishing attempts using CVE names on GitHub, and treat the collected links as untrusted input rather than as verified exploits.

## FAQ

### How do I run PocOrExp_in_Github to collect PoC repositories?

Install the dependencies with pip3 install -r requirements.txt, put a GitHub API token in the TOKENS file in the form token:your_token, then run python3 exp.py -y 2021 -i y for a single year or python3 exp.py -y all -i y for every year.

### What does the -w watch flag do in exp.py?

The -w flag monitors PoC changes. The current strategy is to update known CVEs with PoC from previous years, and all CVEs from the current year. A separate daily script, today.py, writes its results to Today.md.

### Can PocOrExp_in_Github find exploits by nickname or Microsoft number?

No. The README states that aggregation is only done through general CVE numbers, so for vulnerabilities with Windows-specific numbers like MS17-010 and famous vulnerabilities with nicknames, it is better to search for them yourself.

### Are the repositories listed in PocOrExp_in_Github trustworthy?

The project log records finding non-PoC repositories, which were handled by adding a blacklist, and phishing attempts using CVE names on GitHub, for which there is no special handling and the README asks readers to be cautious. A listing indicates a repository mentioned the CVE identifier, not that it contains a verified exploit.

## Sources

- [Issues](https://github.com/ycdxsb/PocOrExp_in_Github/issues)
- [License: MIT](https://github.com/ycdxsb/PocOrExp_in_Github/blob/main/LICENSE)
- [Project website](https://pocorexp.nsa.im)
- [README](https://github.com/ycdxsb/PocOrExp_in_Github/blob/main/README.md)
- [ycdxsb/PocOrExp_in_Github on GitHub](https://github.com/ycdxsb/PocOrExp_in_Github)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/ycdxsb-pocorexp-in-github