This repository contains descriptive payload manifests for publicly-disclosed CVEs that are 90+ days old. Each manifest points at existing public proof-of-concept code and describes how to reproduce the vulnerability in a lab environment. The repo itself contains no novel weaponized exploit code.

These payload manifests are intended for:

• Educational use (learning how attackers approach a class of vulnerability)
• Internal lab testing (running PoCs against your own deliberately-vulnerable targets)
• Authorized red-team / pentest engagements (where you have written authorization)
• Security awareness training (showing operations teams what an exploit looks like)

These payload manifests are not intended for:

• Unauthorized access to systems you do not own
• Probing production systems without coordination and authorization
• Bypassing terms of service or abuse policies of third-party platforms
• Any use that would constitute unauthorized access under your jurisdiction's law

You are responsible for ensuring your use is authorized and legal. The authors and BlueTeamAutomation are not liable for unauthorized use.

If you find an error in one of our payload manifests — wrong CVSS score, broken lab setup, dangerous default in a probe configuration, misleading remediation — please email security@cveasyai.com with the subject "Payload manifest issue: ".

Do not file a public GitHub issue for safety-impacting bugs in our content. Coordinate with us first.

We aim to acknowledge within 72 hours and ship a fix within 30 days for confirmed issues.

If you use one of our payloads to find a vulnerability in a third-party system (where you have authorization to test), follow that vendor's responsible disclosure policy. Do not publish proof of concept against a production system without coordination.

If you cannot find a vendor contact, email security@cveasyai.com and we will help broker disclosure.

• Pull requests adding active 0-day exploits (CVEs less than 90 days old)
• Payload manifests that ship novel weaponized exploit code (we link to public PoCs only)
• Manifests targeting vendors or platforms that have explicitly forbidden testing in their terms of service
• Manifests with destructive default settings (no rm -rf, no encryption-on-disk, no persistent backdoor probes)

If you have a question about whether something is in scope, email security@cveasyai.com before submitting.

For payloads in this repo, all referenced public PoCs are already in the public domain at the time of release. We do not coordinate fresh disclosures through this repo. The paid CVEasy AI app handles coordinated-disclosure workflows for organizations that need it.

MIT licensed. AS-IS, no warranty. See LICENSE.