CVE Test Scripts

This is part of a university project.

This project aims to standardise and centralise scripts that validate if a program is actually vulnerable to the CVEs that are assigned to it. This helps to filter out some false positives such as when the installed version has backported patches applied or when the {run,compile} time configuration in use is not affected.

What it is

• A collection of scripts that check for specific known vulnerabilities with CVEs assigned;
• A reference for how such scripts should be implemented in conformance with the proposed specification.

What it's not

• A generic DAST/SAST tool that scans for new vulnerabilities;
• A tool that naively compares software version numbers with those supposedly affected by CVEs;
• A ready-to-use vulnerability scanner, though one may be built on top of it.

Usage

One of:

• ./cve-test path/to/test.sh
• ./cve-test path/to/cve_dir
• path/to/cve-test from CVE directory

License

Copyright (C) 2025 João Lucas
Copyright (C) 2025 João Mendes
Copyright (C) 2025 Madalena Ungaro

Unless otherwise stated, all files in this repository are licensed under the GNU GPLv3: http://www.gnu.org/licenses/gpl-3.0.html