# zhzyker/vulmap

Vulmap 是一款 web 漏洞扫描和验证工具, 可对 webapps 进行漏洞扫描, 并且具备漏洞验证功能

Repository: https://github.com/zhzyker/vulmap
Canonical: https://ross.abutalabs.com/products/vulmap
Homepage: https://github.com/zhzyker/vulmap
Language: Python
License: GPL-3.0
License Family: copyleft
Topics: exploit, cve, rce, vulnerabilities, cve-2016-4437, security, security-tools, pentesting, pentest-tool, cve-2020-14882, cve-2020-2555, cve-2020-2883, scanner, cve-2020-13942, cve-2020-17518, cve-2021-21972, cve-2021-26855, cve-2021-27065, cve-2021-21975, cve-2021-3129
Last push: 2023-04-26T06:40:48+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 2154, "days_push": 1225, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3521, forks 576 (observed 2026-08-28T04:08:07.956270+00:00)

## What it is
Vulmap is a Python 3 command-line tool that scans web applications for known CVE vulnerabilities and can immediately verify or exploit them. It targets common middleware and frameworks such as WebLogic, Tomcat, Shiro, Spring, Struts2, Fastjson, Solr, Elasticsearch, Jenkins, and Drupal, and supports bulk scanning of assets from Fofa, Shodan, or dismap output files.

## Use cases
- scan a web app for known cve vulnerabilities
- verify an rce found on weblogic or tomcat during a pentest
- bulk scan fofa or shodan results for exploitable cves
- check if a target is vulnerable to shiro deserialization or fastjson rce
- find a quick poc-based scanner for common java middleware cves
- turn vulnerability detection into direct exploitation in one tool

## When to choose
- You need a single lightweight CLI that both detects and verifies known CVEs in widely used web middleware and frameworks
- You want to batch-scan large asset lists from Fofa, Shodan, or dismap fingerprint results with multithreading
- You are doing an authorized security assessment and need fast proof-of-concept confirmation of RCE or deserialization flaws

## When to avoid
- You need a full enterprise DAST/vulnerability-management platform with authenticated scanning, reporting, and continuous monitoring
- Your target technology or CVE is not on its supported list (activemq, flink, shiro, solr, struts2, tomcat, unomi, drupal, elasticsearch, fastjson, jenkins, nexus, weblogic, jboss, spring, thinkphp)
- You require up-to-date coverage of newly published CVEs, since the project has not seen a release since April 2023

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: vulnerability-scanning, penetration-testing, security, osint
- domain: security, penetration-testing
- platform: windows, cross-platform, cli, python
- tags: exploit, cve, rce, vulnerability-scanner, pentest-tool, web-security, fofa, shodan, batch-scanning, red-team, linux, macos, docker

## Member repositories
- zhzyker/vulmap (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:07.956270+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:35:32.111095+00:00, confidence not recorded.
  - readme: https://github.com/zhzyker/vulmap (fetched 2026-08-28T04:08:07.956270+00:00, sha 9a909b670293)
  - homepage: https://github.com/zhzyker/vulmap (fetched 2026-08-29T09:29:19.651411+00:00, sha c2f8173a9229)
- Data as of 2026-08-30T08:39:29.467469+00:00.