Test whether a CVE exploit still exists in a patched package version by writing an exploit against the older version and a test that determines whether the exploit passes.