Also known as: exploit code · proof of concept · PoC
An exploit is code or a technique that takes advantage of a specific vulnerability to cause unintended behaviour, such as executing attacker-supplied code, bypassing authentication, or crashing a service.
A vulnerability is a flaw; an exploit is the working demonstration that the flaw can be abused. The gap between the two is often substantial — many theoretically-exploitable bugs are never successfully weaponised because of memory layout randomisation, sandboxing, or sheer engineering difficulty.
Exploits are commonly graded by reliability. A proof of concept may work once under laboratory conditions; a weaponised exploit works consistently across versions and configurations, which is what makes it dangerous at scale.
Zero-Day
A zero-day is a software vulnerability that attackers know about and exploit before the vendor has released a patch, leaving defenders zero days to prepare a fix.
N-Day
An n-day is a vulnerability that has already been publicly disclosed and patched, but remains exploitable on systems that have not yet applied the update.
Remote Code Execution
Remote code execution (RCE) is a class of vulnerability that allows an attacker to run arbitrary code on a target system over a network, without physical access to that machine.
Buffer Overflow
A buffer overflow is a memory-safety vulnerability in which a program writes more data into a fixed-size memory buffer than it can hold, corrupting adjacent memory and potentially allowing an attacker to alter program execution.
Responsible Disclosure
Responsible disclosure, also called coordinated vulnerability disclosure, is the practice of privately reporting a vulnerability to the affected vendor and allowing a defined period for a fix before publishing details.