A tested module in an exploit framework or a template in a vulnerability scanner usually lowers the skill needed to attack more than a raw proof of concept pasted on a blog. FIRST says EPSS weighs the kind of exploit code, where it is published and how widely adopted, not just whether it exists.
Three kinds of public exploit material
| Kind | What it is | Why it matters |
|---|---|---|
| Raw proof of concept | Code or steps that demonstrate a flaw, often a script on a personal site or repository | May need editing, may only crash a service, may not match your version |
| Framework module | An exploit packaged for an open source penetration testing framework | Standard interface, easier for many operators to run |
| Scanner template | A detection or check definition for a scanning engine | Lets people test many targets quickly |
The Metasploit project describes its framework as an open source tool under a BSD style license, which is why a module there is available to anyone. ProjectDiscovery's documentation says Nuclei templates define targeted requests for specific vulnerability checks across protocols such as HTTP, DNS and TCP, and that templates are community developed and open source. The Exploit Database describes itself as an archive of public exploits and proof of concept code.
These sources describe the tools. Whether a tool is used in attacks is a separate question, and none of the pages claims it.
Why FIRST separates them
FIRST says one of the strongest signals in EPSS is public exploit code, but the model asks what kind. It contrasts carefully tested code that is operationalized in an exploit framework with a proof of concept pasted on a personal blog. It also tracks whether a vulnerability has entered operational attacker tooling such as Nuclei templates, and notes that some such signals follow attacker attention while others create it. The same page says the model uses how widely GitHub repositories hosting exploit code are engaged with.
A simple rating for your own notes
- Level 0: no public code found.
- Level 1: a raw proof of concept exists. Read it. Does it match your version and setup?
- Level 2: several independent proofs of concept, or a write up with working steps.
- Level 3: a packaged module or a scanner template exists.
- Level 4: credible reports of real use, or a KEV listing.
This is an internal shorthand, not a standard. It helps teams talk in the same terms. For a formal scale, the CVSS threat metric and SSVC's exploitation values define their own levels, which are covered in CVSS exploit maturity and does a public exploit mean patch now.
What to check before you react
- Does the code target your version and configuration?
- Does it need authentication, a special setting or user interaction?
- Is the vulnerable service reachable from outside your network?
- Is it remote code execution, or a crash?
If the answers favor an attacker, move up your queue. If the code only works against a setup you do not run, document that and re-check later, because new variants appear.
A caution on running code
Public exploit code is untrusted. If you test it, do so in an isolated lab, read it first and never run it against systems you do not own. Treat the archive as research material, not a download source for production.
Safeguard's reachability analysis helps show whether a vulnerable function in your dependency is called at all, which is often the fastest way to rule a public exploit in or out for your code. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Work through the questions and see how a public exploit changes only some of the answers.
Quick check
Is a Metasploit module proof that attackers use a flaw?
No. It shows a packaged exploit is available. Active use is a separate fact, shown by KEV or credible reports.
Does a scanner template mean the flaw is being exploited?
No. A template defines a check. FIRST treats tooling as a signal that follows or creates attacker attention, not proof of attack.
Sources
- How EPSS Works (FIRST)
- Metasploit Framework README (Rapid7, GitHub)
- Introduction to Nuclei Templates (ProjectDiscovery)
- About the Exploit Database (OffSec)
Last reviewed: 19 October 2026.
