Exploits
We monitor exploit sources for you and add them to our database and correlate exploits with other data. Knowing if a public exploit exists is very important for prioritization. When a public exploit is available, anyone who knows how to run a script or metasploit may exploit a vulnerability. Usually issues with a public exploit should be given the highest priority.
We collect exploits from the following sources:
- Metasploit: All published modules including exploits and auxiliary modules.
- Packetstorm security
- Exploit-db
We also monitor Metasploit source code repository and correlate mentions in the repository with CVEs. Users can see mentions in Metasploit source repository in CVE timelines which helps users to understand exactly when the exploit was being worked on.
Please note that metasploit modules don't have an exact exploit published date, but they have a disclosure date which is normally before the actual module publish date.
This causes skews in CVE timelines but a note on the CVE timeline page clarifies this issue.