A proof-of-concept, often shortened to PoC, is code or a set of steps that demonstrates a vulnerability can actually be triggered. Researchers usually publish one to show that a flaw is real, to help vendors reproduce and fix it, and to let defenders test whether their own systems are affected. A PoC is typically minimal: it proves the issue exists rather than providing a polished attack tool.
PoCs differ widely in what they show. Some only cause a crash, others demonstrate a limited effect, and a few reach full code execution. A working demonstration in a lab, under specific conditions, does not mean the same result can be achieved against every real system, since impact depends on the version, configuration and protections in place.
A public PoC also does not establish that attackers are using the flaw. It does, however, lower the effort needed to build a working exploit, so the risk can rise once one is available. Treat a PoC and exploitation in the wild as separate facts: the first is a demonstration, the second requires evidence of real attacks. Be cautious with PoC code from unverified sources, as some published examples are broken, misleading or themselves malicious.
Defenders should use a PoC only from a source they trust, run it in an isolated test environment and never against systems they do not own or lack permission to test. The more reliable response is to apply the vendor fix, confirm the fixed version is the one actually running, and check advisories for whether active exploitation has been reported.