What does "exploit price" on vuldb.com means?

Yes, it means that in the exploit market that kind of exploit can be sold and bought for something in that range (e.g. $25k-$50k). That website doesn't specifically talk about black market:

The ongoing observation of the exploit market structure helps to collect current prices.

but, if you don't report vulnerabilities to bug bounties, the market you'll find is somewhat gray, if not definitely black, as the legality of selling exploits to a third party is dubious.

A well-known company in this sector, Zerodium, has published its payout ranges for different types of exploits: https://zerodium.com/program.html. There is also a famous 2012 Forbes article on the topic.

It is also very likely that vuldb.com crawls black market websites, in order to find more accurate information on the prices. However, there are probably market areas which cannot be easily found, such as the three/four-letter agency market (i.e. worldwide intelligence agencies, such as the NSA). It has been speculated that prices in those areas are much higher than the ones typical of the "standard" black market.


Exactly what it sounds like - it's the estimated price for an exploit of this kind. Generally a zero-day exploit (e.g. unpatched, and ideally exclusive to buyer), but not always (there is still a small market for patched bugs, where the target is known not to patch in a timely fashion).

There are various "black market" sites offering exploits for sale, so it would be relatively easy to crawl these looking for the latest prices on a regular basis. Not all exploits are sold in this way - look at the HackingTeam emails for an example of a company developing exploits to order, until they got hacked, at least...