Is it a must no and there is several diffrent kinds of vulnerabilities. Some sploits are C code some are perl some are web apps it just really depends IMO too broad a subject