CVSS 3.1 Base Score Calculator

Frequently Asked Questions

• What is CVSS?+
  The Common Vulnerability Scoring System is an open, vendor-neutral standard for rating the severity of software vulnerabilities. It produces a number from 0.0 to 10.0 and a matching severity label, so that teams everywhere can describe and compare risk in a consistent way. This tool implements the base-score portion of CVSS version 3.1.
• What are the eight base metrics?+
  They are Attack Vector (how remote the attacker can be), Attack Complexity (how hard the attack is to pull off), Privileges Required, User Interaction, Scope (whether impact spreads beyond the vulnerable component), and the Confidentiality, Integrity and Availability impacts. Together these capture how easily a flaw can be exploited and how bad the consequences are.
• How is the base score calculated?+
  CVSS combines an exploitability sub-score (from attack vector, complexity, privileges and user interaction) with an impact sub-score (from the confidentiality, integrity and availability metrics). The two are combined and rounded up to one decimal place, with a small multiplier applied when scope is changed. This calculator uses the exact formula and metric weights from the official v3.1 specification.
• What does “Scope” mean?+
  Scope captures whether a vulnerability in one component can affect resources beyond its own security authority. If exploiting the flaw only impacts the vulnerable component, scope is Unchanged; if it lets an attacker affect other components — for example escaping a sandbox or virtual machine — scope is Changed, which raises the score because the blast radius is larger.
• What do the severity ratings mean?+
  CVSS v3.1 maps scores to qualitative ratings: 0.0 is None, 0.1–3.9 is Low, 4.0–6.9 is Medium, 7.0–8.9 is High, and 9.0–10.0 is Critical. These bands help teams prioritise: a Critical finding typically demands urgent patching, while a Low finding can often be scheduled into routine maintenance.
• What is the vector string for?+
  The vector string, such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, records every metric choice in a compact, standard format. Anyone who reads it can reproduce your exact score and see precisely how you assessed the vulnerability. It is the canonical way to share and document a CVSS rating, and you can copy it directly from this tool.
• Does this include Temporal and Environmental scores?+
  No. This calculator focuses on the Base score, which reflects the intrinsic characteristics of a vulnerability that do not change over time or across environments. Temporal metrics (such as exploit maturity) and Environmental metrics (which tailor the score to your specific deployment) adjust the base and are typically layered on afterward.
• Is a CVSS score the same as risk?+
  Not exactly. CVSS measures the severity of a vulnerability in isolation, which is an important input to risk but not the whole picture. Real risk also depends on how exposed the affected asset is, what compensating controls exist, the value of the data, and the likelihood of attack. Use CVSS to prioritise, then apply your own environmental context.
• How accurate is this calculator?+
  It implements the published CVSS v3.1 equations and metric weights exactly, and it reproduces the official reference vectors — for instance, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields 9.8. The scoring is deterministic, so identical metric selections always produce identical results, matching other compliant calculators.
• Are my selections sent anywhere?+
  No. All scoring runs locally in your browser. Nothing about the vulnerability you are assessing is transmitted, logged or stored, so the tool is safe to use for internal, undisclosed or sensitive findings.