# What is a CVSS score?

Canonical: https://hackergpt.org/learn/cvss/

**CVSS, the Common Vulnerability Scoring System, rates the technical severity of a vulnerability from 0.0 to 10.0, computed from a short vector of metrics such as attack vector and privileges required. It is maintained by FIRST; version 4.0 is current, and many records still carry version 3.1 scores.**

## Why it matters

A score turns a long advisory into a number you can sort by, and the vector behind it says why the number is what it is. FIRST's specification maps scores to qualitative ratings: 0.1 to 3.9 low, 4.0 to 6.9 medium, 7.0 to 8.9 high and 9.0 to 10.0 critical, with 0.0 meaning none.

The base score describes the flaw in general, not in your deployment. FIRST says so directly: CVSS measures severity, not risk. A 9.8 in a library feature you never call can matter less to you than a 6.5 on your login page. CVSS 4.0 adds threat and environmental metrics so you can adjust the score for exploitation evidence and for your own setup.

## Example: reading a CVSS 3.1 vector

A vulnerability record carries a vector string next to the score. This one is the classic 9.8 critical, common for remotely reachable memory-corruption and injection bugs:

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H   -> 9.8 Critical

AV:N  attack vector: network (reachable remotely)
AC:L  attack complexity: low
PR:N  privileges required: none (no login)
UI:N  user interaction: none
S:U   scope: unchanged
C:H I:H A:H  high impact on confidentiality, integrity and availability
```

Now apply it to your own site. If the vulnerable component sits behind a login on your deployment, PR:N is not true for you; if the feature is switched off, the bug is not reachable at all. That is the reasoning the environmental metrics capture. Our vulnerability briefs show both: the severity each source published, and the checks to run on your own systems to see whether the conditions in the vector hold.

## Common mistakes

- **Treating the score as risk.** CVSS is severity in general. Your exposure, the data at stake and active exploitation decide priority.
- **Comparing a 3.1 score with a 4.0 score.** The versions use different metrics and formulas. Compare like with like, and quote the version.
- **Quoting one source's number as fact.** The vendor and the NVD sometimes score the same CVE differently. Say whose score it is.
- **Ignoring medium scores.** Several mediums chained together, or one on an exposed endpoint, can matter more than a distant critical.

## Related terms

- [CVE](https://hackergpt.org/learn/cve/)
- [OWASP Top 10](https://hackergpt.org/learn/owasp-top-10/)
- [Penetration testing](https://hackergpt.org/learn/penetration-testing/)
- [Attack surface mapping](https://hackergpt.org/learn/attack-surface-mapping/)

## Go deeper

- [HTTP2Shell (CVE-2026-111497): Is Your App Affected, and What to Patch](https://hackergpt.org/blog/http2shell-brotli-cve-2026-111497/)
- [Vulnerabilities: every brief on what to patch and how to check](https://hackergpt.org/vulnerabilities/)
- [HackerGPT features: check your own site for what is exposed](https://hackergpt.org/features/)

## Sources

- [FIRST: CVSS v4.0 Specification Document](https://www.first.org/cvss/v4.0/specification-document)
- [FIRST: CVSS v3.1 Specification Document](https://www.first.org/cvss/v3.1/specification-document)
- [NVD: Vulnerability Metrics](https://nvd.nist.gov/vuln-metrics/cvss)

Test only sites you own or have written permission to test. To practise without one, use CyberGym, a legal, deliberately vulnerable target. [Practise on CyberGym](https://cybergym.hackergpt.app).