Guide
Scoring a vulnerability with CVSS 3.1
The Common Vulnerability Scoring System, maintained by FIRST, turns a description of a security flaw into a number from 0 to 10 that triage teams can sort by. Scanners, advisories and vulnerability databases quote it everywhere, usually together with a vector string that records the choices behind the number. This calculator reads such a string, or lets you pick each metric, and returns the score, the severity word and the two subscores, following the CVSS 3.1 specification step by step.
Reading a vector
A string such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is eight base metrics. AV is the attack vector (Network, Adjacent, Local, Physical), AC the attack complexity, PR the privileges needed, UI whether a user must act, S the scope, and C, I and A the loss of confidentiality, integrity and availability. Each letter maps to a fixed weight, and the formulas combine them. The page shows the two parts it computes: an exploitability subscore from the first four metrics and an impact subscore from the last three.
Worked scores
The page starts with the classic remote-code-execution vector above: base score 9.8, Critical, impact 5.9, exploitability 3.9. The other presets show how a few letters move the result. With Scope changed (S:C) and the same impact, the score becomes 10.0. A confidentiality-only leak over the network with no privileges (C:H/I:N/A:N) rates 7.5, High. A local attacker with low privileges and full impact (AV:L/PR:L) rates 7.8. A reflected cross-site scripting flaw that needs a click, changes scope and has low impact (UI:R/S:C/C:L/I:L/A:N) rates 6.1, Medium. These match the scores usually published for the same vectors.
Temporal and environmental scores
Base metrics describe the flaw as such. Temporal metrics add what is known today: whether exploit code exists, whether a fix is available, how sure the report is. Environmental metrics let you reflect your own situation with confidentiality, integrity and availability requirements and with modified base metrics. Both are optional; with unchanged scope the environmental score tops out at 9.8, and only a changed scope can reach 10.0. If you leave them out, the page shows dashes for them rather than a made-up number.
Rounding
CVSS rounds up, not to nearest. The 3.1 specification defines a round-up function: multiply the value by 100,000 and round to an integer, and if that integer is an exact multiple of 10,000 keep the value, otherwise go up to the next tenth. A raw result of 4.0000000001 caused by floating-point noise therefore stays 4.0, while a true 4.02 becomes 4.1. This page implements that function exactly, which avoids the off-by-0.1 differences seen in careless implementations.
Limits
CVSS 4.0 is a separate method with its own tables and is not covered. The tool does not choose metrics for you: two analysts can describe one flaw differently, so compare vectors and not only numbers. A score measures technical severity, not the risk to your business.
Related tools
- OWASP Top 10 and CWE Reference explains the weakness classes behind many vectors.
- IOC Extractor collects CVE identifiers from advisories.
- Security Headers Generator helps close common web findings.
- Password Strength Checker covers a frequent authentication finding.
Checked against the current version of the CVSS Calculator on .