~/tools $ ./cvss --score

CVSS 3.1 Calculator

Score a finding from its base metrics or paste a vector string. Uses the official CVSS 3.1 equations.

Runs entirely in your browser. Nothing you paste is sent anywhere.

0.0None
Attack Vector (AV)
Attack Complexity (AC)
Privileges Required (PR)
User Interaction (UI)
Scope (S)
Confidentiality (C)
Integrity (I)
Availability (A)

Why 3.1 and not 4.0

CVSS 4.0 is the current FIRST standard, but its score comes from a large lookup table rather than a formula. Most bug bounty platforms, vendor advisories, and older reports still use 3.1, so this calculator implements the 3.1 equations exactly. For 4.0, use theofficial FIRST calculator.

Scoring honestly

  • Score what you demonstrated, not the worst case you can imagine. Triage teams notice inflation.
  • Scope is Changed only when the impact crosses a security boundary, such as escaping a sandbox or a stored XSS that runs in another user's session.
  • The base score ignores business context. Explain in your report why a Medium might matter more for this client.