How to use the CVSS Score Calculator
- 1. Pick a versionCVSS 3.1 (still the most common) or CVSS 4.0 (released by FIRST in 2023).
- 2. Set the metricsChoose how the flaw is reached and what it affects, or paste a full vector.
- 3. CalculateGet the score, severity band and vector; 3.1 vectors with temporal and environmental metrics are scored too.
How CVSS scoring works
The Common Vulnerability Scoring System rates a vulnerability from 0 to 10. In CVSS 3.1, exploitability metrics (attack vector, complexity, privileges, user interaction) and impact on confidentiality, integrity and availability feed a published formula, with Scope deciding whether the impact reaches other components. CVSS 4.0 replaces the formula: the metrics are grouped into six equivalence sets that pick a "MacroVector", whose score comes from FIRST's lookup table and is then adjusted within that group. It also splits impact into the vulnerable system and subsequent systems, adds Attack Requirements, and asks you to name the score type (CVSS-B, BT, BE or BTE). Everything is calculated in your browser; nothing you enter is uploaded.
We compared 3,000 random CVSS 3.1 vectors (half with temporal and environmental metrics) and 4,000 random CVSS 4.0 vectors with the open-source cvss Python library, and every score matched.
Worked example
A web application flaw reachable over the network, with low complexity, needing a normal user login and no user interaction, that exposes and changes data but doesn't take the service down, is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N: 8.1 High. The same flaw in CVSS 4.0 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N) scores 8.6 High as CVSS-B. The well-known worst case, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, is 9.8 Critical.
Good practice
- Score the flaw itself for the base score; your own exposure belongs in environmental metrics.
- Always share the vector with the score, so others can check your choices.
- Severity bands are the same in both versions: Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, Critical 9.0–10.0.
Frequently asked questions
Should I use 3.1 or 4.0?
Use what your organisation, bug bounty programme or vulnerability database asks for. Many still publish 3.1; 4.0 adoption is growing.
Why do 3.1 and 4.0 give different scores?
They use different metrics and methods, so the same flaw can land in a different band; that's expected.
Is the CVSS calculator free?
Yes. You can open the CVSS calculator and use every option without signing up. When you calculate a score for the first time, we ask once for your name and WhatsApp number; after that it, and every other Uncodemy tool, opens straight away.