Choose the metrics, or paste a vector from a tool’s output or an old report, and get the score, the severity and the vector string to put in a finding. It scores 4.0 as the reference calculator does, and 3.1 by the specification's own formulas.
What the vulnerability is: how it is reached and what it does to the system it is in and to the systems beyond it.
How likely it is to be used: whether it is being attacked, has a public proof of concept, or neither.
The system as your client runs it: how much each impact matters to them, and any base metric their setup changes.
Extra context for the reader. They never change the score.
A vector pasted from elsewhere is read in its own version, in any order and in either case, and anything wrong with it is named: a metric given twice, a value the version does not have, a base metric missing.
FIRST gives CVSS 3.1 and 4.0 the same qualitative scale, so a score maps to a severity the same way in either:
| Severity | Score |
|---|---|
| None | 0.0 |
| Low | 0.1 to 3.9 |
| Medium | 4.0 to 6.9 |
| High | 7.0 to 8.9 |
| Critical | 9.0 to 10.0 |
A score rates the vulnerability, not the risk to a particular client. Most testing firms report the CVSS score beside a severity they have judged in context, and say so in the report's methodology; the severity levels guide covers when the two should differ.
Quote the version and the full vector with every score, and in 4.0 the name of the score (CVSS-B, BT, BE or BTE), so the number can be checked rather than argued about. Score the vulnerability you demonstrated, not the worst one you can imagine, and record the environmental metrics you applied in the finding rather than only in your head.
In Pental a finding is scored in 3.1 or 4.0, whichever your firm uses, and the vector is built from the metrics you choose, so the score and the string in the report always agree, in the Portal and in our free, open-source reporting tool alike. See the platform.
For CVSS 3.1, yes: it uses the specification’s formulas for the base, temporal and environmental scores, including its Roundup, which works in whole numbers so a value like 8.600000000000001 is not rounded up to 8.7. For CVSS 4.0 it gives the score of the reference calculator FIRST’s is built from, Red Hat’s, with its MacroVector table and interpolation, on every one of the 104,976 base vectors. That calculator corrected its rounding in 2024, so on a few hundred vectors whose exact score ends in 5, a calculator without the correction shows 0.1 less.
No. The scoring happens in your browser and nothing you choose or paste leaves the page. The vector is kept in the page’s address so you can share it, which means it only goes where you send the link.
The two versions measure different things and score them differently. 4.0 adds Attack Requirements, splits impact between the vulnerable system and the systems beyond it instead of using Scope, grades User Interaction as Passive or Active, and replaces the formula with a table of 270 MacroVector scores. A difference of a point or so between the versions is normal and not an error in either.
They are FIRST’s names for what a CVSS 4.0 score includes: B for base metrics alone, T when threat metrics are set, E when environmental metrics are set. A score should always be quoted with its name, so a reader knows whether it reflects exploit maturity or the client’s own environment.
Because CVSS 4.0 scores a threat or environmental metric left Not Defined at its worst case: Exploit Maturity as Attacked, and each security requirement as High. A base score is therefore the score before threat intelligence or the client’s environment is taken into account, and setting those metrics can only bring it down or leave it where it is.
The one your client’s policy or your methodology names, stated beside every score. CVSS 4.0 is FIRST’s current version. 3.1 is still what many security tools and vulnerability databases publish, so a report scored in 4.0 will often quote 3.1 scores from its sources, and saying which is which avoids an argument about a number.
Yes. Choose Score many at once and paste up to 500 vectors, one a line, in either version. Each is scored in its own version, anything that is not a whole vector says why, and the table copies as CSV.
The tools are free and stay free, and so is our open-source reporting tool. Pental is the platform they come from.
Pental is pentest management and reporting for testing firms: findings scored as you write them, reports in your own Word template, QA review and a white-label client portal. Free trial, no card required.