This calculator scores a vulnerability's severity under both FIRST's CVSS v3.1 Specification Document and CVSS v4.0 Specification Document Base metric groups at once: pick the Attack Vector, Attack Complexity, Privileges Required and impact values for each standard, and it computes the 0.0–10.0 Base score, the qualitative severity rating and the full vector string entirely in your browser, with no file upload or server call involved.
CVSS v3.1 Base score
9.8
Base score — Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Critical severity: the selected metrics describe a realistic attack path with severe impact. Treat this as a priority for patching or mitigation.
CVSS v4.0 Base score
9.3
Base score — Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Critical severity: the selected metrics describe a realistic attack path with severe impact. Treat this as a priority for patching or mitigation.
Both scores are Base metrics only (no Threat/Environmental adjustment), computed entirely in your browser. Nothing you select here is sent to SoftWSP.
How is a CVSS Base score calculated?
Both versions turn a handful of metric selections into a single 0.0–10.0 number, but the underlying math differs. CVSS v3.1 Base score is a closed-form formula: an Exploitability sub-score (from Attack Vector, Attack Complexity, Privileges Required and User Interaction) and an Impact sub-score (from Confidentiality, Integrity and Availability impact, adjusted by Scope) are combined and rounded up to one decimal place.
CVSS v4.0 Base score is not a closed-form formula. Per the FIRST CVSS v4.0 User Guide, every combination of the 11 Base metrics reduces to one of a fixed set of "MacroVector" severity classes, each with a published score; the exact score for a specific combination is then interpolated between that class's score and its nearest lower-severity neighbour. This calculator implements that lookup-and-interpolation algorithm directly — the same one the National Vulnerability Database uses to publish its own CVSS v4.0 scores.
Sources
Frequently asked questions
Why does the same vulnerability get a different score under CVSS v3.1 and CVSS v4.0?
The two standards use different Base metrics, not just different arithmetic on the same inputs. v4.0 replaces v3.1’s single Scope (Changed/Unchanged) flag with separate Vulnerable System (VC/VI/VA) and Subsequent System (SC/SI/SA) impact groups, and adds a new Attack Requirements (AT) metric. A flaw that scores 9.8 under v3.1 Base can legitimately score 9.3 under v4.0 Base — see the linked guide below for a full breakdown of what changed.
Why does this calculator only compute the Base score, not Environmental or Threat metrics?
Base score is the only part of either standard a vulnerability can be scored on without extra context — Threat metrics need real-world exploit intelligence, and Environmental metrics need the asset owner’s own impact tolerance. Showing Base-only keeps this tool usable the moment you know a vulnerability’s technical characteristics, matching how most vendor advisories and NVD entries report their primary score.
Does any vulnerability data I enter here leave my browser?
No. Every metric selection, the vector string and both scores are computed by JavaScript running on your machine; there is no file upload, no fetch call and no server-side processing involved in the scoring itself.
What happened to the CVSS v3.1 "Scope" metric in CVSS v4.0?
It was retired. v3.1 used one Changed/Unchanged flag to signal that an exploit’s impact crosses a security boundary. v4.0 replaces it with two explicit impact groups — Vulnerable System (VC/VI/VA) for the component with the flaw, and Subsequent System (SC/SI/SA) for everything else the exploit can reach — which the FIRST CVSS v4.0 User Guide gives worked guidance on choosing.
Where can I check a CVSS score that NVD or a vendor advisory already published?
The National Vulnerability Database publishes the CVSS vector string alongside every CVE it scores; paste that vector’s metric values into the matching version here (v3.1 or v4.0) and this calculator will reproduce the same Base score from the same FIRST specification formulas NVD uses.
Questions about this page?