AV
Attack Vector
How remotely an attacker can reach the vulnerable system.
SECURITY SCORING WORKSPACE · HACKERONE-COMPATIBLE METHODS
CVSS Calculator
Choose the scoring method required by the program, build the vector, and validate every result server-side.
✓ CVSS 4.0✓ CVSS 3.1✓ HackerOne CVSS 3.0✓ Manual severity
CVSS 4.0 score
10.0
Critical
Severity, not business risk
Score verified by the server.
01
Base metrics
The intrinsic characteristics of the vulnerability and its direct impact.
AC
Attack Complexity
Conditions outside the attacker's control that affect exploit reliability.
AT
Attack Requirements
Deployment or execution conditions that must already exist for exploitation.
PR
Privileges Required
The privileges the attacker needs before exploitation.
UI
User Interaction
Whether a user other than the attacker must take an action.
VC
Vulnerable System Confidentiality
Confidentiality loss on the vulnerable system.
VI
Vulnerable System Integrity
Integrity loss on the vulnerable system.
VA
Vulnerable System Availability
Availability loss on the vulnerable system.
SC
Subsequent System Confidentiality
Confidentiality impact beyond the vulnerable system.
SI
Subsequent System Integrity
Integrity impact beyond the vulnerable system.
SA
Subsequent System Availability
Availability impact beyond the vulnerable system.
02
Threat metrics
Current evidence about real-world exploitation maturity.
E
Exploit Maturity
The current maturity and availability of exploit code or active exploitation.
03
Environmental metrics
Adjust the score for the importance and configuration of your environment.
CR
Confidentiality Requirement
Importance of confidentiality in this environment.
IR
Integrity Requirement
Importance of integrity in this environment.
AR
Availability Requirement
Importance of availability in this environment.
MAV
Modified Attack Vector
Attack vector after environment-specific controls.
MAC
Modified Attack Complexity
Attack complexity after environment-specific controls.
MAT
Modified Attack Requirements
Attack requirements after environment-specific controls.
MPR
Modified Privileges Required
Required privileges in this environment.
MUI
Modified User Interaction
Required user interaction in this environment.
MVC
Modified Vulnerable Confidentiality
Modified confidentiality impact on the vulnerable system.
MVI
Modified Vulnerable Integrity
Modified integrity impact on the vulnerable system.
MVA
Modified Vulnerable Availability
Modified availability impact on the vulnerable system.
MSC
Modified Subsequent Confidentiality
Modified confidentiality impact on subsequent systems.
MSI
Modified Subsequent Integrity
Modified integrity impact on subsequent systems.
MSA
Modified Subsequent Availability
Modified availability impact on subsequent systems.
04
Supplemental metrics
Extra context that does not change the numerical score.
S
Safety
Potential impact to human safety.
AU
Automatable
Whether the attack can be automated across targets.
R
Recovery
Expected recovery behavior after an attack.
V
Value Density
Resources obtained per exploitation event.
RE
Vulnerability Response Effort
Expected effort for consumers to respond.
U
Provider Urgency
Vendor-provided urgency label.
CVSS describes technical severity, not complete business risk. HackerOne CVSS 3.0 uses its documented custom environmental formula; asset-level maximum severity caps are program-specific and are not applied here.
Read HackerOne's formula ↗