CVSS 3.1 Base Score Calculator
Pick the eight base metrics and get the CVSS 3.1 base score, the severity rating and the vector string, ready to paste into a ticket or a risk register.
🔒 Runs entirely in your browser. Nothing you type is sent anywhere.
How to use it
- Set each of the eight base metrics to match the vulnerability you are scoring.
- Read the base score (0 to 10) and the severity band at the top.
- Copy the vector string into your ticket, risk register or advisory so anyone can see how the score was reached.
What the metrics mean
- Attack Vector (AV): how close the attacker must be, from across the internet (Network) down to physical access.
- Attack Complexity (AC): whether the attack works reliably (Low) or needs conditions outside the attacker’s control (High).
- Privileges Required (PR): what access the attacker needs before they start.
- User Interaction (UI): whether a victim has to do something, such as open a file.
- Scope (S): whether the impact stays in the same security authority (Unchanged) or spreads beyond it (Changed).
- Confidentiality, Integrity, Availability (C/I/A): how badly each is hit.
Severity bands
| Score | Rating |
|---|---|
| 0.0 | None |
| 0.1 to 3.9 | Low |
| 4.0 to 6.9 | Medium |
| 7.0 to 8.9 | High |
| 9.0 to 10.0 | Critical |
FAQ
Is this the base score only? Yes. CVSS 3.1 also has temporal and environmental metrics that adjust the base score for a specific situation. The base score is the one quoted in most advisories and the one scanners report.
Does it match the official calculator? It uses the CVSS 3.1 specification formula, so the score and vector match the FIRST calculator for the same inputs.
Is anything sent to a server? No. The maths runs in your browser.