Skip to content
CVSS.my.id

Worked Examples

Below are worked vulnerability examples across all four CVSS versions. Click any calculator link to inspect or modify the vector live in the browser calculator.

1. Unauthenticated Remote Code Execution (CVSS v4.0)

A network-reachable service allows unauthenticated remote code execution (AV:N/AC:L/AT:N/PR:N/UI:N) with full compromise of the vulnerable host (VC:H/VI:H/VA:H), no subsequent system impact (SC:N/SI:N/SA:N), and public Proof-of-Concept exploit code (E:P).

  • Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
  • Base Score (CVSS-B): 9.3 (Critical)
  • Base + Threat Score (CVSS-BT): 8.9 (High)
  • Open in Calculator: Inspect in v4.0 Calculator

2. Container Escape Affecting Host System (CVSS v4.0 + Supplemental)

An attacker with low privileges inside a container (AV:L/AC:L/AT:N/PR:L/UI:N) compromises both the container (VC:H/VI:H/VA:H) and the underlying host (SC:H/SI:H/SA:H). Supplemental metrics record that the vulnerability is automatable (AU:Y) with provider urgency Red (U:Red).

  • Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/U:Red
  • Score (CVSS-B): 9.3 (Critical) (Supplemental metrics AU:Y/U:Red are preserved in the vector without changing the numeric score.)
  • Open in Calculator: Inspect in v4.0 Calculator

3. Stored Cross-Site Scripting (CVSS v3.1)

An attacker with low privileges (PR:L) injects script that executes in a victim user’s browser (UI:R, S:C) with low confidentiality and integrity impact (C:L/I:L/A:N).

4. Critical Network Service Compromise (CVSS v3.1 vs v3.0)

5. Legacy Network Buffer Overflow (CVSS v2.0)

  • Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C
  • Base Score: 10.0 (High) (Remember: CVSS v2.0 highest severity rating is High.)
  • Temporal Score: 8.3 (High)
  • Open in Calculator: Inspect in v2.0 Calculator