What is CVSS?
A standard 0–10 score for the severity of a vulnerability. Useful for prioritisation, but a score is not the same as proven, in-context impact.
CVSS: A standard 0–10 score for the severity of a vulnerability. Useful for prioritisation, but a score is not the same as proven, in-context impact.
In plain language
CVSS gives a vulnerability a severity number based on factors like attack vector and impact. It is a helpful common language for triage, but a high base score on an unreachable issue is less urgent than a medium score on a live path to your customer data.
SuperPentest reports severity alongside reproduced impact in your context — the actual access or action demonstrated — so prioritisation rests on what was proven, not a generic score. How findings are verified →
A concrete example
Two findings both score CVSS 7.5. One is an unauthenticated info leak on a login page; the other is a theoretical issue in an admin tool reachable only from the office VPN. The score is identical; the real urgency is not. SuperPentest reports the demonstrated access alongside the score, so you triage on proven impact in your context, not the number alone.
Related
CVE → · How findings are verified →
Want this tested on your app? Book a demo or read how findings are verified.