Typorithm · medium

Findings & CVSS

findings-cvsspentestfindingscvssseverity

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Findings & CVSS

Reporting

A finding documents one issue with a clear title, reproducible steps, evidence, business impact, a CVSS v3.1 score, and a remediation. CVSS base metrics standardize severity across reports, but findings are prioritized by real business risk, not the raw score alone.

A finding is the atomic unit of a pentest report. Each one needs a clear title, the reproducible steps to trigger it, supporting evidence (screenshots, requests), and the business impact it creates.

CVSS v3.1 turns severity into a standard 0–10 base score from metrics like attack vector and impact, so a critical here means the same as a critical in another report. The score is a shared language, not the final word.

Real prioritization weighs the CVSS score against context: an internet-facing SQL injection on a payments database outranks a higher-scored bug buried behind VPN and admin login. Risk to the business drives the order, not the number alone.

A finding = title + repro steps + evidence + impact + fix.

CVSS v3.1 base score standardizes severity 0–10.

Prioritize by business risk, not the raw score alone.

finding:
  title: sql-injection-in-login
  severity: critical
  cvss: 9.8
  impact: full-db-access
  remediation: parameterized-queries

Read the implementation

Connect each part of the code to the concept before you type.

1. Finding title

Each finding opens with a clear, specific title so a reader knows the issue at a glance.

title: sql-injection-in-login

2. Severity rating

A severity label (critical/high/medium/low) lets readers triage at a glance before reading the score.

severity: critical

3. CVSS score

The CVSS v3.1 base score standardizes severity on a 0–10 scale so it is comparable across reports.

cvss: 9.8

4. Business impact

Impact ties the technical bug to what it actually lets an attacker do to the business.

impact: full-db-access

5. Remediation

Every finding ships with a concrete fix so the team knows exactly what to change.

remediation: parameterized-queries

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.