Professional Vulnerability Reporting
The skill that separates researchers from professionals
Finding a vulnerability is a technical achievement. Getting it fixed is a professional one. In the real world of bug bounty programs, coordinated disclosure, and corporate security teams, the difference between a finding that gets patched in 48 hours and a finding that sits in a backlog for months is almost always the quality of the report.
Security teams receive dozens to hundreds of vulnerability reports every week. Reports with vague descriptions, missing reproduction steps, or no proof of concept are deprioritized — not because the security team is lazy, but because a report without sufficient detail requires significant investigation work before anyone can even confirm the vulnerability exists. A report that is clear, complete, and reproducible allows triage in minutes rather than hours, which means faster escalation, faster engineering prioritization, and faster shipping of a fix.
What CVSS scores are used for
The Common Vulnerability Scoring System (CVSS) produces a numerical score from 0 to 10 that encodes the severity of a vulnerability using eight standardized metrics. Security teams use CVSS scores for several purposes:
- Triage prioritization — Critical (9.0–10.0) findings get immediate attention; Low (0.1–3.9) findings can wait for a scheduled maintenance window.
- SLA compliance — many security programs have contractual Service Level Agreements that require fixes to ship within a defined number of days based on CVSS severity tier.
- Bug bounty payouts — programs use CVSS scores as the primary input to their payout calculators. A report that includes a correct, justified CVSS vector signals analytical competence and rarely gets downgraded at triage.
- Regulatory reporting — under frameworks such as SOC 2, ISO 27001, and PCI-DSS, organizations must track and report on vulnerability remediation timelines by severity. CVSS provides the standardized severity input.
A CVSS vector string such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is a compact, self-documenting artifact that communicates your full reasoning about a vulnerability's exploitability and impact. Including it in a report — with a brief explanation of each metric — demonstrates that you understand the finding at a level beyond simply triggering an error.
What this lab covers
In this lab you will write a complete professional vulnerability report for a SQL injection finding in a login endpoint. You will fill in every required field — title, CWE reference, CVSS vector, affected endpoint, reproduction steps, proof of concept, business impact, and fix recommendation — using the interactive report writer panel to your right.
The panel scores your report in real time on a 100-point quality meter. You need a score of 70 or above to unlock the submission button. After completing the report, you will also submit the correct CVSS 3.1 vector string for this specific finding to demonstrate that you can calculate severity independently.
By the end of this lab you will have practiced the core skill that makes security researchers genuinely useful to the organizations they work with.