# Vulnerability Classification

## CVSS Scoring Guidance

When scoring a finding, use CVSS 3.1 as the common language:

| Severity | Score Range | Meaning |
|----------|-------------|---------|
| None | 0.0 | No risk |
| Low | 0.1-3.9 | Limited impact, hard to exploit |
| Medium | 4.0-6.9 | Exploitable with effort, moderate impact |
| High | 7.0-8.9 | Easily exploitable, significant impact |
| Critical | 9.0-10.0 | Wormable, remote code execution, auth bypass |

## Finding Severity Triaging

| Priority | Action | SLA |
|----------|--------|-----|
| P0-Critical | Block release, fix immediately | < 24h |
| P1-High | Fix in current sprint | < 1 week |
| P2-Medium | Schedule in next sprint | < 1 month |
| P3-Low | Backlog, address when in area | < 1 quarter |

## Common Vulnerability Classes

| CWE Category | What to Look For |
|--------------|-----------------|
| CWE-20 (Input Validation) | Injection, path traversal, type confusion |
| CWE-79 (XSS) | Unsanitized output, reflected/stored/DOM variants |
| CWE-89 (SQL Injection) | String concatenation in queries, no parameterization |
| CWE-200 (Info Leak) | Stack traces, debug endpoints, verbose errors |
| CWE-287 (Auth) | Weak password policies, missing MFA, session fixation |
| CWE-295 (TLS) | Certificate validation disabled, expired certs |
| CWE-863 (Authorization) | Missing access checks, IDOR, privilege escalation |
| CWE-918 (SSRF) | User-controlled URLs in server-side requests |