20. Vulnerability Scanning and Assessment

20.1 Vulnerability, CVE, CWE and CVSS

By Ravindra Bagale Last updated: 27 September 2026

In short: A vulnerability is a weakness in software, configuration or process that an attacker could use.

A vulnerability is a weakness in software, configuration or process that an attacker could use. A threat is someone or something that could use it, and risk is how likely and how harmful that would be. Thodkyaat: vulnerability = ughdi khidki, threat = chor, risk = chor aat yenyachi shakyata aani nuksan.

Term	Full form	What it is	Example
CVE	Common Vulnerabilities and Exposures	A unique ID for one publicly known vulnerability	`CVE-2011-2523` (the vsftpd 2.3.4 backdoor)
CWE	Common Weakness Enumeration	The type of mistake behind vulnerabilities	CWE-89 = SQL Injection
CVSS	Common Vulnerability Scoring System	A score from 0.0 to 10.0 for severity	9.8 = Critical
NVD	National Vulnerability Database	US government database with CVE details and scores	nvd.nist.gov
Exploit	–	Code or steps that actually use a vulnerability	A Metasploit module

CVSS severity bands (CVSS v3):

Score	Severity
0.0	None
0.1 – 3.9	Low
4.0 – 6.9	Medium
7.0 – 8.9	High
9.0 – 10.0	Critical

A CVSS score is built from things like: can it be attacked over the network? Does the attacker need a login? Does a user need to click something? What happens to confidentiality, integrity and availability (the CIA triad)?

Ravindra Bagale's Tip

Students confuse CVE and CWE. A simple rule: a CVE is one specific bug (one patient), a CWE is a type of bug (one disease). SQL Injection is a CWE; an SQL Injection bug in a particular piece of software is a CVE. This question almost always comes up in interviews.

Practice task

Open nvd.nist.gov and search CVE-2011-2523. Write down its description, CVSS score and severity, and the affected product. Then find which CWE it is mapped to.