Vulnerability Report Writer
A guided form that forces good structure — title, severity, steps to reproduce, impact, remediation — then exports clean Markdown or a printable PDF.
Finding a bug is the easy half. What gets it fixed — or paid — is a report that a stranger can reproduce without asking you a single question. This page gives you the structure that bug bounty triagers and internal security teams expect, and exports it as Markdown or PDF.
How to use it
- Fill in the title, severity, and affected component or URL.
- Write numbered steps to reproduce, then impact, then remediation.
- Download as Markdown or print to PDF.
What to take away
Steps to reproduce carry the whole report
Write them so someone with no context can follow along exactly. Include the account used, the exact request, and what you saw versus what you expected.
Impact means business consequence
"Reflected XSS" is a finding. "Any user who clicks a crafted link has their session token sent to an attacker-controlled server" is an impact. The second is what gets prioritised.
Suggest a fix, but stay in your lane
Naming the correct control — parameterised queries, output encoding, an authorisation check — is helpful. Prescribing their architecture is not.
Frequently asked questions
What should a vulnerability report contain?
A clear title, severity with a CVSS vector, the affected component, reproduction steps, demonstrated impact, and remediation guidance. Anything a triager has to ask you for is a delay.
How much detail is too much?
Screenshots and raw requests are welcome; speculation is not. Report what you observed and what it enables, not what you imagine might be possible elsewhere.
Do I need a CVSS score in the report?
Most programmes want one, and including the vector string rather than just the number lets the triager check your reasoning instead of arguing with your total.
Where this fits in the course
This security tool pairs with Path 09 — Bug Bounty — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- CVSS 4.0 + 3.1 Calculator — Build a CVSS vector and calculate Base, Threat, and Environmental severity locally.
- Risk Register Builder — Add risks with likelihood and impact, get an auto-scored severity, and export the register as Markdown.
- Incident Severity & SLA Calculator — Impact × urgency in, a priority tier and realistic remediation SLA out.
- STRIDE Threat-Model Worksheet — A guided Spoofing/Tampering/Repudiation/Info-Disclosure/DoS/Elevation worksheet, exportable as Markdown.