Vulnerability Assessment Report Template
What a client receives from a web application security assessment — two reports, each written for a different reader.
What You Receive: Two Reports
Every assessment delivers two separate reports, each written for a different audience.
| Report | Audience | Contents |
|---|---|---|
| 1. Executive Report | Owners and decision makers | A non-technical, plain-English summary: overall risk rating, key findings and what they mean for the business, prioritized recommendations, and the scope and testing window. No jargon and no code. |
| 2. Developer Report | Developers and technical staff | A technical report with severity ratings, steps to reproduce, and a proof of concept for every vulnerability found, plus fix guidance for each. Includes methodology, in-scope and out-of-scope items, and the severity rating scheme (CVSS 4.0). |
A retest of reported findings is included after fixes are deployed.
Sample Reports
The samples below show exactly what these reports look like when filled out. The target is fictional — "Northwind Bakery Supply Co." is an invented company, and every host uses reserved example domains. All requests, responses, and proofs of concept are illustrative only.
The samples show six findings at different severity levels, including one chained finding: an open redirect that allows a blind (out-of-band) cross-site scripting payload to reach an internal admin portal.
Executive Report →
Non-technical summary for the business owner — risk rating, plain-English findings, and prioritized action items.
Developer Report →
Full technical report with CVSS 4.0 scoring, steps to reproduce, proof-of-concept requests, and remediation guidance for each finding.
How Testing Is Done
- Manual testing, aligned to the OWASP Top 10
- Non-destructive: no denial-of-service testing and no actions intended to damage data or availability
- Scoped in writing before any testing begins
What Is Tested
- Authentication and sessions
- Access control (IDOR, privilege escalation)
- Injection (XSS, SQLi, SSRF)
- Business logic flaws
- API security
- Misconfigurations and exposed data
Severity Ratings
Findings in the developer report are rated with CVSS 4.0 (base score, CVSS-B), using the standard qualitative scale: Low, Medium, High, and Critical. Each finding lists its full CVSS vector so the score can be checked in the FIRST CVSS 4.0 calculator.
Where chaining, business context, or real-world exploitability makes the practical risk higher or lower than the CVSS-B rating, the finding also states an assessor priority and the reason. The CVSS-B score is always shown unchanged.
License
The report templates are released under the MIT License. You may reuse and adapt them.