The funny thing about infosec taxonomies is that actual attacks actively resist classifications like CVSS. CVSS is generally used on the sysadmin side to figur

The funny thing about infosec taxonomies is that actual attacks actively resist classifications like CVSS. CVSS is generally used on the sysadmin side to figure out what to patch first. Successful attackers generally go after shit that's unpatched. This often means that the most exploited bugs are the ones with the lowest CVSS scores, so new tools and techniques tend to grow around issues that sysadmins consider to not be a big deal. People eventually catch on that the "no big deal" bugs are getting exploited en-masse, and try to tweak the scoring process, which is why we're on CVSSv3 now with CVSSv4 in the works, and it's just as useless as it's always been.