Well, that's a pretty interesting question but, from a scoring perspective, what's the exact vulnerability being scored?

That's what this work is trying to evaluate.