---
title: Create an application vulnerability entry
description: Create an application vulnerability entry for the vulnerability specified for the penetration test finding. Application vulnerabilities are vulnerabilities on the custom software applications.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/pen-test-create-app-vul-entry-avm.html
release: australia
product: Application Vulnerability Response
classification: application-vulnerability-response
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 2
breadcrumb: [Penetration testing, Use, Application Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Create an application vulnerability entry

Create an application vulnerability entry for the vulnerability specified for the penetration test finding. Application vulnerabilities are vulnerabilities on the custom software applications.

## Before you begin

Role required: Ethical Hacker

## About this task

Application Vulnerability Response relates a vulnerability to an application to create the penetration test finding. These findings are manually-created application vulnerable items \(AVIs\). You can reuse an existing entry or create one manually for each vulnerability during penetration testing.

## Procedure

1.  Navigate to **All** > **Application Vulnerability Response** > **Libraries** > **Third-Party**.

2.  On the Application Vulnerability Entries page, select **New**.

3.  On the form, fill in the fields.

    |Field|Description|
    |-----|-----------|
    |ID|Identifier for this vulnerability entry.|
    |Severity|Normalized degree of severity of this vulnerability. Severity maps are provided for NVD and with ServiceNow third-party integrations. For more information on creating or adjusting severity maps, see [Map the severity of an application vulnerable item automatically](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-create-severity-map.md).|
    |Primary CVE|Reference to the Common Weakness Enumeration element that this vulnerability best fits into.|
    |Category name|Classification provided by the third-party integration. Aids in assignment.|
    |Vulnerability Details|
    |Attack vector|Most vulnerable attack vector for this vulnerability.|
    |Attack complexity|Metric that describes the conditions beyond the attacker's control that must exist to exploit the vulnerability.|
    |Scope|Metric to measure the ability of a software vulnerability to impact resources beyond its means.|
    |Integrity|Metric to measure the impact to the integrity of a successfully exploited vulnerability.|
    |CVSS Vector|Open framework to capture the characteristics and severity of software vulnerabilities.|
    |Privileges required|Level of privileges an attacker must possess before successfully exploiting the vulnerability.|
    |User interaction|Requirement for human interaction to successfully exploit a vulnerability.|
    |Confidentiality|Impact to the confidentiality of the information resources due to a successfully exploited vulnerability. These resources are managed by a software component.|
    |Availability|Impact to the availability of the impacted component resulting from a successfully exploited vulnerability.|
    |CVSS Base Score|Numeric \(0-10\) representation of the severity of an application vulnerability entry.|
    |Threat|Description of the threat from this vulnerability.|
    |Mitigation description|Description of the steps to mitigate the vulnerability.|

4.  To save the form, select **Submit**.

    **Note:** AVEs are created in the Application Vulnerability Entry \(sn\_vul\_app\_vul\_entry\) table. The Application Vulnerability Entry table is a child of the Vulnerability Entry \(**sn\_vul\_entry**\) table. Hence, the AVEs created are added to the Vulnerability Entry table as well.