Which of the following scoring systems could you use in the case that you as an ethical hacker are looking for a way to organize and prioritize vulnerabilities that were discovered in your work?