So wat I have now is a finding that input data is not properly validated, which might pose problems for applications that do not sanitize output well but not in the current application. What CVSS score would I put on that? I cannot well make it a high vulnerability because it is impossible to exploit now. But in the future it could pose problems and I do want it fixed in the context of "defense in depth"
Question: What would the CVSS score be for a non-exploitable input validation vulnerability?