Example data. The target is an intentionally insecure app we built for testing, so it has far more issues than a real product should. The host name has been changed and request details and evidence values have been removed for publication.
Security assessment
demo.vulnerable-app.test
23 Sept 2026, 09:55 UTC · 21s · 1,741 requests · 56 checks · signed in as 3 test accounts
194findings
4 critical issues need attention first
- Critical
- 4
- High
- 8
- Medium
- 77
- Low
- 55
- Info
- 50
Executive summary
demo.vulnerable-app.test has 7 issues to fix immediately (4 critical, 1 exploited in the wild, 2 with exploitation predicted), and 9 of the findings connect into attack paths worth treating together.
Act now
Critical findings, and known vulnerabilities that are exploited or predicted to be. Fix these first.
- VULN-001 Environment file exposed
Fix: Remove the file from the web root immediately and rotate every credential in it. Treat them as compromised — you cannot know who has already read this.
- VULN-002 Command injection: shell echo output visible from 'host'
Fix: Do not pass user input to a shell. Use argv-style subprocess invocation and reject metacharacters at input validation.
- VULN-003 SQL injection (error-based) in 'q' parameter
Fix: Use parameterised queries or prepared statements. Never concatenate input into SQL.
- VULN-004 Server-Side Template Injection in 'name' (Jinja2/Twig)
Fix: Never pass user input directly into template rendering. Use sandboxed template engines.
- VULN-012 [Act now] CVE-2019-11358: jQuery prototype pollution via jQuery.extend
Fix: Upgrade jquery to 3.4.0 or later.
- VULN-013 [Act now] CVE-2020-11022: jQuery cross-site scripting via untrusted HTML passed to DOM manipulation
Fix: Upgrade jquery to 3.5.0 or later.
- VULN-014 [Act now] CVE-2020-11023: jQuery XSS through <option> elements in DOM manipulation
Fix: Upgrade jquery to 3.5.0 or later. CISA's required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Findings · 41 groups
VULN-001Environment file exposedact nowCVSS 9.8Critical
What it means
A .env file is served directly. These hold database credentials, API keys and application signing secrets.
Why it matters
Whatever is in this file is now public. In most applications that is the database password and the session signing key, which together are full compromise rather than information disclosure.
How to fix it
Remove the file from the web root immediately and rotate every credential in it. Treat them as compromised — you cannot know who has already read this.
Affected
- /.env
- confidence: confirmed
- fix: Act now
- CWE-538
- A05:2021 Security Misconfiguration
- CVSS 9.8
- ATT&CK T1552.001
VULN-002Command injection: shell echo output visible from 'host'act nowCVSS 9.8Critical
What it means
Appending `; echo bugsnaps` to 'host' put the string 'bugsnaps' in the response. That is the output of a shell command we injected — command execution is confirmed.
Why it matters
Arbitrary command execution on the server, with the privileges of the web process.
How to fix it
Do not pass user input to a shell. Use argv-style subprocess invocation and reject metacharacters at input validation.
Affected
- /tools/ping
- confidence: confirmed
- fix: Act now
- CWE-78
- A03:2021 Injection
- CVSS 9.8
- ATT&CK T1190
VULN-003SQL injection (error-based) in 'q' parameteract nowCVSS 9.8Critical
What it means
A single quote appended to 'q' produced a database error that neither the original value nor a benign control produced. The error reproduced on a repeat request.
Why it matters
An attacker may be able to read, modify, or delete database contents.
How to fix it
Use parameterised queries or prepared statements. Never concatenate input into SQL.
Affected
- /search
- confidence: confirmed
- fix: Act now
- CWE-89
- A03:2021 Injection
- CVSS 9.8
- ATT&CK T1190
VULN-004Server-Side Template Injection in 'name' (Jinja2/Twig)act nowCVSS 9.8Critical
What it means
Template expression `{{7*7}}` was evaluated to `49` by the server.
Why it matters
Full server-side code execution via template injection.
How to fix it
Never pass user input directly into template rendering. Use sandboxed template engines.
Affected
- /greet
- confidence: confirmed
- fix: Act now
- CWE-1336
- A03:2021 Injection
- CVSS 9.8
- ATT&CK T1190
VULN-005Login form submits over plain HTTP2×CVSS 7.5High
What it means
A form on this page submits to /session over plain HTTP. Everything typed into it crosses the network in clear text, no matter how the page itself was served. This form contains a password field.
Why it matters
Anyone on the network path reads the submitted data. For a login form that is the username and password.
How to fix it
Point the form action at an HTTPS URL.
Affected (2)
- /login
- /session
- confidence: confirmed
- fix: Within 30 days
- CWE-319
- A02:2021 Cryptographic Failures
- CVSS 7.5
- ATT&CK T1557
VULN-006End-of-life nginx 1.18.0 no longer receives security fixesCVSS 8.1High
What it means
nginx 1.18.0 is on the 1.18 release line, whose support ended on 2021-04-20. No security fixes are published for it upstream, so any vulnerability found in it from now on stays open.
Why it matters
Every vulnerability disclosed in this release line from here on stays unpatched, so the server is one advisory away from an exploitable, unfixable hole.
How to fix it
Upgrade nginx to a release line that still receives security fixes (supported lines: 1.31, 1.30), and test the application against it.
Affected
- /
- confidence: confirmed
- fix: Within 30 days
- CWE-1104
- A06:2021 Vulnerable and Outdated Components
- CVSS 8.1
- ATT&CK T1190
VULN-007End-of-life PHP 7.4.3 no longer receives security fixesCVSS 8.1High
What it means
PHP 7.4.3 is on the 7.4 release line, whose support ended on 2022-11-28. No security fixes are published for it upstream, so any vulnerability found in it from now on stays open.
Why it matters
Every vulnerability disclosed in this release line from here on stays unpatched, so the server is one advisory away from an exploitable, unfixable hole.
How to fix it
Upgrade PHP to a release line that still receives security fixes (supported lines: 8.5, 8.4, 8.3, 8.2), and test the application against it.
Affected
- /
- confidence: confirmed
- fix: Within 30 days
- CWE-1104
- A06:2021 Vulnerable and Outdated Components
- CVSS 8.1
- ATT&CK T1190
VULN-008Spring Boot actuator /env is publicCVSS 7.5High
What it means
Spring Boot's /actuator/env endpoint answers without authentication. It lists every property source: environment variables, system properties and application configuration.
Why it matters
Configuration and environment are disclosed. Keys Spring recognises as secrets are masked, but connection strings, internal hostnames and custom-named credentials frequently are not.
How to fix it
Expose only `health` over HTTP (`management.endpoints.web.exposure.include=health`), put the rest behind authentication, or move management to an internal port.
Affected
- /actuator/env
- confidence: confirmed
- fix: Within 30 days
- CWE-215
- A05:2021 Security Misconfiguration
- CVSS 7.5
- ATT&CK T1552.001
VULN-009Git repository exposedCVSS 7.5High
What it means
The .git directory is served by the web server. The full commit history can be downloaded and reconstructed with standard tooling.
Why it matters
An attacker gets your complete source code and, far more damaging, every version of it. Credentials that were committed once and removed in a later commit are still in the history and are recovered by this.
How to fix it
Stop the web server from serving dotfiles. Deploy build output rather than a working tree, and rotate every secret that has ever been committed — removing a file in a later commit does not remove it from history.
Affected
- /.git/HEAD
- confidence: confirmed
- fix: Within 30 days
- CWE-527
- A05:2021 Security Misconfiguration
- CVSS 7.5
- ATT&CK T1552.001
VULN-010Git configuration exposedCVSS 7.5High
What it means
The repository's .git/config is readable. It names the remote, which sometimes carries credentials in the URL.
Why it matters
Confirms the repository is exposed, and can leak the remote URL along with any embedded access token.
How to fix it
Block access to .git and redeploy from build output.
Affected
- /.git/config
- confidence: confirmed
- fix: Within 30 days
- CWE-527
- A05:2021 Security Misconfiguration
- CVSS 7.5
- ATT&CK T1552.001
VULN-011Google API key exposed in a public responseCVSS 7.5High
What it means
A Google API key, identifiable by its AIza prefix and length. It was found in a response served to anyone who requests this URL, at line 1.
Why it matters
Usable against whichever Google APIs the key is enabled for, billed to your project. Unrestricted keys are the common case.
How to fix it
Restrict the key by HTTP referrer and by API in the Cloud console, or regenerate it. A key in front-end code must always be restricted.
Affected
- /static/app.js
- confidence: confirmed
- fix: Within 30 days
- CWE-798
- A07:2021 Identification and Authentication Failures
- CVSS 7.5
- ATT&CK T1552
VULN-012[Act now] CVE-2019-11358: jQuery prototype pollution via jQuery.extendact nowCVSS 6.1Medium
What it means
jquery 1.12.4 is running on this host. jQuery.extend(true, {}, ...) with an attacker-controlled source object could pollute Object.prototype, altering application behaviour and enabling further attacks. It is exploitable only when the application deep-merges untrusted objects with jQuery.extend(true, ...), which cannot be confirmed from outside.
Why it matters
EPSS puts the probability of exploitation in the next 30 days at 87% — the 99.7% percentile of all published vulnerabilities.
How to fix it
Upgrade jquery to 3.4.0 or later.
Affected
- /static/js/vendor.js
- confidence: likely
- fix: Act now
- CWE-1321
- A06:2021 Vulnerable and Outdated Components
- CVSS 6.1
- ATT&CK T1190
VULN-013[Act now] CVE-2020-11022: jQuery cross-site scripting via untrusted HTML passed to DOM manipulationact nowCVSS 6.1Medium
What it means
jquery 1.12.4 is running on this host. Passing HTML from untrusted sources to jQuery DOM manipulation methods (such as .html()) could execute untrusted code because the content was not always sanitised. It is exploitable only when the application passes HTML that an attacker can influence to jQuery's DOM manipulation methods, which cannot be confirmed from outside.
Why it matters
EPSS puts the probability of exploitation in the next 30 days at 99% — the 99.9% percentile of all published vulnerabilities.
How to fix it
Upgrade jquery to 3.5.0 or later.
Affected
- /static/js/vendor.js
- confidence: likely
- fix: Act now
- CWE-79
- A06:2021 Vulnerable and Outdated Components
- CVSS 6.1
- ATT&CK T1190
VULN-014[Act now] CVE-2020-11023: jQuery XSS through <option> elements in DOM manipulationact nowCVSS 6.1Medium
What it means
jquery 1.12.4 is running on this host. jQuery before 3.5.0 can execute script contained in HTML passed to its DOM manipulation methods (.html(), .append() and others) when that HTML holds <option> elements — even HTML that was sanitised first. It is exploitable only when the application passes HTML that an attacker can influence to jQuery's DOM manipulation methods, which cannot be confirmed from outside.
Why it matters
CVE-2020-11023 is in CISA's Known Exploited Vulnerabilities catalogue: exploitation has been observed in the wild. CISA's remediation deadline for federal agencies is 2025-02-13.
How to fix it
Upgrade jquery to 3.5.0 or later. CISA's required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected
- /static/js/vendor.js
- confidence: likely
- fix: Act now
- CWE-79
- A06:2021 Vulnerable and Outdated Components
- CVSS 6.1
- ATT&CK T1190
VULN-015Page can be framed by any site25×CVSS 4.7Medium
What it means
Neither CSP frame-ancestors nor X-Frame-Options is set, so any site can load this page in an iframe.
Why it matters
An attacker can overlay their own interface on top of this page and trick a logged-in user into clicking controls they cannot see.
How to fix it
Add frame-ancestors 'none' to the CSP, or 'self' if the page is framed by your own application.
Affected (25)
- /
- /.well-known/openapi.json
- /about
- /account
- /api-docs
- confidence: confirmed
- fix: Within 90 days
- CWE-1021
- A05:2021 Security Misconfiguration
- CVSS 4.7
- ATT&CK T1189
VULN-016No Content-Security-Policy25×CVSS 4.7Medium
What it means
No CSP is set, so the browser will execute script from anywhere the page tells it to.
Why it matters
CSP is the control that limits the damage of a cross-site scripting bug. Without it, any injection that does land runs with the full privileges of the page.
How to fix it
Start with default-src 'self' in report-only mode, work through the violations, then enforce. Avoid 'unsafe-inline' in script-src; use a nonce or a hash.
Affected (25)
- /
- /.well-known/openapi.json
- /about
- /account
- /api-docs
- confidence: confirmed
- fix: Within 90 days
- CWE-1021
- A05:2021 Security Misconfiguration
- CVSS 4.7
- ATT&CK T1189
VULN-017Cookie 'session' is readable by JavaScript3×CVSS 4.3Medium
What it means
'session' has no HttpOnly attribute, so any script running on the page can read it.
Why it matters
Turns a cross-site scripting bug into session theft. With HttpOnly, the same bug cannot reach the cookie.
How to fix it
Add HttpOnly to 'session' unless client-side JavaScript genuinely needs to read it.
Affected (3)
- /
- /login
- /session
- confidence: confirmed
- fix: Within 90 days
- CWE-1004
- A05:2021 Security Misconfiguration
- CVSS 4.3
- ATT&CK T1539
VULN-018One user can read another user's record (IDOR)2×CVSS 6.5Medium
What it means
The resource at /api/orders/1 belongs to the test account 'alice'. 'bob' requested the same URL and received the same content. 'bob' received a 200 whose content matches what the owner 'alice' receives (100% identical after masking volatile values). The same values for address, email, full_name appear in both responses. The result reproduced on a second request.
Why it matters
Anyone who can guess or enumerate an identifier can read records belonging to other people. Identifiers of this kind are routinely sequential or visible in a URL, so this is not a theoretical exposure — it is usually the whole dataset, one record at a time.
How to fix it
Enforce the ownership check server-side on every request, not in the UI and not by hiding the identifier. The handler should confirm that the authenticated principal is entitled to this specific object before returning it, and answer 404 or 403 when they are not. Applying the check in one place — a policy layer or query scoping — is what stops the next endpoint from reintroducing it.
Affected (2)
- /api/orders/1
- /api/orders/2
- confidence: confirmed
- fix: Within 90 days
- CWE-639
- A01:2021 Broken Access Control
- CVSS 6.5
VULN-019Password field on a page served over plain HTTP2×CVSS 5.3Medium
What it means
This page is served over plain HTTP and asks for a password. The page and everything submitted from it travel unencrypted.
Why it matters
Credentials are exposed both in transit and to an attacker who can modify the page to change where the form submits.
How to fix it
Serve the entire page over HTTPS and redirect HTTP to HTTPS.
Affected (2)
- /login
- /session
- confidence: confirmed
- fix: Within 90 days
- CWE-319
- A02:2021 Cryptographic Failures
- CVSS 5.3
- ATT&CK T1557
VULN-020Session identifier carried in a URL2×CVSS 6.8Medium
What it means
1 URL(s) on this page carry sessionid with a secret-looking value, for example on /account.
Why it matters
Anyone who sees the URL — in a log, in history, in a Referer sent to another site, or in a link a user shares — can take over the session.
How to fix it
Keep session identifiers in cookies only (disable URL rewriting, e.g. `<tracking-mode>COOKIE</tracking-mode>` for servlet containers).
Affected (2)
- /about
- /account
- confidence: confirmed
- fix: Within 90 days
- CWE-598
- A04:2021 Insecure Design
- CVSS 6.8
- ATT&CK T1539
VULN-021End-of-life Bootstrap 3.3.7 no longer receives security fixesCVSS 4.7Medium
What it means
Bootstrap 3.3.7 is on the 3 release line, whose support ended on 2019-07-24. No security fixes are published for it upstream, so any vulnerability found in it from now on stays open.
Why it matters
Browser-side flaws found in this library from here on stay unpatched, exposing visitors to cross-site scripting through it.
How to fix it
Upgrade Bootstrap to a release line that still receives security fixes (supported lines: 5), and test the application against it.
Affected
- /ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css
- confidence: confirmed
- fix: Within 90 days
- CWE-1104
- A06:2021 Vulnerable and Outdated Components
- CVSS 4.7
- ATT&CK T1190
VULN-022End-of-life jQuery 1.12.4 no longer receives security fixesCVSS 4.7Medium
What it means
jQuery 1.12.4 is on the 1 release line, whose support ended. No security fixes are published for it upstream, so any vulnerability found in it from now on stays open.
Why it matters
Browser-side flaws found in this library from here on stay unpatched, exposing visitors to cross-site scripting through it.
How to fix it
Upgrade jQuery to a release line that still receives security fixes (supported lines: 4, 3), and test the application against it.
Affected
- /static/js/vendor.js
- confidence: confirmed
- fix: Within 90 days
- CWE-1104
- A06:2021 Vulnerable and Outdated Components
- CVSS 4.7
- ATT&CK T1190
VULN-023PHP detectedCVSS 5.3Medium
What it means
The application uses PHP. Detection: X-Powered-By: PHP/7.4.3.
Why it matters
Technology fingerprinting helps attackers choose targeted exploits.
How to fix it
Remove version banners and technology-revealing headers for PHP.
Affected
- /
- confidence: confirmed
- fix: Within 90 days
- CWE-200
- A05:2021 Security Misconfiguration
- CVSS 5.3
- ATT&CK T1592.002
VULN-024Signing out does not invalidate the sessionCVSS 6.8Medium
What it means
After calling the logout endpoint, the same session token still returned the protected resource with the same content (100% identical). The logout clears the cookie in the browser and leaves the session valid on the server.
Why it matters
Signing out does not actually end the session, so a user on a shared or public machine remains logged in from the server's point of view. Any copy of the token — from browser history, a proxy log, a backup, or a machine the user walked away from — continues to work.
How to fix it
Delete or revoke the session server-side when logout is called, and treat the cleared cookie as a courtesy rather than the mechanism. Where sessions are stateless tokens, keep a revocation list that is consulted on every request.
Affected
- /logout
- confidence: confirmed
- fix: Within 90 days
- CWE-613
- A07:2021 Identification and Authentication Failures
- CVSS 6.8
VULN-025Sensitive response may be cached (missing no-store)3×CVSS 4Medium
What it means
The response is authenticated or contains sensitive session data, but lacks a `Cache-Control: no-store` header. Without this header, browsers or intermediary proxies might cache the sensitive response, exposing it to subsequent users.
Why it matters
Another user on the same machine, or an attacker with access to an intermediary cache, can view the sensitive content.
How to fix it
Add `Cache-Control: no-store` to all authenticated or sensitive responses.
Affected (3)
- /
- /login
- /session
- confidence: likely
- fix: Within 90 days
- CWE-524
- A04:2021 Insecure Design
- CVSS 4
VULN-026No rate limiting on an authentication endpoint2×CVSS 5.3Medium
What it means
5 rapid requests to this authentication endpoint were all processed with no 429 response and no RateLimit/Retry-After header. That is the signature of an endpoint with no throttling, which lets an attacker brute-force credentials or one-time codes at speed. (5 probe(s); statuses [200, 200, 200, 200, 200].) The sample is deliberately small, so this is a strong indication rather than proof the threshold is not higher.
Why it matters
Without a limit, an attacker can try passwords, one-time codes or reset tokens as fast as the server answers — credential stuffing and OTP/reset brute-force become practical.
How to fix it
Rate-limit authentication endpoints per account and per source (e.g. token bucket with a low ceiling), add exponential backoff and temporary lockout after repeated failures, and return 429 with Retry-After. For OTP, also cap attempts per code and expire codes quickly.
Affected (2)
- /login
- /session
- confidence: likely
- fix: Within 90 days
- CWE-307
- A07:2021 Identification and Authentication Failures
- CVSS 5.3
VULN-027POST form lacks CSRF protection2×CVSS 6.5Medium
What it means
A POST form (action: /session) has no anti-CSRF token and no SameSite cookie protection.
Why it matters
An attacker can trick authenticated users into performing actions they didn't intend.
How to fix it
Add a CSRF token to every state-changing form. Set SameSite=Lax on session cookies.
Affected (2)
- /login
- /session
- confidence: likely
- fix: Within 90 days
- CWE-352
- A01:2021 Broken Access Control
- CVSS 6.5
- ATT&CK T1189
VULN-028Input reflection in 'q' parameter2×CVSS 6.1Medium
What it means
The endpoint reflects the 'q' parameter unescaped into the HTML response.
Why it matters
Cross-site scripting (XSS) if the reflection occurs in an executable context.
How to fix it
Contextually encode all user-supplied input before reflecting it in the response.
Affected (2)
- /greet
- /search
- confidence: likely
- fix: Within 90 days
- CWE-79
- A03:2021 Injection
- CVSS 6.1
- ATT&CK T1189
VULN-029[Urgent] CVE-2018-14042: Bootstrap XSS in the tooltip data-container propertyCVSS 6.1Medium
What it means
bootstrap 3.3.7 is running on this host. Bootstrap before 3.4.0, and 4.x before 4.1.2, does not sanitise the tooltip data-container property, so an attacker-controlled value executes script when the tooltip is shown. It is exploitable only when an attacker can influence a tooltip's data-container attribute, which cannot be confirmed from outside.
Why it matters
A public exploit exists for CVE-2018-14042, so the barrier to attempting it is low even though exploitation has not been observed in the wild.
How to fix it
Upgrade bootstrap to 3.4.0 or later.
Affected
- /ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css
- confidence: likely
- fix: Within 90 days
- CWE-79
- A06:2021 Vulnerable and Outdated Components
- CVSS 6.1
- ATT&CK T1190
VULN-030[Urgent] CVE-2019-8331: Bootstrap cross-site scripting in tooltip and popover data-templateCVSS 6.1Medium
What it means
bootstrap 3.3.7 is running on this host. XSS is possible in the tooltip or popover data-template attribute, allowing script execution when an attacker controls that attribute value. It is exploitable only when tooltip or popover data-template, data-content or data-title attributes are populated from untrusted input, which cannot be confirmed from outside.
Why it matters
EPSS puts exploitation probability at 16.4%, which is active rather than theoretical.
How to fix it
Upgrade bootstrap to 3.4.1 or later.
Affected
- /ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css
- confidence: likely
- fix: Within 90 days
- CWE-79
- A06:2021 Vulnerable and Outdated Components
- CVSS 6.1
- ATT&CK T1190
VULN-031No X-Content-Type-Options: nosniff25×CVSS 3.1Low
What it means
Without nosniff, a browser may ignore the declared Content-Type and guess from the bytes instead.
Why it matters
An uploaded file served as text can be re-interpreted as script, turning a file upload into stored cross-site scripting.
How to fix it
Send X-Content-Type-Options: nosniff on every response.
Affected (25)
- /
- /.well-known/openapi.json
- /about
- /account
- /api-docs
- confidence: confirmed
- fix: Next planned release
- CWE-430
- A05:2021 Security Misconfiguration
- CVSS 3.1
- ATT&CK T1189
VULN-032No Referrer-Policy25×CVSS 3.1Low
What it means
No Referrer-Policy is set, so the browser default governs what is sent to other sites in the Referer header.
Why it matters
Full URLs leak to third parties. Where a URL carries a reset token, an invitation code or an internal identifier, that is the secret leaving with it.
How to fix it
Send Referrer-Policy: strict-origin-when-cross-origin.
Affected (25)
- /
- /.well-known/openapi.json
- /about
- /account
- /api-docs
- confidence: confirmed
- fix: Next planned release
- CWE-200
- A01:2021 Broken Access Control
- CVSS 3.1
- ATT&CK T1592.002
VULN-033CORS allows any originCVSS 3.1Low
What it means
Access-Control-Allow-Origin is *, so any website can read this endpoint's responses from a visitor's browser.
Why it matters
If this endpoint ever returns data tied to the visitor, any site they visit can read it. Safe only for genuinely public data.
How to fix it
Return a specific allowed origin from an allowlist rather than a wildcard, and only when the endpoint's data is meant to be shared.
Affected
- /api/products
- confidence: confirmed
- fix: Next planned release
- CWE-942
- A05:2021 Security Misconfiguration
- CVSS 3.1
- ATT&CK T1539
VULN-034Session cookie is valid for far longer than a sessionCVSS 3.1Low
What it means
The session cookie issued at sign-in persists for 365 day(s). A session cookie should last for the browser session, or for a bounded idle period — not for months.
Why it matters
Every hour of that lifetime is an hour in which a copy of the cookie — from a shared machine, a backup, a proxy log — still signs the attacker in.
How to fix it
Drop Max-Age/Expires so the cookie lasts the browser session, and enforce an absolute and idle timeout server-side. The server's view of expiry is the one that matters; the cookie attribute is only a hint to the browser.
Affected
- /session
- confidence: confirmed
- fix: Next planned release
- CWE-613
- A07:2021 Identification and Authentication Failures
- CVSS 3.1
VULN-035Cookie 'session' has no SameSite attribute3×CVSS 3.1Low
What it means
'session' does not state a SameSite policy. Modern browsers default to Lax, which covers the common case, but the default is not guaranteed and older clients send the cookie on any cross-site request.
Why it matters
Cross-site request forgery against state-changing endpoints.
How to fix it
Set SameSite=Lax on 'session', or Strict if nothing needs cross-site use.
Affected (3)
- /
- /login
- /session
- confidence: likely
- fix: Next planned release
- CWE-1275
- A01:2021 Broken Access Control
- CVSS 3.1
- ATT&CK T1539
VULN-036No Cross-Origin-Embedder-Policy header12×CVSS 0Info
What it means
The response lacks a Cross-Origin-Embedder-Policy header. COEP prevents a document from loading any cross-origin resources that don't explicitly grant the document permission (via CORP or CORS).
Why it matters
Misses defense-in-depth against cross-origin attacks like Spectre or XS-Leaks.
How to fix it
Add Cross-Origin-Embedder-Policy to restrict cross-origin interactions where applicable.
Affected (12)
- /
- /about
- /greet
- /login
- /products
- confidence: informational
- fix: No deadline
- CWE-693
- A05:2021 Security Misconfiguration
- CVSS 0
VULN-037No Cross-Origin-Opener-Policy header12×CVSS 0Info
What it means
The response lacks a Cross-Origin-Opener-Policy header. COOP isolates the browsing context, preventing cross-origin documents from opening it and accessing its window object.
Why it matters
Misses defense-in-depth against cross-origin attacks like Spectre or XS-Leaks.
How to fix it
Add Cross-Origin-Opener-Policy to restrict cross-origin interactions where applicable.
Affected (12)
- /
- /about
- /greet
- /login
- /products
- confidence: informational
- fix: No deadline
- CWE-693
- A05:2021 Security Misconfiguration
- CVSS 0
VULN-038No Cross-Origin-Resource-Policy header12×CVSS 0Info
What it means
The response lacks a Cross-Origin-Resource-Policy header. CORP allows a resource to explicitly state which origins can read it, protecting against cross-origin read blocking bypasses.
Why it matters
Misses defense-in-depth against cross-origin attacks like Spectre or XS-Leaks.
How to fix it
Add Cross-Origin-Resource-Policy to restrict cross-origin interactions where applicable.
Affected (12)
- /
- /about
- /greet
- /login
- /products
- confidence: informational
- fix: No deadline
- CWE-693
- A05:2021 Security Misconfiguration
- CVSS 0
VULN-039No Permissions-Policy header12×CVSS 0Info
What it means
The response lacks a Permissions-Policy header. This header allows a site to control which browser features and APIs can be used in the document or in embedded frames.
Why it matters
Misses an opportunity to restrict access to powerful browser features (geolocation, camera, microphone, etc.).
How to fix it
Add a Permissions-Policy header to restrict unused browser features.
Affected (12)
- /
- /about
- /greet
- /login
- /products
- confidence: informational
- fix: No deadline
- CWE-693
- A05:2021 Security Misconfiguration
- CVSS 0
VULN-040No security.txt: no published way to report a vulnerabilityCVSS 0Info
What it means
No security.txt file was found at /.well-known/security.txt. This is not a vulnerability; it means a researcher who finds one has no published, authorised channel to report it, which tends to mean reports arrive late or not at all.
Why it matters
Slower, less reliable vulnerability reports. No direct exploitation path.
How to fix it
Publish /.well-known/security.txt with a Contact line and an Expires date (see RFC 9116). A single mailto: contact is enough to start.
Affected
- /
- confidence: informational
- fix: No deadline
- CWE-200
- A05:2021 Security Misconfiguration
- CVSS 0
VULN-041Server header discloses a software versionCVSS 0Info
What it means
The Server header names a product and version. This is not a vulnerability on its own — it tells an attacker which published vulnerabilities are worth trying first.
Why it matters
Shortens reconnaissance. No direct exploitation path.
How to fix it
Suppress or generalise the Server header at the web server or reverse proxy.
Affected
- /
- confidence: informational
- fix: No deadline
- CWE-200
- A05:2021 Security Misconfiguration
- CVSS 0
- ATT&CK T1592.002
Remediation plan
- Act nowRemove the file from the web root now, rotate every credential and signing key in it, and invalidate existing sessions. — Exposed environment file → direct account or database takeover
- Act nowUse parameterised queries or prepared statements. Never concatenate input into SQL. — SQL injection (error-based) in 'q' parameter
- Act nowDo not pass user input to a shell. Use argv-style subprocess invocation and reject metacharacters at input validation. — Command injection: shell echo output visible from 'host'
- Act nowNever pass user input directly into template rendering. Use sandboxed template engines. — Server-Side Template Injection in 'name' (Jinja2/Twig)
- Act nowBlock .git at the web server now, then scan the full history for committed secrets and rotate every one found. — Exposed source history → credential recovery → deeper access
- Act nowPrioritise the KEV-listed CVE above all other findings and patch to the fixed version. — Outdated component with a vulnerability under active exploitation
- Within 30 daysTurn off debug mode and the interface in production, then invalidate all active sessions. — Debug interface in production → other users' sessions and the app's secrets
- Within 30 daysRevoke or restrict the key at the provider now, then move the call that needs it server-side. — Credential shipped to the browser → third-party account abuse
- Within 30 daysSchedule the upgrade to a supported release line now; treat it as a project, not a patch. — End-of-life platform with known vulnerabilities → no patch path
- Within 30 daysPoint the form action at an HTTPS URL. — Login form submits over plain HTTP
- Within 90 daysAdd a server-side ownership check to the affected handler, then audit every sibling endpoint that takes the same identifier. — Missing ownership check → enumerate every record
- Within 90 daysMove the secret out of the URL; meanwhile set Referrer-Policy: strict-origin-when-cross-origin. — Secret in a URL + permissive Referrer-Policy → secret sent to third parties
Critical and known-exploited issues are marked for immediate action; high follows CISA BOD 19-02's 30 days; medium (90 days) and low (next release) are suggested defaults.
Attack paths
Findings worth treating together, because one makes the next easier.
Exposed environment file → direct account or database takeover
The .env file is served directly. These hold the database password, third-party API keys and the application's own signing secret. No chaining is even required — the credentials are simply readable, and the signing secret alone often lets an attacker forge valid sessions for any user.
First step · Remove the file from the web root now, rotate every credential and signing key in it, and invalidate existing sessions.
Exposed source history → credential recovery → deeper access
The .git directory is downloadable, so an attacker reconstructs the full commit history offline. Credentials are committed and later removed far more often than teams expect, and every one of those still sits in the history. From a recovered database password or API key the attacker moves from reading the site to acting as it.
First step · Block .git at the web server now, then scan the full history for committed secrets and rotate every one found.
Debug interface in production → other users' sessions and the app's secrets
A development interface is answering in production. These record requests as they happen — cookies, headers, form bodies — or print the environment the application runs with. An attacker reads another user's session cookie out of the log and replays it, or lifts a database password from the environment, without breaking anything.
First step · Turn off debug mode and the interface in production, then invalidate all active sessions.
Credential shipped to the browser → third-party account abuse
A provider credential is inlined into a response served to every visitor. If it is live and unrestricted — the common case for keys that were meant to stay server-side — anyone who views source can use it directly against that provider, billed to this account.
First step · Revoke or restrict the key at the provider now, then move the call that needs it server-side.
End-of-life platform with known vulnerabilities → no patch path
Part of the server stack is on a release line its maintainers no longer fix. Published vulnerabilities already match it, and patching is not an option — the only remedy is a version upgrade, which takes planning.
First step · Schedule the upgrade to a supported release line now; treat it as a project, not a patch.
Missing ownership check → enumerate every record
A record belonging to one test account was returned to another. The check that should compare the requesting user against the object's owner is absent rather than weak, so the same is almost certainly true of neighbouring endpoints. Identifiers in this position are usually sequential, which turns a single unauthorised read into a script that walks the whole table.
First step · Add a server-side ownership check to the affected handler, then audit every sibling endpoint that takes the same identifier.
Outdated component with a vulnerability under active exploitation
A component here matches a vulnerability in CISA's Known Exploited Vulnerabilities catalogue — meaning it is not a theoretical risk but one being used against organisations now. Public tooling for it already exists, so the barrier to an attempt is low.
First step · Prioritise the KEV-listed CVE above all other findings and patch to the fixed version.
Secret in a URL + permissive Referrer-Policy → secret sent to third parties
A session identifier or token rides in the URL, and the Referrer-Policy lets the full URL go out with requests to other sites. Every analytics script, embedded image or outbound link on the page receives the secret in its Referer header and logs it.
First step · Move the secret out of the URL; meanwhile set Referrer-Policy: strict-origin-when-cross-origin.
Weak CSP + JavaScript-readable session cookie → session theft from any injection
The Content-Security-Policy does not constrain script, and the session cookie has no HttpOnly flag. Individually these are medium findings. Together they mean that any cross-site scripting bug anywhere on the site — present or introduced later — escalates straight to reading the session cookie and impersonating the user, because nothing stops injected script from running and nothing hides the cookie from it.
First step · Set HttpOnly on the session cookie and enforce a script-src that excludes unsafe-inline.
Coverage
✓ 732 checks passed · 1 could not be checked.
These are not passes — we don't know whether they would have been fine.
- Verify: CVE-2023-44487 may apply to nginx 1.18.0 (HTTP/2 Rapid Reset: denial of service via stream cancellation)
nginx 1.18.0 is in the affected range, but the advisory applies only if the server has HTTP/2 enabled, which could not be observed from outside. It is in CISA's Known Exploited Vulnerabilities catalogue. Check this on the server. If it does, upgrade nginx to 1.25.3 or later.
- 1 check(s) could not complete. They are listed as unchecked rather than counted as passing.
- Checks were non-destructive. Input submitted: a sign-in for each operator-supplied test account, attempted once per account; and crafted but non-destructive values in query parameters and headers (quote characters, template expressions, canary strings, benign URLs) to observe how the application handles input. No record was created, modified or deleted, no destructive or timing-based payload was sent, and nothing was exploited beyond observing the response and demonstrating read access to a test account's own data.
Findings describe what the checks observed during the testing window above. An automated assessment does not replace a manual penetration test.