| Access Control Vulnerability |
Access Control |
No |
No |
No |
No |
No |
| Apache Druid - Remote Code Execution (Apache Log4j) |
Access Control |
No |
No |
Yes |
Yes |
No |
| Apache Flink - Remote Code Execution |
Access Control |
No |
No |
Yes |
Yes |
No |
| Apache NiFi - Remote Code Execution |
Access Control |
No |
No |
Yes |
Yes |
No |
| Apache OFBiz - JNDI Remote Code Execution (Apache Log4j) |
Access Control |
No |
No |
Yes |
Yes |
No |
| Apache Solr 7+ - Remote Code Execution (Apache Log4j) |
Access Control |
No |
No |
Yes |
Yes |
No |
| Apache Solr 9.1 - Remote Code Execution |
Access Control |
No |
No |
Yes |
Yes |
No |
| Apache Solr <=8.8.1 - Local File Inclusion |
Access Control |
No |
No |
Yes |
Yes |
No |
| Authentication Bypass |
Access Control |
Yes |
Yes |
Yes |
No |
Yes |
| Broken Function Level Authorization |
Access Control |
No |
No |
No |
No |
Yes |
| Broken Object Level Authorization |
Access Control |
Yes |
Yes |
Yes |
Yes |
Yes |
| Broken Object Level Authorization |
Access Control |
No |
No |
No |
No |
Yes |
| Broken Object Level Authorization |
Access Control |
No |
No |
Yes |
Yes |
Yes |
| Cassandra AllowAllAuthenticator Enabled |
Access Control |
No |
No |
No |
No |
Yes |
| ClickHouse Authentication Disabled |
Access Control |
No |
No |
No |
No |
Yes |
| DbGate Web Client - Unauthenticated Remote Command Execution |
Access Control |
No |
No |
Yes |
Yes |
No |
| Default Credentials Used |
Access Control |
No |
No |
No |
Yes |
Yes |
| Default MSSQL Credentials |
Access Control |
No |
No |
No |
Yes |
Yes |
| Default MySQL Credentials |
Access Control |
No |
No |
No |
Yes |
Yes |
| Default PostgreSQL Credentials |
Access Control |
No |
No |
No |
Yes |
Yes |
| Default SNMP Read Community |
Access Control |
No |
No |
No |
No |
Yes |
| Default SNMP Write Community |
Access Control |
No |
No |
No |
No |
Yes |
| Default SSH Credentials |
Access Control |
No |
No |
No |
Yes |
Yes |
| Drupal 7 Elfinder - Remote Code Execution |
Access Control |
No |
No |
Yes |
Yes |
No |
| Drupal Avatar Uploader - Cross-Site Scripting |
Access Control |
No |
No |
Yes |
Yes |
No |
| Enabled SSH Password Authentication |
Access Control |
No |
No |
No |
Yes |
Yes |
| Enumeration of a parameter (API) |
Access Control |
Yes |
Yes |
Yes |
No |
Yes |
| Exposed JDWP Debug Port |
Access Control |
No |
No |
No |
No |
Yes |
| Exposed MSSQL Server |
Access Control |
No |
No |
No |
Yes |
Yes |
| Exposed MySQL Server |
Access Control |
No |
No |
No |
Yes |
Yes |
| Exposed Node.js Inspector |
Access Control |
No |
No |
No |
No |
Yes |
| Exposed PHP-FPM Port |
Access Control |
No |
No |
No |
No |
Yes |
| Exposed PostgreSQL Server |
Access Control |
No |
No |
No |
Yes |
Yes |
| GraphQL Authorization Bypass |
Access Control |
Yes |
No |
No |
Yes |
Yes |
| Improper Session Invalidation |
Access Control |
No |
No |
No |
No |
Yes |
| InfluxDB Authentication Disabled |
Access Control |
No |
No |
No |
No |
Yes |
| Infoblox NetMRI < 7.6.1 - Remote Code Execution via Hardcoded Ruby Cookie Secret Key |
Access Control |
No |
No |
Yes |
Yes |
No |
| IoTaWatt Configuration App Exposure |
Access Control |
No |
No |
Yes |
Yes |
No |
| Jolokia <= 1.7.1 Information Leakage |
Access Control |
No |
No |
Yes |
Yes |
No |
| Joomla JLex Review 6.0.1 - Cross-Site Scripting |
Access Control |
No |
No |
Yes |
Yes |
No |
| Joomla JVTwitter - Cross-Site Scripting |
Access Control |
No |
No |
Yes |
Yes |
No |
| Joomla JoomBri Careers 3.3.0 - Cross-Site Scripting |
Access Control |
No |
No |
Yes |
Yes |
No |
| Joomla MarvikShop ShoppingCart 3.4 - Cross-Site Scripting |
Access Control |
No |
No |
Yes |
Yes |
No |
| Joomla Solidres 2.13.3 - Cross-Site Scripting |
Access Control |
No |
No |
Yes |
Yes |
No |
| Joomla iProperty Real Estate 4.1.1 - Cross-Site Scripting |
Access Control |
No |
No |
Yes |
Yes |
No |
| Joomla jMarket 5.15 - Cross-Site Scripting |
Access Control |
No |
No |
Yes |
Yes |
No |
| Joomla! CMS <=3.4.6 - Remote Code Execution |
Access Control |
No |
No |
Yes |
Yes |
No |
| Jupyter Notebook - Remote Command Execution |
Access Control |
No |
No |
Yes |
Yes |
No |
| MCP Server Accessible Without Authentication |
Access Control |
No |
No |
No |
Yes |
Yes |
| MFA Bypass |
Access Control |
No |
No |
No |
No |
Yes |
| Malwared BYOB - Unauthenticated Remote Code Execution |
Access Control |
No |
No |
Yes |
Yes |
No |
| Memcached Authentication Disabled |
Access Control |
No |
No |
No |
No |
Yes |
| Missing Authentication |
Access Control |
No |
No |
No |
No |
Yes |
| MongoDB Authentication Disabled |
Access Control |
No |
No |
No |
No |
Yes |
| Multi User Access Control |
Access Control |
Yes |
Yes |
Yes |
No |
Yes |
| Neo4j Authentication Disabled |
Access Control |
No |
No |
No |
No |
Yes |
| Nginx Server - Local File Inclusion |
Access Control |
No |
No |
Yes |
Yes |
No |
| Nginx Virtual Host Traffic Status Module - Cross-Site Scripting |
Access Control |
No |
No |
Yes |
Yes |
No |
| Open SSH Server |
Access Control |
No |
No |
No |
Yes |
Yes |
| PHP 8.1.0-dev - Backdoor Remote Code Execution |
Access Control |
No |
No |
Yes |
Yes |
No |
| PHP LDAP Admin < 1.2.5 - Cross-Site Scripting |
Access Control |
No |
No |
Yes |
Yes |
No |
| PHP Timeclock <=1.04 - Cross-Site Scripting |
Access Control |
No |
No |
Yes |
Yes |
No |
| Path Traversal via File Upload |
Access Control |
No |
No |
Yes |
No |
Yes |
| Potentially Bruteforceable Login Form |
Access Control |
No |
No |
No |
Yes |
Yes |
| Private Data Exposure |
Access Control |
Yes |
Yes |
Yes |
Yes |
Yes |
| React2Shell CVE-2025-55182 - Javascript RCE |
Access Control |
No |
No |
Yes |
Yes |
No |
| React2Shell CVE-2025-55182 - Shell RCE |
Access Control |
No |
No |
Yes |
Yes |
No |
| Ruby on Rails - CRLF Injection and Cross-Site Scripting |
Access Control |
No |
No |
Yes |
Yes |
No |
| Sangfor Log Center - Remote Command Execution |
Access Control |
No |
No |
Yes |
Yes |
No |
| Session Fixation |
Access Control |
No |
No |
No |
No |
Yes |
| ThinkPHP 2/3 - Remote Code Execution |
Access Control |
No |
No |
Yes |
Yes |
No |
| ThinkPHP 5.0.1 - Remote Code Execution |
Access Control |
No |
No |
Yes |
Yes |
No |
| ThinkPHP 5.0.23 - Remote Code Execution |
Access Control |
No |
No |
Yes |
Yes |
No |
| ThinkPHP 6.0.0~6.0.1 - Arbitrary File Write |
Access Control |
No |
No |
Yes |
Yes |
No |
| Twig PHP <2.4.4 template engine - SSTI |
Access Control |
No |
No |
Yes |
Yes |
No |
| Unauthenticated DNS Dynamic Update |
Access Control |
No |
No |
No |
No |
Yes |
| Unauthenticated Modbus Write |
Access Control |
No |
No |
No |
No |
Yes |
| Unbound Session Token |
Access Control |
No |
No |
No |
No |
Yes |
| Veeam Backup & Replication - Unauthenticated |
Access Control |
Yes |
Yes |
No |
Yes |
No |
| WordPress Oembed Proxy - Server-Side Request Forgery |
Access Control |
No |
No |
Yes |
Yes |
No |
| WordPress PHPFreeChat 0.2.8 - Cross-Site Scripting |
Access Control |
No |
No |
Yes |
Yes |
No |
| WordPress Woody Code Snippets <2.4.6 - Cross-Site Scripting |
Access Control |
No |
No |
Yes |
Yes |
No |
| WordPress Wordfence - Cross-Site Scripting |
Access Control |
No |
No |
Yes |
Yes |
No |
| WordPress Wordfence 7.4.6 - Cross-Site Scripting |
Access Control |
No |
No |
Yes |
Yes |
No |
| Xdebug remote code execution via xdebug.remote_connect_back |
Access Control |
No |
No |
Yes |
Yes |
No |
| Zebra_Form PHP Library <= 2.9.8 - Cross-Site Scripting |
Access Control |
No |
No |
Yes |
Yes |
No |
| ZenML ZenML Server - Improper Authentication |
Access Control |
Yes |
Yes |
No |
Yes |
No |
| Zip Slip via File Upload |
Access Control |
No |
No |
Yes |
No |
Yes |
| nginxWebUI ≤ 3.5.0 - Remote Command Execution |
Access Control |
No |
No |
Yes |
Yes |
No |
| nginxWebUI ≤ 3.5.0 runCmd - Remote Command Execution |
Access Control |
No |
No |
Yes |
Yes |
No |
| ASP.NET ViewState Encryption |
Configuration |
No |
No |
Yes |
Yes |
Yes |
| ASP.NET ViewState MAC Validation Disabled |
Configuration |
No |
No |
Yes |
Yes |
Yes |
| Actuator Spring Boot Remote Restart |
Configuration |
Yes |
Yes |
Yes |
Yes |
No |
| Actuator Spring Boot Remote Shutdown |
Configuration |
Yes |
Yes |
Yes |
Yes |
No |
| Angular Development Build |
Configuration |
No |
No |
Yes |
Yes |
Yes |
| Business Logic |
Configuration |
No |
No |
No |
No |
Yes |
| Business Logic (Negative Value) |
Configuration |
Yes |
Yes |
Yes |
No |
Yes |
| Client-Side State Tampering |
Configuration |
No |
No |
No |
No |
Yes |
| CodiMD - File Upload |
Configuration |
No |
No |
Yes |
Yes |
No |
| Compromised Supply Chain |
Configuration |
No |
No |
Yes |
Yes |
Yes |
| DNS record TXT length |
Configuration |
No |
No |
No |
Yes |
Yes |
| DNS record loopback |
Configuration |
No |
No |
No |
Yes |
Yes |
| DNSSEC Not Enabled |
Configuration |
No |
No |
No |
Yes |
Yes |
| Dangling CNAME record |
Configuration |
No |
No |
No |
Yes |
Yes |
| Domain Takeover |
Configuration |
No |
No |
Yes |
Yes |
Yes |
| Domain Takeover |
Configuration |
No |
No |
No |
No |
No |
| Excessive Browser Permissions |
Configuration |
No |
No |
Yes |
Yes |
Yes |
| File Upload Endpoint Detected |
Configuration |
No |
No |
Yes |
No |
Yes |
| GraphQL IDE |
Configuration |
Yes |
No |
No |
Yes |
Yes |
| HTTP Method Override |
Configuration |
No |
No |
No |
No |
Yes |
| HTTP without HTTPS Redirect |
Configuration |
No |
No |
No |
Yes |
Yes |
| HTTP/2 Not Supported |
Configuration |
No |
No |
No |
Yes |
Yes |
| Misconfigured DKIM DNS Record |
Configuration |
No |
No |
No |
Yes |
Yes |
| Misconfigured DMARC DNS Record |
Configuration |
No |
No |
No |
Yes |
Yes |
| Missing PKCE |
Configuration |
No |
No |
No |
No |
Yes |
| Missing Subresource Integrity |
Configuration |
No |
No |
Yes |
Yes |
Yes |
| OAuth Grant Misconfiguration |
Configuration |
No |
No |
No |
No |
Yes |
| Open DNS Recursive Resolver |
Configuration |
No |
No |
No |
No |
Yes |
| Permissive SPF DNS Record |
Configuration |
No |
No |
No |
Yes |
Yes |
| PhpMyAdmin - Unauthenticated Access |
Configuration |
No |
No |
Yes |
Yes |
No |
| Private IP Disclosed in DNS Record |
Configuration |
No |
No |
No |
Yes |
Yes |
| React Development Build |
Configuration |
No |
No |
Yes |
Yes |
Yes |
| Request URL Override |
Configuration |
No |
No |
Yes |
Yes |
Yes |
| Self Signed SSL Certificate |
Configuration |
No |
No |
Yes |
Yes |
No |
| Sensitive Data in DNS TXT Record |
Configuration |
No |
No |
No |
Yes |
Yes |
| Svelte Development Build |
Configuration |
No |
No |
Yes |
Yes |
Yes |
| Unconfigured or Default Install |
Configuration |
No |
No |
No |
Yes |
Yes |
| Unrestricted File Upload |
Configuration |
No |
No |
Yes |
No |
Yes |
| Unsafe Function Use |
Configuration |
No |
No |
Yes |
Yes |
Yes |
| Unusually High Number of Open Ports |
Configuration |
No |
No |
No |
Yes |
Yes |
| Vue.js Development Build |
Configuration |
No |
No |
Yes |
Yes |
Yes |
| WAF Bypass |
Configuration |
No |
No |
No |
Yes |
Yes |
| Weak Flask Session Secret |
Configuration |
No |
No |
Yes |
Yes |
Yes |
| Wildcard Ports Detected |
Configuration |
No |
No |
No |
Yes |
Yes |
| WordPress wp-config Detection |
Configuration |
No |
No |
Yes |
Yes |
No |
| XSS via Domain Takeover |
Configuration |
No |
No |
No |
No |
No |
| Agentic Replay |
Custom |
No |
No |
No |
No |
Yes |
| API Endpoint Exposed in JavaScript Bundle |
Information Disclosure |
No |
No |
No |
No |
Yes |
| AWS Access Token |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
Yes |
| Application Information Disclosure |
Information Disclosure |
No |
No |
No |
No |
Yes |
| BSPHP - Information Disclosure |
Information Disclosure |
No |
No |
Yes |
Yes |
No |
| Console Error |
Information Disclosure |
No |
No |
Yes |
Yes |
Yes |
| Crashing Page |
Information Disclosure |
No |
No |
Yes |
Yes |
Yes |
| DNS Rebinding Attack |
Information Disclosure |
No |
No |
No |
Yes |
No |
| DNS Zone Transfer Allowed to Any Client |
Information Disclosure |
No |
No |
No |
No |
Yes |
| Debug Mode Enabled |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
Yes |
| Exploitable CVE |
Information Disclosure |
No |
No |
No |
No |
Yes |
| Exposed Config File |
Information Disclosure |
No |
No |
Yes |
Yes |
Yes |
| Exposed Source Map |
Information Disclosure |
No |
No |
Yes |
Yes |
Yes |
| File Disclosure |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
Yes |
| Git Metadata Directory Exposure |
Information Disclosure |
No |
No |
Yes |
Yes |
No |
| GraphQL Field Suggestion |
Information Disclosure |
Yes |
No |
No |
Yes |
Yes |
| Guessable Cookie Value |
Information Disclosure |
No |
No |
Yes |
Yes |
Yes |
| Header Leak |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
Yes |
| Internal Organization Page |
Information Disclosure |
No |
No |
No |
Yes |
Yes |
| Introspection enabled |
Information Disclosure |
Yes |
No |
No |
Yes |
Yes |
| JavaScript Library |
Information Disclosure |
No |
No |
Yes |
Yes |
Yes |
| LLM System Prompt Leakage |
Information Disclosure |
No |
No |
Yes |
No |
Yes |
| LLM Tool / Function-Calling Exposure |
Information Disclosure |
No |
No |
Yes |
No |
Yes |
| Leaked AWS Configuration |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Leaked AWStats Config |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Leaked AWStats Script Config |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Leaked Actuator Spring Boot Dump |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Leaked Actuator Spring Boot Heapdump |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Leaked Actuator Spring Boot Trace |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Leaked Alibaba Canal Config |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Leaked Ansible Configuration Page |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Leaked Apache Airflow Configuration Page |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Leaked AppVeyor Configuration Page |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Leaked Appspec YML/YAML |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Leaked Dockerrun AWS Configuration Page |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Leaked MySQL Dump Files |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Leaked Spring Boot Actuator Environment |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Leaked Spring Boot Actuator Logfile |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Leaked Spring Boot Actuator Mappings |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Leaked mysql.initial Config |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Leaked settings.php |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Node ecstatic Internal Path - Exposure |
Information Disclosure |
No |
No |
Yes |
Yes |
No |
| Password Field Autocompletion |
Information Disclosure |
No |
No |
Yes |
Yes |
Yes |
| Possible User Enumeration |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
Yes |
| Private IP Disclosure |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
Yes |
| Private Key Exposure |
Information Disclosure |
No |
No |
Yes |
Yes |
No |
| Selenium - Node Exposure |
Information Disclosure |
No |
No |
Yes |
Yes |
No |
| Sensitive Comments |
Information Disclosure |
No |
No |
Yes |
Yes |
Yes |
| Spoofable SPF Records with PTR Mechanism |
Information Disclosure |
No |
No |
No |
Yes |
No |
| Stack Trace Disclosure |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
Yes |
| ThinkPHP 5.0.9 - Information Disclosure |
Information Disclosure |
No |
No |
Yes |
Yes |
No |
| Vulnerable Dependency |
Information Disclosure |
No |
No |
No |
Yes |
Yes |
| Vulnerable JavaScript Library |
Information Disclosure |
No |
No |
Yes |
Yes |
Yes |
| WordPress DB Repair Exposed |
Information Disclosure |
No |
No |
Yes |
Yes |
No |
| WordPress RDF Feed Users |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| WordPress REST API Users |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| WordPress oEmbed Endpoint |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| WordPress wp-cron Exposed |
Information Disclosure |
Yes |
Yes |
Yes |
Yes |
No |
| Apache Log4j2 Remote Code Injection |
Injection |
No |
No |
Yes |
Yes |
No |
| Arcade.php - SQL Injection |
Injection |
No |
No |
Yes |
Yes |
No |
| Boolean-based Blind SQL Injection |
Injection |
Yes |
Yes |
Yes |
No |
Yes |
| CGI-bin Remote Code Execution |
Injection |
Yes |
Yes |
Yes |
No |
Yes |
| CRLF Injection |
Injection |
No |
No |
Yes |
Yes |
Yes |
| CSP Bypass via Input Injection |
Injection |
No |
No |
Yes |
Yes |
Yes |
| Change Detection - Server Side Template Injection |
Injection |
Yes |
Yes |
No |
Yes |
No |
| Client Side Prototype Pollution |
Injection |
No |
No |
Yes |
Yes |
Yes |
| Command Injection |
Injection |
No |
No |
No |
No |
No |
| Command Injection |
Injection |
Yes |
Yes |
Yes |
No |
Yes |
| Command Injection |
Injection |
No |
No |
Yes |
Yes |
Yes |
| Cross-Site Scripting (XSS) |
Injection |
No |
No |
No |
No |
No |
| Cross-Site Scripting (XSS) |
Injection |
No |
No |
Yes |
Yes |
Yes |
| Dangerous Dynamic Code Execution in JavaScript |
Injection |
No |
No |
No |
No |
Yes |
| Directory Traversal |
Injection |
Yes |
Yes |
Yes |
No |
Yes |
| Frontend HTTP Parameter Pollution |
Injection |
No |
No |
Yes |
Yes |
Yes |
| GeoVision Geowebserver <= 5.3.3 - Local File Inclusion / Cross-Site Scripting |
Injection |
No |
No |
Yes |
Yes |
No |
| HTML Injection |
Injection |
No |
No |
Yes |
Yes |
Yes |
| Host Header Injection (Redirect) |
Injection |
Yes |
Yes |
Yes |
No |
Yes |
| Host Header Injection (Reflected) |
Injection |
Yes |
Yes |
Yes |
No |
Yes |
| JWT Algorithm Confusion (RS256 to HS256) |
Injection |
Yes |
Yes |
Yes |
No |
Yes |
| JWT Signature Bypass (alg=none) |
Injection |
Yes |
Yes |
Yes |
No |
Yes |
| JWT Signature Not Verified |
Injection |
Yes |
Yes |
Yes |
No |
Yes |
| JWT Weak Secret Bruteforced |
Injection |
Yes |
Yes |
Yes |
No |
Yes |
| Joomla MarvikShop ShoppingCart 3.4 - Sql Injection |
Injection |
No |
No |
Yes |
Yes |
No |
| Joomla `departments` - SQL Injection |
Injection |
No |
No |
Yes |
Yes |
No |
| LLM Command Injection |
Injection |
No |
No |
Yes |
No |
Yes |
| LLM Insecure Output Handling |
Injection |
No |
No |
Yes |
No |
Yes |
| LLM Prompt Injection |
Injection |
No |
No |
Yes |
No |
Yes |
| Lucee < 6.0.1.59 - Remote Code Execution |
Injection |
No |
No |
Yes |
Yes |
No |
| Mass Assignment |
Injection |
Yes |
Yes |
Yes |
No |
Yes |
| NoSQL Injection Stored |
Injection |
Yes |
Yes |
Yes |
No |
Yes |
| NoSQL Injection Stored |
Injection |
No |
No |
Yes |
Yes |
Yes |
| PHP - var_destroy Use-After-Free (php2shell) |
Injection |
No |
Yes |
Yes |
Yes |
No |
| PHPOK - SQL Injection |
Injection |
No |
No |
Yes |
Yes |
No |
| Reflected URL Parameter |
Injection |
No |
No |
Yes |
Yes |
Yes |
| Reflected XSS Injection |
Injection |
No |
No |
No |
No |
Yes |
| Remote Code Execution via File Upload (Polyglot) |
Injection |
No |
No |
Yes |
No |
Yes |
| SQL Injection |
Injection |
No |
No |
No |
No |
No |
| SQL Injection |
Injection |
No |
No |
Yes |
Yes |
Yes |
| SQL Injection |
Injection |
Yes |
Yes |
Yes |
No |
Yes |
| SQL Injection (Oracle-Based) |
Injection |
No |
No |
Yes |
Yes |
Yes |
| SSTI (Server-Side Template Injection) |
Injection |
Yes |
Yes |
Yes |
No |
Yes |
| Stored XSS Injection |
Injection |
Yes |
Yes |
Yes |
No |
Yes |
| Stored XSS via File Upload |
Injection |
No |
No |
Yes |
No |
Yes |
| Template Injection |
Injection |
No |
No |
Yes |
Yes |
Yes |
| WordPress Core - Pre-Authentication Blind SQL Injection |
Injection |
No |
No |
Yes |
Yes |
No |
| WordPress Core - Pre-Authentication Reflected XSS (XSS2Shell) |
Injection |
No |
No |
Yes |
Yes |
No |
| XML External Entity (XXE) via File Upload |
Injection |
No |
No |
Yes |
No |
Yes |
| XSS via Query Parameter |
Injection |
No |
No |
Yes |
Yes |
Yes |
| XSS via Reflected Input |
Injection |
No |
No |
Yes |
Yes |
Yes |
| XXE Injection |
Injection |
Yes |
Yes |
Yes |
No |
Yes |
| Anonymous NULL TLS Ciphers Enabled |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Broken TLS Certificate Chain of Trust |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| CORS Misconfiguration |
Protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
| CSP Allowlisted Script Resources |
Protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
| DROWN-Vulnerable SSLv2 Service |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Excessive TLS Server Certificates |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Frontend Server Error |
Protocol |
No |
No |
Yes |
Yes |
Yes |
| Improper TLS 1.0 Cipher Order |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Improper TLS 1.1 Cipher Order |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Improper TLS 1.2 Cipher Order |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Improper TLS 1.3 Cipher Order |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Improper TLS Certificate Chain Order |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Improper TLS Certificate Extended Key Usage |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Improper TLS Certificate Key Usage |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Improper TLS Cipher Suite Order |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Improper TLS Handshake Timestamp |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Insecure HTTP Request |
Protocol |
No |
No |
Yes |
Yes |
Yes |
| Insecure TLS Protocol Negotiation |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Insecure Technology Used |
Protocol |
No |
No |
No |
Yes |
Yes |
| Insecure WebSocket Connection |
Protocol |
No |
No |
Yes |
Yes |
Yes |
| Insufficient SSL Certificate Key Size |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Invalid SSL Certificate Validity Period |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Logjam Common Diffie-Hellman Primes |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Misconfigured Cache Control Header |
Protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
| Misconfigured Content-Type Header |
Protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
| Misconfigured SSL Certificate Subject Alternative Name |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Misconfigured Set-Cookie Header |
Protocol |
No |
No |
Yes |
Yes |
Yes |
| Misconfigured Set-Cookie Header |
Protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
| Misconfigured Strict-Transport-Security Header |
Protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
| Misconfigured TLS 1.2 |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Misconfigured X-Content-Type-Options Header |
Protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
| Misconfigured X-Frame-Options Header |
Protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
| Mismatched SSL Certificate Common Name |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Mismatched SSL Common Name Without SNI |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing Access-Control-Allow-Origin Header |
Protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
| Missing Certificate Revocation List Distribution Points |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing Certificate Transparency |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing Content Security Policy Header |
Protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
| Missing Content Security Policy Header |
Protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
| Missing Extended TLS Support |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing Extended Validation Certificate Policies |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing Next Protocol Negotiation |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing OCSP Responder URLs |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing OCSP Stapling |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing Post-Quantum Key Exchange |
Protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
| Missing SSL Secure Renegotiation |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing SSL Session ID Support |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing SSL Session Resumption IDs |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing SSL Session Resumption Tickets |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing Secure Client Renegotiation |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing TLS 1.3 Support |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing TLS ALPN |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing TLS Extensions |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing TLS Fallback SCSV |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing TLS Must-Staple |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing TLS Session Tickets |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Missing Vary: Origin Header in CORS Response |
Protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
| NULL TLS Ciphers Enabled |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Non-Compliant SSL Certificate Details |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Overly Permissive Access-Control-Allow-Origin Header |
Protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
| RC4 TLS Cipher Usage |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| SSL Certificate Misconfiguration |
Protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
| SSL Certificate Uses a SHA-1 Fingerprint |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| SSL Configuration |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| SSL ROBOT Vulnerability |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| SSL Revoked Certificate via OCSP |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| SSL SWEET32 Vulnerability |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| SSL Ticketbleed Vulnerability |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| SSL Untrusted Certificate |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| SSL Untrusted Certificate Authorities |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| SSLv2 Supported |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Server Error |
Protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
| Suboptimal Average Strength Ciphers |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| TLS 1.0 CBC Ciphers Vulnerable to BEAST |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| TLS 1.0 Supported |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| TLS 1.1 Supported |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| TLS Certificate Revocation Status Issue |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| TLS ChangeCipherSpec Injection Vulnerability |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| TLS Compression Enabled |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Unsafe Eval or Inline in Content Security Policy |
Protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
| Weak SSL 3DES and IDEA Ciphers |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Weak SSL Certificate Signature Algorithm |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Weak SSL Cipher Negotiation |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Weak SSL Low-Security Ciphers |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| Weak SSL Pre-RFC 128-bit Ciphers |
Protocol |
Yes |
Yes |
Yes |
Yes |
No |
| CSRF Token Invalidation |
Request Forgery |
No |
No |
No |
No |
Yes |
| GET based CSRF |
Request Forgery |
Yes |
No |
No |
Yes |
Yes |
| GET based CSRF |
Request Forgery |
No |
No |
Yes |
Yes |
Yes |
| LLM-Enabled Server-Side Request Forgery |
Request Forgery |
No |
No |
Yes |
No |
Yes |
| OAuth Missing State Validation |
Request Forgery |
No |
No |
No |
No |
Yes |
| Open Redirect |
Request Forgery |
No |
No |
Yes |
Yes |
Yes |
| POST based CSRF |
Request Forgery |
Yes |
No |
No |
Yes |
Yes |
| POST based CSRF |
Request Forgery |
No |
No |
Yes |
Yes |
Yes |
| Server Side Request Forgery |
Request Forgery |
Yes |
Yes |
Yes |
No |
Yes |
| Server Side Request Forgery via Frontend |
Request Forgery |
No |
No |
Yes |
Yes |
Yes |
| Server-Side Request Forgery |
Request Forgery |
No |
No |
No |
No |
No |
| Server-Side Request Forgery via File Upload |
Request Forgery |
No |
No |
Yes |
No |
Yes |
| kkFileView 4.0.0 - Server-Side Request Forgery |
Request Forgery |
No |
No |
Yes |
Yes |
No |
| Character limit |
Resource Limitation |
Yes |
No |
No |
Yes |
Yes |
| GraphQL Alias Limit |
Resource Limitation |
Yes |
No |
No |
Yes |
Yes |
| GraphQL Batch Limit |
Resource Limitation |
Yes |
No |
No |
Yes |
Yes |
| GraphQL Cyclic Recursive Query |
Resource Limitation |
Yes |
No |
No |
Yes |
Yes |
| GraphQL Directive Overloading |
Resource Limitation |
Yes |
No |
No |
Yes |
Yes |
| GraphQL Field Duplication |
Resource Limitation |
Yes |
No |
No |
Yes |
Yes |
| GraphQL Recursive Fragment |
Resource Limitation |
Yes |
No |
No |
Yes |
Yes |
| Missing Rate Limiting |
Resource Limitation |
No |
No |
No |
No |
Yes |
| Pagination missing |
Resource Limitation |
Yes |
Yes |
Yes |
Yes |
Yes |
| Request Timeout (Resource Exhaustion) |
Resource Limitation |
No |
No |
Yes |
Yes |
Yes |
| Request Timeout (Resource Exhaustion) |
Resource Limitation |
Yes |
Yes |
Yes |
Yes |
Yes |
| Response Size Exceeded |
Resource Limitation |
Yes |
Yes |
Yes |
Yes |
Yes |
| Unreachable server |
Resource Limitation |
Yes |
Yes |
Yes |
Yes |
Yes |
| WordPress xmlrpc.php Exposed |
Resource Limitation |
Yes |
Yes |
Yes |
Yes |
No |
| Invalid integer format |
Schema |
Yes |
Yes |
Yes |
Yes |
Yes |
| Adminer Default Login - Detect |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Apache Airflow Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Apache Airflow v3 Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Apache Apisix Admin - Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Apache Apollo - Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Apache CloudStack - Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Apache DolphinScheduler Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Apache Doris - Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Apache Dubbo - Default Admin Discovery |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Apache HertzBeat - Default Credentials |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Apache Kafka Center Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Apache Karaf - Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Apache Kylin Console - Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Apache Ranger - Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Apache Tomcat - Default Login Discovery |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Apache Tomcat Manager Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Django Secret Key Exposure |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| EasyImage down.php - Arbitrary File Read |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| ElasticSearch - Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Esafenet CDG mysql - File Read |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Exposed JSON Configuration Files |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Exposed JWT Token |
Sensitive Data |
Yes |
Yes |
Yes |
Yes |
Yes |
| Fanwei OA E-Office - Information Disclosure |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| GLPI Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Gitlab Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Grafana Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Hardcoded Secret in JavaScript Bundle |
Sensitive Data |
No |
No |
Yes |
Yes |
Yes |
| High number of Custom Scalars |
Sensitive Data |
Yes |
Yes |
Yes |
Yes |
Yes |
| High number of Payment Card Industry Data |
Sensitive Data |
Yes |
Yes |
Yes |
Yes |
Yes |
| High number of Personal Health Information |
Sensitive Data |
Yes |
Yes |
Yes |
Yes |
Yes |
| High number of Personal Identifiable Information |
Sensitive Data |
Yes |
Yes |
Yes |
Yes |
Yes |
| High number of Secrets |
Sensitive Data |
Yes |
Yes |
Yes |
Yes |
Yes |
| Jenkins Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Joomla! Component Easy Shop 1.2.3 - Local File Inclusion |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Joomla! Component com_sef - Local File Inclusion |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Joomla! com_booking component 2.4.9 - Information Leak |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Joomla! com_fabrik 3.9.11 - Local File Inclusion |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Microsoft Access Database File - Detect |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Minio Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Nginx Proxy Manager - Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Node-Red - Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| OA E-Office mysql_config.ini - Information Disclosure |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| OpenMediaVault - Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| OpenSearch Dashboard - Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| RabbitMQ Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Rundeck - Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Secret Token Ruby - File Disclosure |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Seeyon OA A6 createMysql.jsp Database - Information Disclosure |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Sensitive Data Leak in JavaScript Bundle |
Sensitive Data |
No |
No |
No |
No |
Yes |
| Social Metrics Tracker <= 1.6.8 - Unauthorized Data Export |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| SonarQube Default Login - Detect |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| TOTOLINK N150RT - Password Exposure |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| TOTP Secret Exposure |
Sensitive Data |
No |
No |
No |
No |
Yes |
| Twonky Server - Exposure |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Webmin - Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| WordPress DB Backup |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| WordPress DB Backup |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| WordPress Debug Log - Exposure |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| WordPress Plugin "AffiliateWP -- Allowed Products" Log Disclosure |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| WordPress Total Upkeep Database and Files Backup Download |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| WordPress Wordfence 7.4.5 - Local File Inclusion |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| Zabbix Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| phpMyAdmin - Default Login |
Sensitive Data |
No |
No |
Yes |
Yes |
No |
| phpwiki 1.5.4 - Cross-Site Scripting/Local File Inclusion |
Sensitive Data |
No |
No |
Yes |
Yes |
No |