Fracture

Detailed View

INFO FR-001 — Internal Redirect: Trailing Slash Mismatch

Description: The server issued an internal redirect due to a trailing slash mismatch on the target URL. This may expose URL normalization behavior.

Remediation: Ensure consistent URL handling and redirect policies are configured on the web server.

OWASP Web: A05:2025

INFO FR-002 — HTTP Redirect to In-Scope URL

Description: The target URL issues an HTTP redirect to another in-scope URL. Redirect chains may expose internal routing logic.

Remediation: Review redirect configurations to ensure they are intentional and do not expose sensitive routing information.

OWASP Web: A04:2025

INFO FR-003 — HTTP Redirect to External URL

Description: The target URL issues an HTTP redirect to an external domain. This could be leveraged in open redirect or phishing scenarios.

Remediation: Validate and whitelist all redirect destinations. Avoid unvalidated redirects to external URLs.

OWASP Web: A04:2025

LOW FR-004 — WordPress readme.html Accessible

Description: The WordPress readme.html file is publicly accessible. This file may disclose the WordPress version and other installation details.

Remediation: Remove or restrict access to readme.html via web server configuration.

OWASP Web: A06:2025

INFO FR-005 — WordPress license.txt Accessible

Description: The WordPress license.txt file is publicly accessible. While not directly exploitable, it confirms a WordPress installation.

Remediation: Remove or restrict access to license.txt via web server configuration.

OWASP Web: A05:2025

MEDIUM FR-006 — Information Disclosure: WordPress Version

Description: The WordPress version was identified from publicly accessible files or meta tags. A known version allows attackers to target specific vulnerabilities.

Remediation: Remove version disclosure from meta generator tags and restrict access to files that reveal version information. Keep WordPress updated.

OWASP Web: A06:2025

MEDIUM FR-007 — WordPress Login Page Accessible

Description: The WordPress admin login page (wp-login.php) is publicly accessible. This exposes the authentication endpoint to brute-force and credential stuffing attacks.

Remediation: Restrict access to wp-login.php by IP, add CAPTCHA, implement account lockout, or use a WAF rule to limit login attempts.

OWASP Web: A07:2025

MEDIUM FR-008 — WordPress User Registration Enabled

Description: WordPress user self-registration is enabled. Attackers may create accounts to gain authenticated access or exploit subscriber-level vulnerabilities.

Remediation: Disable user registration if not required. If required, implement email verification and role restrictions for new registrations.

OWASP Web: A05:2025

LOW FR-009 — WordPress Password Reset Form Accessible

Description: The WordPress password reset form is accessible. Combined with user enumeration, this could facilitate account takeover via password reset abuse.

Remediation: Implement rate limiting on the password reset endpoint and ensure username/email enumeration is not possible through error messages.

OWASP Web: A07:2025

LOW FR-010 — WordPress X-Pingback Header Present

Description: The X-Pingback HTTP header is present, advertising the XML-RPC pingback endpoint. This confirms XML-RPC is enabled and may facilitate SSRF or DDoS amplification.

Remediation: Disable XML-RPC or remove the X-Pingback header via web server configuration if XML-RPC functionality is not required.

OWASP Web: A05:2025

HIGH FR-011 — WordPress XML-RPC Interface Enabled

Description: The WordPress XML-RPC interface (xmlrpc.php) is enabled and accessible. This legacy interface enables brute-force attacks, SSRF via pingback, and DDoS amplification.

Remediation: Disable XML-RPC entirely if not required. If required, restrict access by IP and disable the multicall method.

OWASP Web: A05:2025

HIGH FR-012 — WordPress XML-RPC Multicall Brute-Force Vector

Description: The XML-RPC system.multicall method is enabled, allowing an attacker to test hundreds of username/password combinations in a single HTTP request, bypassing standard rate limiting.

Remediation: Disable XML-RPC or specifically block the system.multicall method. Implement per-IP rate limiting at the web server level.

OWASP Web: A07:2025

HIGH FR-013 — WordPress XML-RPC Pingback SSRF Vector

Description: The XML-RPC pingback.ping method is accessible. An attacker can abuse this to perform Server-Side Request Forgery (SSRF) or use the WordPress server as a DDoS reflector.

Remediation: Disable XML-RPC or block the pingback.ping method. Implement egress filtering to restrict outbound requests from the web server.

OWASP Web: A10:2025

HIGH FR-014 — WordPress XML-RPC Interface Accessible

Description: The WordPress XML-RPC endpoint responds to requests. The full list of available methods was retrieved, confirming the attack surface exposed by this legacy interface.

Remediation: Disable xmlrpc.php entirely unless required. If required, restrict access by IP whitelist.

OWASP Web: A05:2025

MEDIUM FR-015 — WordPress REST API Exposed

Description: The WordPress REST API is publicly accessible without authentication. This may expose site structure, user data, and plugin information to unauthenticated users.

Remediation: Restrict REST API access to authenticated users where possible. Disable specific endpoints that expose sensitive data.

OWASP Web: A01:2025

HIGH FR-016 — WordPress Users Exposed via REST API

Description: The WordPress REST API /wp/v2/users endpoint returns a list of registered usernames and IDs without authentication. This facilitates targeted brute-force and social engineering attacks.

Remediation: Disable or restrict the /wp/v2/users endpoint. Use a security plugin or custom code to require authentication for user enumeration endpoints.

OWASP Web: A01:2025

LOW FR-017 — WordPress Media Files Enumerable via REST API

Description: The WordPress REST API /wp/v2/media endpoint exposes a list of uploaded media files without authentication, revealing site content structure and potentially sensitive file paths.

Remediation: Restrict the media REST API endpoint to authenticated users or disable it if not needed for public consumers.

OWASP Web: A01:2025

MEDIUM FR-018 — WordPress User Enumeration via Author Archives

Description: WordPress author archive pages (/?author=N) redirect to /author/<username>/, disclosing valid usernames. Enumerated usernames can be used for targeted brute-force attacks.

Remediation: Disable author archive pages or suppress the username slug from archive URLs using a security plugin or custom rewrite rules.

OWASP Web: A07:2025

LOW FR-019 — WordPress Username Disclosed via oEmbed API

Description: The WordPress oEmbed endpoint discloses the site author username in its JSON response. This provides an additional username enumeration vector.

Remediation: Disable the oEmbed endpoint if not required, or customize the author name field to avoid exposing login usernames.

OWASP Web: A07:2025

CRITICAL FR-020 — WordPress Configuration Backup Exposed

Description: A WordPress configuration backup file (e.g., wp-config.php.bak, wp-config.php~) was found accessible on the web server. These files typically contain database credentials, authentication keys, and salts.

Remediation: Immediately remove all backup and temporary copies of wp-config.php from the web root. Rotate all credentials disclosed. Configure the web server to deny access to .bak, .swp, and ~ files.

OWASP Web: A01:2025

INFO FR-021 — WordPress Plugin Detected

Description: WordPress plugin(s) confirmed via readme.txt enumeration. Version disclosure enables targeted CVE lookups. Plugin names and versions are listed in the Affected field.

Remediation: Keep all WordPress plugins updated to the latest release. Remove readme.txt from plugin directories on production servers. Remove unused plugins to reduce attack surface.

Effort: Low

OWASP Web: A06:2025

MITRE ATT&CK: T1592.002 (Reconnaissance)

NIST 800-53: CM-8, SI-2

PCI DSS 4: 6.3.2

INFO FR-022 — WordPress Theme Detected

Description: The active WordPress theme was detected via static asset paths. Theme identification aids in locating theme-specific vulnerabilities.

Remediation: Keep themes updated. Remove inactive themes. Restrict access to theme readme and style.css version disclosures.

OWASP Web: A06:2025

HIGH FR-023 — WordPress Debug Log Accessible

Description: The WordPress debug log file (wp-content/debug.log) is publicly accessible. Debug logs may contain PHP errors, stack traces, file paths, database queries, and credentials.

Remediation: Disable WP_DEBUG in production. Move the debug log outside the web root or restrict access via web server configuration.

OWASP Web: A09:2025

MEDIUM FR-024 — WordPress uploads Directory Browsing Enabled

Description: Directory listing is enabled on the WordPress uploads directory. Attackers can enumerate all uploaded files, potentially finding sensitive documents or user data.

Remediation: Disable directory listing in the web server configuration. Add an Options -Indexes directive or equivalent.

OWASP Web: A05:2025

INFO FR-025 — Robots.txt Discloses Hidden Paths

Description: The robots.txt file contains Disallow directives that reveal hidden or sensitive application paths. These paths are often administrative interfaces, backup files, or unlinked endpoints.

Remediation: Review paths listed in robots.txt. Ensure sensitive paths are protected by authentication, not just excluded from crawlers.

OWASP Web: A05:2025

INFO FR-026 — Sitemap.xml Discovered

Description: A sitemap.xml file was found. Sitemaps enumerate application URLs and can reveal non-linked endpoints and application structure.

Remediation: Review all URLs listed in sitemap.xml to ensure none expose sensitive functionality without proper access controls.

OWASP Web: A05:2025

LOW FR-027 — Server Banner Disclosure

Description: The HTTP Server header discloses the web server software name and version. This information assists attackers in identifying applicable CVEs and exploit modules.

Remediation: Configure the web server to suppress or genericize the Server header. Remove version information from all HTTP response headers.

OWASP Web: A05:2025

LOW FR-028 — X-Powered-By Header Discloses Technology Stack

Description: The X-Powered-By HTTP response header discloses the backend technology (e.g., PHP version, ASP.NET version, Express). This aids fingerprinting and CVE targeting.

Remediation: Remove or suppress the X-Powered-By header in web server and application framework configuration.

OWASP Web: A05:2025

MEDIUM FR-029 — Application Error Message Disclosure

Description: Verbose error messages are returned by the application, potentially revealing stack traces, file paths, database queries, or framework internals.

Remediation: Configure custom error pages for all HTTP error codes. Ensure verbose errors are logged server-side only and not returned to clients.

OWASP Web: A05:2025

MEDIUM FR-030 — Directory Listing Enabled

Description: Directory listing is enabled on one or more paths, allowing unauthenticated users to browse file and directory contents. This may expose source code, configuration files, or sensitive documents.

Remediation: Disable directory listing in web server configuration (Options -Indexes for Apache, autoindex off for Nginx).

OWASP Web: A05:2025

MEDIUM FR-031 — WSDL/WADL Service Description Exposed

Description: A WSDL or WADL service description file is publicly accessible. These files describe all available service methods, parameters, and data types, providing a full attack surface map.

Remediation: Restrict access to WSDL/WADL files by IP or authentication. Remove them from public-facing endpoints in production.

OWASP Web: A05:2025

INFO FR-032 — GraphQL Endpoint Detected

Description: A GraphQL endpoint was detected. GraphQL endpoints expose a queryable schema and may be subject to introspection, batching attacks, and authorization bypass.

Remediation: Disable introspection in production. Implement query depth limiting, rate limiting, and field-level authorization checks.

OWASP Web: A05:2025

MEDIUM FR-033 — Swagger/OpenAPI Documentation Exposed

Description: Swagger UI or OpenAPI specification files are publicly accessible without authentication. These documents expose the full API surface including endpoints, parameters, authentication schemes, and data models.

Remediation: Restrict access to API documentation in production. If public documentation is required, ensure it does not expose internal or administrative endpoints.

OWASP Web: A05:2025

HIGH FR-034 — Admin Interface Exposed

Description: An administrative interface was discovered at a predictable path. Admin interfaces exposed to the internet are high-value targets for brute-force, credential stuffing, and authentication bypass attacks.

Remediation: Restrict admin interface access by IP whitelist. Move admin interfaces to non-standard ports or behind a VPN. Enforce MFA on all administrative accounts.

OWASP Web: A05:2025

HIGH FR-035 — Backup File Discovered

Description: A backup file (e.g., .bak, .old, .orig, ~, .zip) was discovered in the web root. Backup files often contain source code, configuration, or credentials.

Remediation: Remove all backup files from the web root. Add web server rules to deny access to common backup file extensions.

OWASP Web: A05:2025

CRITICAL FR-036 — Configuration File Exposed

Description: A configuration file (e.g., .env, config.php, settings.py, database.yml) is publicly accessible. Configuration files typically contain database credentials, API keys, secret keys, and other sensitive values.

Remediation: Remove configuration files from the web root immediately. Store configuration outside the document root. Rotate all exposed credentials.

OWASP Web: A05:2025

CRITICAL FR-037 — Git Repository Exposed

Description: A .git directory or git repository index is accessible from the web root. An attacker can reconstruct the full source code, commit history, and any secrets ever committed.

Remediation: Immediately block access to .git directories via web server configuration. Rotate all credentials ever committed to the repository. Audit git history for secrets.

OWASP Web: A05:2025

HIGH FR-038 — SVN/CVS Repository Exposed

Description: A Subversion (.svn) or CVS repository directory is accessible from the web root. Repository metadata can be used to reconstruct source files.

Remediation: Block access to .svn and CVS directories via web server configuration. Remove version control directories from the web root.

OWASP Web: A05:2025

HIGH FR-039 — Log File Accessible

Description: An application or server log file is publicly accessible. Log files may contain IP addresses, usernames, session tokens, stack traces, and sensitive application data.

Remediation: Move log files outside the web root. Restrict access via web server configuration. Ensure log rotation is implemented.

OWASP Web: A09:2025

CRITICAL FR-040 — Database File Exposed

Description: A database file (e.g., .sqlite, .db, .mdb) is directly accessible from the web server. This exposes the entire database contents to unauthenticated download.

Remediation: Remove all database files from the web root immediately. Store database files outside the document root and restrict filesystem permissions.

OWASP Web: A05:2025

HIGH FR-041 — TLS Certificate Expired

Description: The TLS certificate presented by the server has expired. Browser warnings will be displayed, and the certificate can no longer be trusted to guarantee the server's identity.

Remediation: Renew the TLS certificate immediately. Implement automated certificate renewal (e.g., Let's Encrypt with certbot or ACME protocol) to prevent future expirations.

OWASP Web: A02:2025

HIGH FR-042 — TLS Certificate Not Yet Valid

Description: The TLS certificate presented by the server has a notBefore date in the future, meaning it is not yet valid. Clients may reject the connection.

Remediation: Ensure server time is synchronized via NTP. Verify the certificate was issued correctly and replace if the issue persists.

OWASP Web: A02:2025

HIGH FR-043 — TLS Certificate Hostname Mismatch

Description: The Common Name or Subject Alternative Names in the TLS certificate do not match the hostname being accessed. This breaks trust validation and may indicate a misconfiguration or MITM condition.

Impact: A TLS certificate hostname mismatch indicates the certificate was not issued for the requested domain, causing browser warnings. Users who bypass these warnings become vulnerable to MITM attacks, and automated systems may silently accept invalid certificates.

Remediation: Obtain and install a certificate that matches the server's hostname. Use Subject Alternative Names (SANs) to cover all required hostnames.

OWASP Web: A02:2025

MEDIUM FR-044 — TLS Certificate Self-Signed

Description: The TLS certificate is self-signed and not issued by a trusted Certificate Authority. Clients cannot validate the server's identity, making the connection susceptible to MITM attacks.

Remediation: Replace the self-signed certificate with one issued by a trusted CA. Use Let's Encrypt for free, automatically renewed certificates.

OWASP Web: A02:2025

HIGH FR-045 — Weak TLS Protocol Supported (SSLv2/SSLv3/TLS 1.0/TLS 1.1)

Description: The server supports one or more deprecated TLS/SSL protocol versions (SSLv2, SSLv3, TLS 1.0, or TLS 1.1). These protocols have known cryptographic weaknesses exploitable by POODLE, BEAST, and similar attacks.

Remediation: Disable SSLv2, SSLv3, TLS 1.0, and TLS 1.1. Configure the server to support only TLS 1.2 and TLS 1.3.

OWASP Web: A02:2025

HIGH FR-046 — Weak Cipher Suite Supported

Description: The server supports weak cipher suites including NULL encryption, RC4, DES, 3DES, or export-grade ciphers. Weak ciphers can be exploited to decrypt TLS-protected traffic.

Remediation: Configure the server to support only strong cipher suites (AES-GCM, ChaCha20-Poly1305). Use Mozilla SSL Configuration Generator for recommended cipher lists.

OWASP Web: A02:2025

MEDIUM FR-047 — TLS BEAST Vulnerability

Description: The server is vulnerable to the BEAST (Browser Exploit Against SSL/TLS) attack due to the use of TLS 1.0 with CBC cipher suites. An attacker with network position can decrypt portions of encrypted traffic.

Remediation: Disable TLS 1.0. Prefer TLS 1.2+ with GCM cipher suites. Enable server-side cipher preference.

OWASP Web: A02:2025

HIGH FR-048 — TLS POODLE Vulnerability

Description: The server supports SSLv3, making it vulnerable to the POODLE (Padding Oracle On Downgraded Legacy Encryption) attack. An attacker can force a downgrade to SSLv3 and decrypt session cookies.

Remediation: Disable SSLv3 entirely. Implement TLS_FALLBACK_SCSV to prevent protocol downgrade attacks.

OWASP Web: A02:2025

CRITICAL FR-049 — TLS DROWN Vulnerability

Description: The server supports SSLv2, making modern TLS connections vulnerable to the DROWN attack. An attacker can decrypt RSA-encrypted TLS sessions by exploiting SSLv2 export cipher weaknesses.

Remediation: Disable SSLv2 on all servers sharing the same private key. Regenerate private keys if SSLv2 was enabled.

OWASP Web: A02:2025

CRITICAL FR-050 — TLS HEARTBLEED Vulnerability

Description: The server is running a version of OpenSSL vulnerable to Heartbleed (CVE-2014-0160). An attacker can read up to 64KB of server memory per request, potentially extracting private keys, session tokens, and credentials.

Remediation: Upgrade OpenSSL to 1.0.1g or later immediately. After patching, revoke and regenerate all TLS certificates and private keys. Invalidate all active sessions.

OWASP Web: A02:2025

HIGH FR-051 — TLS LOGJAM Vulnerability

Description: The server supports DHE key exchange with weak (export-grade) Diffie-Hellman parameters (512-bit), making it vulnerable to the LOGJAM downgrade attack.

Remediation: Disable export-grade DHE cipher suites. Generate and configure strong (2048-bit or 4096-bit) DH parameters. Prefer ECDHE over DHE.

OWASP Web: A02:2025

HIGH FR-052 — TLS FREAK Vulnerability

Description: The server supports RSA_EXPORT cipher suites, making it vulnerable to the FREAK (Factoring RSA Export Keys) attack. An attacker can force the use of weak 512-bit RSA keys.

Remediation: Disable all EXPORT cipher suites. Update OpenSSL to a patched version. Enforce server-side cipher preference.

OWASP Web: A02:2025

HIGH FR-053 — TLS ROBOT Vulnerability

Description: The server is vulnerable to the ROBOT (Return Of Bleichenbacher's Oracle Threat) attack, allowing an attacker to perform RSA decryption and signing operations with the server's private key.

Remediation: Disable RSA key exchange cipher suites. Use ECDHE for forward secrecy. Patch the TLS library to a version with ROBOT mitigations.

OWASP Web: A02:2025

HIGH FR-054 — TLS CCS Injection Vulnerability

Description: The server is vulnerable to the OpenSSL CCS Injection vulnerability (CVE-2014-0224). An attacker with MITM position can force the use of weak key material.

Remediation: Upgrade OpenSSL to 0.9.8za, 1.0.0m, or 1.0.1h or later. Restart the server after patching.

OWASP Web: A02:2025

HIGH FR-055 — TLS Ticketbleed Vulnerability

Description: The server is vulnerable to Ticketbleed (CVE-2016-9244) in F5 BIG-IP TLS implementations, allowing an attacker to read up to 31 bytes of uninitialized memory via TLS session tickets.

Remediation: Apply the vendor patch from F5. Disable TLS session tickets as a temporary mitigation.

OWASP Web: A02:2025

MEDIUM FR-056 — TLS SWEET32 Vulnerability

Description: The server supports 3DES cipher suites, making long-lived TLS connections vulnerable to the SWEET32 birthday attack, which can recover plaintext from encrypted traffic.

Remediation: Disable 3DES (TRIPLE_DES, 3DES_EDE) cipher suites. Prefer AES-GCM cipher suites.

OWASP Web: A02:2025

MEDIUM FR-057 — HTTP Strict Transport Security (HSTS) Not Enforced

Description: The Strict-Transport-Security (HSTS) header is not present or has an insufficient max-age. Without HSTS, browsers may connect over HTTP, enabling SSL stripping attacks.

Impact: Without HSTS enforcement, browsers permit plaintext HTTP connections, enabling SSL stripping attacks where an attacker downgrades the connection to intercept credentials and session tokens in transit.

Remediation: Add the Strict-Transport-Security header with a max-age of at least 31536000 seconds (1 year), includeSubDomains, and preload directives.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

OWASP Web: A05:2025

MEDIUM FR-058 — TLS Certificate Uses Weak Signature Algorithm (MD5/SHA-1)

Description: The TLS certificate is signed with a weak signature algorithm (MD5 or SHA-1). SHA-1 certificates are deprecated by major browsers and CAs, and MD5 certificates are cryptographically broken.

Remediation: Replace the certificate with one using SHA-256 or stronger signature algorithm (SHA-2 family).

OWASP Web: A02:2025

MEDIUM FR-059 — TLS Certificate Short Key Length

Description: The TLS certificate uses an RSA key shorter than 2048 bits. Short RSA keys are susceptible to factoring attacks with sufficient computational resources.

Remediation: Replace the certificate with one using at least 2048-bit RSA keys, or preferably 4096-bit RSA or ECDSA P-256/P-384.

OWASP Web: A02:2025

HIGH FR-060 — Subdomain Takeover Vulnerability

Description: A subdomain DNS record points to an external service (e.g., GitHub Pages, S3, Heroku, Netlify) that is no longer claimed. An attacker can register the unclaimed resource and serve malicious content from the trusted subdomain.

Remediation: Remove dangling DNS records immediately. Claim or delete the referenced external resource. Implement DNS monitoring to detect future dangling records.

OWASP Web: A05:2025

MEDIUM FR-061 — Missing Content-Security-Policy Header

Description: The Content-Security-Policy (CSP) header is absent. Without CSP, the application has no defense against Cross-Site Scripting (XSS) and data injection attacks through browser-enforced policy.

Remediation: Implement a restrictive Content-Security-Policy header. Start with a report-only policy, monitor violations, then enforce. Avoid 'unsafe-inline' and 'unsafe-eval' directives.

OWASP Web: A05:2025

MEDIUM FR-062 — Missing X-Frame-Options Header

Description: The X-Frame-Options header is absent. Without this header, the page can be embedded in an iframe on any origin, enabling clickjacking attacks that trick users into performing unintended actions.

Remediation: Add 'X-Frame-Options: DENY' or 'X-Frame-Options: SAMEORIGIN'. Alternatively, use the CSP frame-ancestors directive.

OWASP Web: A05:2025

LOW FR-063 — Missing X-Content-Type-Options Header

Description: The X-Content-Type-Options header is absent. Without this header, browsers may perform MIME type sniffing, potentially executing uploaded files as scripts.

Remediation: Add 'X-Content-Type-Options: nosniff' to all HTTP responses.

OWASP Web: A05:2025

LOW FR-064 — Missing Referrer-Policy Header

Description: The Referrer-Policy header is absent. Without this header, the browser's default behavior may leak the full URL (including query parameters and path) in the Referer header to third-party origins.

Remediation: Add 'Referrer-Policy: strict-origin-when-cross-origin' or a more restrictive policy to prevent sensitive URL data leakage.

OWASP Web: A05:2025

LOW FR-065 — Missing Permissions-Policy Header

Description: The Permissions-Policy (formerly Feature-Policy) header is absent. This header controls which browser features and APIs are available to the page and embedded third-party content.

Remediation: Add a Permissions-Policy header that disables browser features not required by the application (e.g., camera, microphone, geolocation).

OWASP Web: A05:2025

MEDIUM FR-066 — Missing Strict-Transport-Security Header

Description: The HTTP Strict-Transport-Security (HSTS) header is absent. Without HSTS, browsers may connect over plain HTTP, and SSL stripping attacks can downgrade HTTPS connections to HTTP.

Remediation: Add 'Strict-Transport-Security: max-age=31536000; includeSubDomains; preload' to all HTTPS responses.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

OWASP Web: A05:2025

MITRE ATT&CK: T1557 (Collection)

NIST 800-53: SC-8

PCI DSS 4: 4.2.1

MEDIUM FR-067 — Insecure Content-Security-Policy (Unsafe-Inline Allowed)

Description: The Content-Security-Policy header contains 'unsafe-inline', which negates XSS protection by allowing inline JavaScript and CSS. This is the most common CSP misconfiguration.

Remediation: Replace 'unsafe-inline' with nonce-based or hash-based CSP. Refactor inline scripts to external files.

OWASP Web: A05:2025

MEDIUM FR-068 — Insecure Content-Security-Policy (Wildcard Source)

Description: The Content-Security-Policy header contains a wildcard (*) source directive, allowing scripts or resources to be loaded from any origin. This effectively disables CSP's XSS protection.

Remediation: Replace wildcard sources with specific, trusted origin allowlists. Audit all third-party resource dependencies.

OWASP Web: A05:2025

MEDIUM FR-069 — Session Cookie Missing Secure Flag

Description: One or more session cookies are set without the Secure flag. Without the Secure flag, the cookie will be transmitted over unencrypted HTTP connections, exposing session tokens to network interception.

Remediation: Set the Secure flag on all session cookies. Ensure the application forces HTTPS for all authenticated requests.

OWASP Web: A02:2025

MEDIUM FR-070 — Session Cookie Missing HttpOnly Flag

Description: One or more session cookies are set without the HttpOnly flag. Without HttpOnly, client-side JavaScript can read the cookie value, enabling session token theft via XSS.

Remediation: Set the HttpOnly flag on all session and authentication cookies to prevent JavaScript access.

OWASP Web: A02:2025

MEDIUM FR-071 — Session Cookie Missing SameSite Attribute

Description: Session cookies are set without the SameSite attribute, or with SameSite=None without Secure. This enables Cross-Site Request Forgery (CSRF) attacks in browsers that do not implement SameSite by default.

Remediation: Set SameSite=Strict or SameSite=Lax on all session cookies. Use SameSite=None only for legitimate cross-site cookie sharing, and always with Secure.

OWASP Web: A01:2025

HIGH FR-072 — JWT Token in Local Storage

Description: JSON Web Tokens (JWTs) are stored in browser localStorage. localStorage is accessible to JavaScript, making JWT tokens vulnerable to theft via XSS attacks.

Remediation: Store JWTs in HttpOnly, Secure cookies instead of localStorage. This prevents JavaScript access and protects tokens from XSS-based theft.

OWASP Web: A02:2025

CRITICAL FR-073 — JWT Algorithm Confusion (None Algorithm)

Description: The server accepts JWTs with the algorithm set to 'none', bypassing signature verification entirely. An attacker can forge arbitrary JWT payloads and impersonate any user.

Remediation: Explicitly validate the JWT algorithm on the server side. Reject tokens with 'alg: none'. Use a strict allowlist of permitted algorithms.

OWASP Web: A02:2025

CRITICAL FR-074 — JWT Algorithm Confusion (RS256 to HS256)

Description: The server is vulnerable to JWT algorithm confusion. By changing the algorithm from RS256 to HS256 and signing the token with the public key as the HMAC secret, an attacker can forge valid JWTs.

Remediation: Enforce algorithm validation server-side. Use separate code paths for asymmetric (RS256) and symmetric (HS256) verification. Never use the public key as an HMAC secret.

OWASP Web: A02:2025

CRITICAL FR-075 — JWT Weak HMAC Secret

Description: The JWT HMAC signing secret is weak or uses a common/guessable value. An attacker can brute-force the secret offline and forge arbitrary JWT tokens.

Remediation: Use a cryptographically random secret of at least 256 bits for HMAC-signed JWTs. Store the secret securely and rotate it periodically.

OWASP Web: A02:2025

CRITICAL FR-076 — JWT Signature Not Verified

Description: The server accepts JWTs with an invalid or tampered signature. The server is processing the JWT payload without verifying its integrity, allowing full token forgery.

Remediation: Ensure the JWT verification library is correctly configured to always verify the signature. Never decode without verification.

OWASP Web: A02:2025

MEDIUM FR-077 — JWT Sensitive Data in Payload

Description: Sensitive data (e.g., passwords, PII, internal IDs) was found in the JWT payload. JWT payloads are base64-encoded but not encrypted, making them readable to any party with the token.

Remediation: Remove sensitive data from JWT payloads. Use JWE (JSON Web Encryption) if sensitive data must be embedded in tokens.

OWASP Web: A02:2025

HIGH FR-078 — JWT Token Accepted After Expiry

Description: The server accepts JWT tokens after their 'exp' (expiration) claim has passed. This allows indefinite reuse of stolen or leaked tokens.

Remediation: Enforce 'exp' claim validation in JWT processing. Reject tokens with past expiration times. Use short token lifetimes with refresh token rotation.

OWASP Web: A07:2025

CRITICAL FR-079 — JWT kid Header Injection

Description: The JWT 'kid' (Key ID) header parameter is used in an unsafe SQL query or file path lookup without validation. An attacker can inject a SQL payload or path traversal sequence into the kid header to manipulate key selection.

Remediation: Validate and sanitize the 'kid' header value. Use a whitelist of known key IDs. Never use the kid value directly in SQL queries or file system lookups.

OWASP Web: A02:2025

CRITICAL FR-080 — JWT jwk Header Injection

Description: The server trusts the 'jwk' (JSON Web Key) header embedded in the JWT itself for signature verification. An attacker can embed their own public key in the jwk header and sign a forged token with the corresponding private key.

Remediation: Never trust keys embedded in the JWT header. Use only server-side trusted key stores for JWT verification. Ignore or reject tokens with 'jwk' or 'jku' headers unless explicitly required.

OWASP Web: A02:2025

CRITICAL FR-081 — SQL Injection

Description: SQL injection was detected. User-supplied input is incorporated into SQL queries without proper parameterization or escaping. An attacker can manipulate database queries to extract, modify, or delete data, bypass authentication, or execute operating system commands.

Remediation: Use parameterized queries or prepared statements for all database interactions. Never concatenate user input into SQL strings. Apply the principle of least privilege to database accounts.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2025

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, SA-11, RA-5

PCI DSS 4: 6.2.4, 6.3.2

CRITICAL FR-082 — Blind SQL Injection (Boolean-Based)

Description: Boolean-based blind SQL injection was detected. The application does not return error messages, but its behavior changes based on the truth value of injected conditions, allowing data extraction through binary search.

Remediation: Use parameterized queries or prepared statements. Implement a WAF. Review all database query construction code for unsanitized input.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2025

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, SA-11, RA-5

PCI DSS 4: 6.2.4, 6.3.2

CRITICAL FR-083 — Blind SQL Injection (Time-Based)

Description: Time-based blind SQL injection was detected. The server introduces measurable response delays when injected time-delay SQL functions (e.g., SLEEP, WAITFOR DELAY) are executed, confirming SQL injection without visible output.

Remediation: Use parameterized queries or prepared statements. Implement query timeouts and anomaly detection. Review all database interaction code.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2025

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, SA-11, RA-5

PCI DSS 4: 6.2.4, 6.3.2

CRITICAL FR-084 — NoSQL Injection

Description: NoSQL injection was detected against a MongoDB, Elasticsearch, or similar NoSQL database. Unsanitized user input is used to construct NoSQL query objects, allowing query manipulation, authentication bypass, and data extraction.

Remediation: Validate and sanitize all user input before using it in NoSQL queries. Use typed query builders and avoid accepting raw operator objects (e.g., $where, $gt) from user input.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

OWASP Web: A03:2025

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

CRITICAL FR-085 — Command Injection (OS Command Injection)

Description: Operating system command injection was detected. User-supplied input is passed to a system shell command without sanitization. An attacker can execute arbitrary OS commands with the privileges of the web server process.

Remediation: Avoid calling OS commands from web applications. If unavoidable, use a whitelist of allowed commands and never pass user input directly to shell functions. Use language-native APIs instead of shell commands.

OWASP Web: A03:2025

CRITICAL FR-086 — Server-Side Template Injection (SSTI)

Description: Server-Side Template Injection was detected. User input is embedded directly into a server-side template (Jinja2, Freemarker, Twig, Velocity, Pebble, etc.) and executed. This can lead to remote code execution on the server.

Remediation: Never render user-controlled data as template code. Escape all user input before inserting into templates. Use sandboxed template environments.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2025

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, SA-11

PCI DSS 4: 6.2.4

HIGH FR-087 — Cross-Site Scripting (XSS) — Reflected

Description: Reflected Cross-Site Scripting was detected. User-supplied input is returned in the HTTP response without proper encoding, allowing an attacker to inject client-side scripts that execute in the victim's browser.

Remediation: Encode all user-supplied data before rendering it in HTML context. Implement a strict Content-Security-Policy. Use a template engine with auto-escaping enabled.

OWASP Web: A03:2025

HIGH FR-088 — Cross-Site Scripting (XSS) — Stored

Description: Stored Cross-Site Scripting was detected. Malicious scripts submitted by an attacker are persisted in the application's data store and executed in the browser of every user who views the affected content.

Remediation: Encode all stored user data before rendering. Validate and sanitize input on write. Implement CSP with nonce-based script policy.

OWASP Web: A03:2025

HIGH FR-089 — Cross-Site Scripting (XSS) — DOM-Based

Description: DOM-based Cross-Site Scripting was detected. Client-side JavaScript reads attacker-controlled data (e.g., from URL fragments, postMessage, or localStorage) and writes it to a dangerous sink (innerHTML, eval, document.write) without sanitization.

Remediation: Review all client-side JavaScript for unsafe DOM manipulation. Use textContent instead of innerHTML. Validate and encode data before passing to DOM sinks.

OWASP Web: A03:2025

HIGH FR-090 — LDAP Injection

Description: LDAP injection was detected. User input is incorporated into LDAP query filters without proper escaping. An attacker can manipulate LDAP queries to bypass authentication or extract directory entries.

Remediation: Use an LDAP library that supports parameterized queries. Escape all special LDAP characters (\, *, (, ), NUL) in user-supplied input before using it in filters.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A03:2025

MITRE ATT&CK: T1190 (Initial Access), T1110 (Credential Access)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

HIGH FR-091 — XPath Injection

Description: XPath injection was detected. User input is embedded in XPath query expressions without sanitization. An attacker can manipulate queries to extract unauthorized XML data or bypass authentication.

Remediation: Use parameterized XPath queries. Escape all user-supplied data used in XPath expressions. Validate input against a strict whitelist.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A03:2025

OWASP API: API8:2023 – Security Misconfiguration

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

CRITICAL FR-092 — XML External Entity (XXE) Injection

Description: XML External Entity (XXE) injection was detected. The XML parser processes externally supplied entity references, allowing an attacker to read local files, perform SSRF, or cause denial of service.

Remediation: Disable external entity processing in the XML parser configuration. Use safe XML parsing libraries. If XML must be accepted, validate and strip external entities before parsing.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

OWASP Web: A05:2025

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1083 (Discovery)

NIST 800-53: SI-10, CM-6

PCI DSS 4: 6.2.4

MEDIUM FR-093 — HTTP Parameter Pollution

Description: HTTP Parameter Pollution (HPP) was detected. Supplying duplicate parameters causes inconsistent behavior in the application, potentially bypassing input validation, WAF rules, or access controls.

Remediation: Normalize HTTP parameter handling. Define explicit behavior for duplicate parameters. Validate parameters server-side after normalization.

OWASP Web: A03:2025

HIGH FR-094 — Information Disclosure: Javascript Secret

Description: Sensitive secrets (API keys, credentials, tokens, private keys) were found hardcoded in client-side JavaScript files. These secrets are visible to anyone who views the page source.

Remediation: Remove all hardcoded secrets from client-side JavaScript. Move sensitive keys to server-side configuration. Rotate any exposed secrets immediately. Implement secret scanning in the CI/CD pipeline.

OWASP Web: A02:2025

LOW FR-095 — Information Disclosure: Internal IP in JavaScript

Description: Internal IP addresses or hostnames were found referenced in client-side JavaScript. This reveals internal network topology and may aid in SSRF attacks.

Remediation: Remove internal IP addresses from client-side code. Use relative URLs or environment-specific configuration injection to avoid hardcoded internal references.

OWASP Web: A05:2025

MEDIUM FR-096 — Hidden Form Fields Disclose Sensitive Data

Description: Hidden HTML form fields contain sensitive data such as user IDs, prices, roles, or tokens that are not intended to be modified by the client but are submitted without server-side validation.

Remediation: Validate all form fields server-side regardless of whether they are hidden. Never rely on hidden fields for security-relevant data. Use server-side session state instead.

OWASP Web: A01:2025

MEDIUM FR-097 — Client-Side Redirect via open() or location

Description: JavaScript code uses window.location, window.open, or similar to redirect users based on URL parameters without validation. This may enable open redirect or DOM-based XSS attacks.

Remediation: Validate redirect destinations against a server-side whitelist. Avoid using unsanitized URL parameters in client-side redirects.

OWASP Web: A01:2025

LOW FR-098 — HTML Comment Discloses Sensitive Information

Description: HTML comments in the page source reveal sensitive information such as developer notes, TODO items, internal system names, credentials, or debug information.

Remediation: Remove all sensitive comments from HTML templates and responses before deployment. Implement a pre-deployment review process to catch information leakage.

OWASP Web: A05:2025

HIGH FR-099 — Path Traversal / Local File Inclusion

Description: Path traversal (directory traversal) was detected. An attacker can use sequences like ../../ in user-supplied file path parameters to read files outside the intended directory, such as /etc/passwd, application configuration, or source code.

Remediation: Validate all file path inputs against a strict whitelist. Use canonical path resolution and verify the resolved path starts with the allowed base directory. Avoid user-controlled file paths entirely where possible.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A01:2025

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1083 (Discovery), T1190 (Initial Access)

NIST 800-53: AC-3, SI-10

PCI DSS 4: 6.2.4

CISA KEV

CRITICAL FR-100 — Remote File Inclusion

Description: Remote File Inclusion (RFI) was detected. The application includes or requires files using a URL parameter that can be set to a remote URL, allowing an attacker to inject and execute remote PHP or server-side code.

Remediation: Disable allow_url_include in PHP configuration. Never pass user input to include(), require(), or equivalent file inclusion functions. Use a whitelist of allowed includes.

OWASP Web: A03:2025

CRITICAL FR-101 — Server-Side Request Forgery (SSRF)

Description: Server-Side Request Forgery (SSRF) was detected. The application fetches remote resources at a URL controlled by the attacker. This can be used to access internal services, cloud metadata endpoints (169.254.169.254), or exfiltrate data from internal networks.

Remediation: Validate and whitelist all URLs that the server is allowed to fetch. Block requests to private IP ranges, loopback addresses, and cloud metadata endpoints. Implement egress filtering at the network level.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

OWASP Web: A10:2025

OWASP API: API7:2023 – Server Side Request Forgery

MITRE ATT&CK: T1190 (Initial Access), T1552.005 (Credential Access)

NIST 800-53: SI-10, SC-7

PCI DSS 4: 6.2.4

CRITICAL FR-102 — SSRF via Cloud Metadata Endpoint Access

Description: SSRF was exploited to access the cloud provider's instance metadata service (AWS 169.254.169.254, GCP metadata.google.internal, Azure metadata endpoint). This can expose IAM credentials, instance configuration, and other sensitive metadata.

Remediation: Block access to 169.254.169.254 and all cloud metadata endpoints at the network level. Use IMDSv2 on AWS (which requires session tokens). Implement SSRF mitigation with URL allowlisting.

OWASP Web: A10:2025

HIGH FR-103 — SSRF via Internal Network Access

Description: SSRF was exploited to access internal network services (RFC 1918 address ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). The attacker can probe and interact with services not directly accessible from the internet.

Remediation: Implement a URL allowlist that explicitly blocks private IP ranges. Use network segmentation to prevent the web tier from accessing internal services unnecessarily.

OWASP Web: A10:2025

CRITICAL FR-104 — Broken Authentication — Default Credentials

Description: The application or an integrated component (CMS, framework, admin panel) uses default or well-known credentials (admin/admin, admin/password, etc.) that have not been changed.

Remediation: Change all default credentials immediately. Implement a policy requiring strong, unique credentials for all accounts. Enforce password complexity requirements.

OWASP Web: A07:2025

CRITICAL FR-105 — Authentication Bypass via SQL Injection

Description: The login form is vulnerable to SQL injection, allowing authentication bypass without valid credentials. Payloads such as ' OR '1'='1 successfully authenticate as arbitrary users.

Remediation: Use parameterized queries for all authentication-related SQL. Implement input validation on login forms. Review all authentication logic for injection vulnerabilities.

OWASP Web: A07:2025

CRITICAL FR-106 — Authentication Bypass via Response Manipulation

Description: Authentication can be bypassed by manipulating server responses (e.g., changing 'false' to 'true' in JSON responses, modifying HTTP status codes). The application relies on client-supplied success/failure signals instead of server-side session management.

Remediation: Implement server-side session management. Never rely on client-side responses to make authentication decisions. Validate authentication state server-side on every request.

OWASP Web: A07:2025

HIGH FR-107 — Authentication Bypass via Direct URL Access

Description: Authenticated pages or resources are accessible by directly navigating to their URLs without an active session. Authentication enforcement is missing on the server side for certain endpoints.

Remediation: Enforce authentication middleware on all routes that require authentication. Implement a centralized authentication check that applies to every request.

OWASP Web: A01:2025

HIGH FR-108 — Password Reset Token Weak or Predictable

Description: Password reset tokens are short, sequential, or based on predictable data (timestamp, username hash, MD5). An attacker can enumerate or brute-force valid reset tokens to take over accounts.

Remediation: Generate password reset tokens using a cryptographically secure random number generator with at least 128 bits of entropy. Enforce token expiration and single-use consumption.

OWASP Web: A07:2025

CRITICAL FR-109 — Sensitive File Exposed — /etc/passwd

Description: The /etc/passwd file is accessible via path traversal or misconfiguration. This file contains system user account information and can aid privilege escalation and targeted attacks.

Remediation: Fix the path traversal or misconfiguration that exposes this file. Restrict filesystem permissions and ensure the web server process cannot read sensitive system files.

OWASP Web: A01:2025

CRITICAL FR-110 — Information Disclosure: .env File

Description: The .env environment configuration file is publicly accessible. This file typically contains database credentials, API keys, secret keys, and other application secrets.

Remediation: Immediately move .env files outside the web root. Block access to .env files via web server configuration. Rotate all exposed credentials.

OWASP Web: A05:2025

CRITICAL FR-111 — Sensitive File Exposed — Private Key

Description: A private cryptographic key file (.pem, .key, .p12, .pfx) was found accessible on the web server. Exposure of private keys compromises the entire PKI trust chain and enables impersonation.

Remediation: Remove all private key files from the web root immediately. Revoke and reissue the associated certificates. Store private keys outside the web root with strict filesystem permissions.

OWASP Web: A02:2025

MEDIUM FR-112 — Sensitive File Exposed — phpinfo()

Description: A phpinfo() page is publicly accessible. This page reveals PHP version, loaded modules, configuration settings, environment variables, file system paths, and potentially sensitive server configuration.

Remediation: Remove all phpinfo() calls from production code. Block access to any phpinfo scripts via web server configuration.

OWASP Web: A05:2025

LOW FR-113 — Sensitive File Exposed — Composer/NPM Metadata

Description: Package metadata files (composer.json, package.json, package-lock.json, composer.lock) are publicly accessible. These reveal application dependencies and versions, aiding in CVE identification.

Remediation: Block access to package metadata files via web server configuration. Move these files outside the web root or deny access to them.

OWASP Web: A05:2025

HIGH FR-114 — Vulnerability Scanner Finding — Known CVE

Description: A vulnerability scanner (Nuclei) identified a known CVE in a component used by the application. The component version matches a published vulnerability with a known proof-of-concept or exploit.

Remediation: Update the vulnerable component to the patched version. Apply vendor security patches. Implement a patch management process with regular CVE monitoring.

OWASP Web: A06:2025

HIGH FR-115 — Vulnerability Scanner Finding — Exposed Panel

Description: A Nuclei scan identified an exposed administrative or monitoring panel (e.g., Grafana, Kibana, Consul, Prometheus, Jenkins) without authentication or with default credentials.

Remediation: Restrict access to all administrative panels by IP whitelist or VPN. Enforce authentication and disable default credentials. Move panels off public-facing infrastructure.

OWASP Web: A05:2025

MEDIUM FR-116 — Vulnerability Scanner Finding — Misconfiguration

Description: A Nuclei scan identified a security misconfiguration in the application or server. Common examples include debug endpoints enabled, HTTP methods unrestricted, or CORS policies allowing arbitrary origins.

Remediation: Review and remediate the specific misconfiguration identified. Implement a security hardening baseline and apply it consistently across all servers.

OWASP Web: A05:2025

MEDIUM FR-117 — GraphQL Introspection Enabled

Description: GraphQL introspection is enabled in the production environment. Introspection allows any client to retrieve the full schema including all types, queries, mutations, and field definitions, providing a complete attack surface map.

Remediation: Disable GraphQL introspection in production environments. If introspection is required, restrict it to authenticated and authorized users.

OWASP Web: A05:2025

HIGH FR-118 — GraphQL Batch Query Attack

Description: The GraphQL endpoint accepts batched queries, allowing multiple queries to be sent in a single HTTP request. This can be abused to bypass rate limiting and perform brute-force or enumeration attacks at scale.

Remediation: Implement query batching limits. Enforce per-query rate limiting that accounts for batched requests. Consider disabling batch query support if not required.

OWASP Web: A04:2025

HIGH FR-119 — GraphQL Deeply Nested Query (DoS)

Description: The GraphQL endpoint does not enforce query depth limits. An attacker can craft deeply nested queries that cause exponential resource consumption, leading to denial of service.

Remediation: Implement query depth limiting (e.g., max depth of 5-10 levels). Add query complexity analysis and reject queries above a complexity threshold.

OWASP Web: A04:2025

LOW FR-120 — GraphQL Field Suggestion Enabled

Description: The GraphQL server returns 'Did you mean X?' suggestions when querying non-existent fields. This allows schema enumeration even when introspection is disabled.

Remediation: Disable field suggestions in the GraphQL server configuration. In Apollo Server, set the 'debug' option to false.

OWASP Web: A05:2025

MEDIUM FR-121 — Insufficient Logging and Monitoring

Description: The application fails to generate adequate log entries for security-relevant events such as failed logins, access control failures, or input validation errors. Without sufficient logging, attacks may go undetected.

Remediation: Implement comprehensive security logging for all authentication events, access control failures, and input validation errors. Forward logs to a centralized SIEM. Set up alerts for anomalous patterns.

OWASP Web: A09:2025

MEDIUM FR-122 — Verbose Error Messages Logged to Client

Description: The application returns verbose error messages including stack traces, file paths, or internal state to the client. This information aids attackers in understanding the application's internals.

Remediation: Configure custom error pages in production. Log detailed errors server-side only. Never expose stack traces, framework-specific error messages, or internal paths to users.

OWASP Web: A09:2025

HIGH FR-123 — No Account Lockout Mechanism

Description: The login endpoint does not implement account lockout or rate limiting after repeated failed authentication attempts. An attacker can conduct unlimited brute-force or credential stuffing attacks.

Remediation: Implement account lockout (temporary lock after N failed attempts) or progressive delays. Add CAPTCHA after a threshold of failures. Monitor for credential stuffing patterns.

OWASP Web: A07:2025

MEDIUM FR-124 — Username Enumeration via Login Response

Description: The login form returns different error messages for invalid usernames versus invalid passwords ('User not found' vs 'Incorrect password'). This allows enumeration of valid usernames.

Remediation: Return a generic error message ('Invalid username or password') regardless of whether the username or password is incorrect. Apply consistent response timing to prevent timing-based enumeration.

OWASP Web: A07:2025

MEDIUM FR-125 — Username Enumeration via Password Reset

Description: The password reset form reveals whether a submitted email or username exists in the system through different response messages or behaviors. This enables username/email enumeration.

Remediation: Always return the same response message for both registered and unregistered users ('If an account exists, a reset email has been sent'). Avoid timing differences that could leak account existence.

OWASP Web: A07:2025

MEDIUM FR-126 — Username Enumeration via Registration

Description: The user registration form discloses whether a username or email is already registered, enabling enumeration of valid accounts.

Remediation: Implement email-based registration confirmation to avoid exposing account existence. Use consistent responses that do not distinguish between registered and unregistered identifiers.

OWASP Web: A07:2025

MEDIUM FR-127 — Weak Password Policy

Description: The application accepts passwords that are too short or lack complexity requirements. Weak passwords are trivially compromised through brute-force or dictionary attacks.

Remediation: Enforce a minimum password length of 12 characters. Check passwords against known breached password lists (e.g., HaveIBeenPwned API). Consider implementing NIST SP 800-63B password guidance.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2025

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1110.001 (Credential Access)

NIST 800-53: IA-5

PCI DSS 4: 8.3.6

MEDIUM FR-128 — Multi-Factor Authentication Not Enforced

Description: Multi-factor authentication (MFA) is not available or not enforced for privileged accounts. Single-factor authentication is vulnerable to credential theft, phishing, and brute-force attacks.

Remediation: Implement and enforce MFA for all user accounts, especially administrative and privileged accounts. Use TOTP, hardware tokens, or push-based MFA.

OWASP Web: A07:2025

HIGH FR-129 — Insecure Direct Object Reference (IDOR)

Description: Insecure Direct Object Reference (IDOR) was detected. Direct references to internal objects (user IDs, record IDs, file names) are exposed in URLs or parameters without authorization checks, allowing access to other users' data by modifying the reference.

Remediation: Implement server-side authorization checks on every object access. Use indirect references (GUIDs, hashed IDs) instead of sequential integer IDs. Validate object ownership on every request.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2025

OWASP API: API1:2023 – Broken Object Level Authorization

MITRE ATT&CK: T1078 (Defense Evasion)

NIST 800-53: AC-3, AC-4

PCI DSS 4: 6.2.4, 7.2.1

HIGH FR-130 — Horizontal Privilege Escalation

Description: Horizontal privilege escalation was detected. An authenticated user can access or modify another user's resources by manipulating user-specific identifiers in requests, without authorization validation.

Remediation: Enforce server-side ownership checks for all user-specific resources. Validate that the requesting user owns or has explicit permission to access the target resource.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2025

OWASP API: API1:2023 – Broken Object Level Authorization

MITRE ATT&CK: T1078 (Defense Evasion)

NIST 800-53: AC-3, AC-4

PCI DSS 4: 7.2.1

CRITICAL FR-131 — Vertical Privilege Escalation

Description: Vertical privilege escalation was detected. A lower-privileged user can access administrative functionality or higher-privileged resources by directly accessing restricted endpoints or modifying role/permission parameters.

Remediation: Implement role-based access control (RBAC) enforced server-side. Never rely on client-supplied role or privilege parameters. Centralize authorization logic and apply it to every request.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

OWASP Web: A01:2025

OWASP API: API5:2023 – Broken Function Level Authorization

MITRE ATT&CK: T1068 (Privilege Escalation)

NIST 800-53: AC-6, AC-3

PCI DSS 4: 7.2.1

HIGH FR-132 — Missing Function-Level Access Control

Description: Application functions (APIs, admin actions) are protected only by hiding them from the UI but lack server-side access control enforcement. An attacker who discovers the endpoint URL can invoke restricted functionality.

Remediation: Implement server-side access control checks on every sensitive function endpoint. Security by obscurity (hiding URLs) is not a substitute for proper access control.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2025

OWASP API: API5:2023 – Broken Function Level Authorization

MITRE ATT&CK: T1078 (Privilege Escalation), T1068 (Privilege Escalation)

NIST 800-53: AC-3, AC-6

PCI DSS 4: 7.2.1

HIGH FR-133 — Session Fixation

Description: Session fixation was detected. The application does not generate a new session ID after successful authentication. An attacker who can set a victim's session ID can hijack the session after the victim authenticates.

Remediation: Generate a new session ID upon successful authentication. Invalidate pre-authentication session IDs. Never accept session IDs provided in URLs.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

OWASP Web: A07:2025

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1563 (Lateral Movement), T1550.004 (Defense Evasion)

NIST 800-53: AC-12, IA-5

PCI DSS 4: 8.3.6

HIGH FR-134 — Session Token in URL

Description: Session tokens are transmitted in URL query parameters. Session tokens in URLs are exposed in browser history, referrer headers, server logs, and proxy logs, significantly increasing the risk of session hijacking.

Remediation: Transmit session tokens only via HttpOnly, Secure cookies. Never include session tokens in URLs or query parameters.

OWASP Web: A07:2025

MEDIUM FR-135 — Long-Lived Session Without Expiration

Description: Session tokens remain valid indefinitely or for excessively long periods. Long-lived sessions increase the window of opportunity for session hijacking after token theft.

Remediation: Implement server-side session expiration. Set absolute session timeouts (e.g., 8 hours) and idle timeouts (e.g., 30 minutes). Require re-authentication for sensitive actions.

OWASP Web: A07:2025

HIGH FR-136 — Session Not Invalidated on Logout

Description: Session tokens remain valid on the server after the user logs out. An attacker who captures a session token before logout can reuse it indefinitely.

Remediation: Invalidate session tokens server-side upon logout. Ensure the session store removes or expires the session record. Do not rely solely on clearing the client-side cookie.

OWASP Web: A07:2025

HIGH FR-137 — Cross-Site Request Forgery (CSRF)

Description: Cross-Site Request Forgery (CSRF) was detected. State-changing requests lack CSRF tokens or other anti-CSRF mechanisms. An attacker can craft a malicious page that triggers state-changing actions in the victim's authenticated session.

Remediation: Implement CSRF tokens (synchronizer token pattern or double-submit cookie). Use SameSite=Strict or SameSite=Lax cookies. Validate the Origin/Referer header for state-changing requests.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

OWASP Web: A01:2025

MITRE ATT&CK: T1189 (Initial Access)

NIST 800-53: SI-10, SC-8

PCI DSS 4: 6.2.4

HIGH FR-138 — CSRF Token Not Validated Server-Side

Description: The application includes CSRF tokens in forms but does not validate them server-side, or accepts any non-empty value as valid. The CSRF protection mechanism is present but ineffective.

Remediation: Validate CSRF tokens server-side on every state-changing request. Reject requests with missing, empty, or invalid CSRF tokens. Ensure tokens are unpredictable and bound to the user session.

OWASP Web: A01:2025

HIGH FR-139 — Cross-User Data Leakage

Description: Data belonging to one user is visible to another user due to insufficient isolation in shared resources, caches, or multi-tenant data stores. This is a class of broken access control.

Remediation: Implement strict data isolation per user/tenant. Audit all data access paths for ownership validation. Review caching configurations to prevent cross-user cache poisoning.

OWASP Web: A01:2025

MEDIUM FR-140 — Open Redirect

Description: An open redirect vulnerability was detected. The application redirects users to a URL specified in a request parameter without validation. Attackers can craft URLs that redirect victims to malicious sites, facilitating phishing.

Remediation: Validate redirect destinations against a strict whitelist of allowed URLs or origins. Avoid user-controlled redirect targets entirely. Use relative redirects where possible.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP Web: A01:2025

MITRE ATT&CK: T1566.002 (Initial Access)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

CRITICAL FR-141 — Insecure Deserialization

Description: Insecure deserialization was detected. The application deserializes user-supplied data (via pickle, Java ObjectInputStream, PHP unserialize, YAML.load, etc.) without integrity verification. This can lead to remote code execution, authentication bypass, or denial of service.

Remediation: Do not deserialize data from untrusted sources. Sign serialized objects with an HMAC and verify the signature before deserialization. Use safe serialization formats (JSON) instead of language-native object serialization.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A08:2025

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-10, SA-11

PCI DSS 4: 6.2.4

CRITICAL FR-142 — Java Deserialization via Gadget Chains

Description: Java object deserialization was identified with known gadget chain exploitability. Exploitation of known gadget chains (Commons Collections, Spring, etc.) via ysoserial payloads can result in remote code execution.

Remediation: Upgrade all Java serialization libraries to patched versions. Implement a serialization filter (JEP 290). Use Contrast Security or similar RASP to detect deserialization attacks at runtime.

OWASP Web: A08:2025

CRITICAL FR-143 — PHP Object Injection via unserialize()

Description: PHP's unserialize() function is called on user-controlled input. If the application's autoloaded classes contain exploitable magic methods (__wakeup, __destruct, __toString), this can lead to arbitrary code execution via POP chains.

Remediation: Never call unserialize() on user-supplied input. Replace with JSON or other data formats. If unavoidable, use allowed_classes parameter to restrict which classes can be instantiated.

OWASP Web: A08:2025

CRITICAL FR-144 — Unrestricted File Upload — Executable File

Description: The file upload functionality allows uploading of executable files (PHP, JSP, ASP, Python, etc.) without restriction. An attacker can upload a web shell and execute arbitrary commands on the server.

Remediation: Implement a strict file extension whitelist for uploads. Validate file content using magic bytes, not just extension. Store uploaded files outside the web root. Rename all uploaded files to remove their original extension.

OWASP Web: A04:2025

HIGH FR-145 — Unrestricted File Upload — MIME Type Bypass

Description: The file upload validation relies solely on the Content-Type header or file extension, which can be manipulated by an attacker. Malicious file content can be uploaded while disguising it as a permitted MIME type.

Remediation: Validate files using server-side magic byte analysis (file signature), not MIME type headers or extensions supplied by the client. Use a library such as python-magic or libmagic.

OWASP Web: A04:2025

HIGH FR-146 — File Upload — Path Traversal in Filename

Description: The file upload functionality uses the client-supplied filename in the server-side file path without sanitization. An attacker can supply a filename with path traversal sequences to write files to arbitrary server locations.

Remediation: Never use client-supplied filenames for server-side storage. Generate a random server-side filename for every uploaded file. Strip all path components from the original filename.

OWASP Web: A04:2025

HIGH FR-147 — Mass Assignment Vulnerability

Description: Mass assignment (also known as auto-binding) was detected. The application binds HTTP request parameters directly to internal model attributes without filtering. An attacker can set privileged attributes (isAdmin, role, balance) by adding them to the request body.

Remediation: Implement an explicit allowlist of fields that can be mass-assigned from user input. Use Data Transfer Objects (DTOs) or explicit field binding rather than mapping all request parameters to model attributes.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A04:2025

OWASP API: API6:2023 – Unrestricted Access to Sensitive Business Flows

MITRE ATT&CK: T1078 (Privilege Escalation)

NIST 800-53: AC-3, SI-10

PCI DSS 4: 6.2.4

CRITICAL FR-148 — Mass Assignment — Privilege Escalation via Role Field

Description: Mass assignment was exploited to modify a privileged field such as 'isAdmin', 'role', or 'permission_level' by including it in a user-controlled request body. This allows privilege escalation to administrator or higher-privileged roles.

Remediation: Block mass assignment of privilege-related fields. Explicitly whitelist only user-modifiable fields. Validate and enforce role changes through dedicated privileged endpoints.

OWASP Web: A04:2025

HIGH FR-149 — Broken Object-Level Authorization (BOLA) in API

Description: API endpoints expose object-level access without authorization validation. An authenticated user can access or modify another user's objects by substituting object IDs in API requests (equivalent to IDOR in APIs).

Remediation: Implement authorization checks at the object level for every API endpoint. Validate that the authenticated user has permission to access the specific object referenced in the request.

OWASP Web: A01:2025

HIGH FR-150 — Broken Function-Level Authorization (BFLA) in API

Description: API endpoints with administrative or privileged functionality are accessible to lower-privileged or unauthenticated users. Function-level access control is not enforced by the API.

Remediation: Enforce role-based access control at the function/endpoint level. Apply authorization middleware to every API route that requires privilege. Perform authorization checks server-side on every request.

OWASP Web: A01:2025

MEDIUM FR-151 — HTTP Method Override Accepted

Description: The application accepts HTTP method override headers (X-HTTP-Method-Override, X-Method-Override) that substitute the actual HTTP method with a client-specified one. This may bypass access controls that rely on HTTP method restrictions.

Remediation: Disable HTTP method override support unless explicitly required. If required, restrict method overrides to authenticated users and validate that the overridden method is appropriate for the endpoint.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

OWASP Web: A01:2025

OWASP API: API8:2023 – Security Misconfiguration

NIST 800-53: CM-6, CM-7

PCI DSS 4: 6.2.4

HIGH FR-152 — CORS Misconfiguration — Arbitrary Origin Reflected

Description: The server reflects the request's Origin header in the Access-Control-Allow-Origin response header and includes Access-Control-Allow-Credentials: true. This allows any origin to make credentialed cross-origin requests and read responses, bypassing the Same-Origin Policy.

Remediation: Maintain an explicit whitelist of allowed origins. Never reflect the request Origin blindly. Do not combine Access-Control-Allow-Credentials: true with dynamic origin reflection or wildcard origins.

OWASP Web: A01:2025

HIGH FR-153 — CORS Misconfiguration — Null Origin Allowed

Description: The server includes 'Access-Control-Allow-Origin: null' in its response. This allows sandboxed iframes, redirects, and local file requests to make credentialed cross-origin requests to the API.

Remediation: Remove 'null' from the allowed origins list. Use an explicit origin whitelist instead.

OWASP Web: A01:2025

HIGH FR-154 — Business Logic Flaw — Negative Value Accepted

Description: The application accepts negative numeric values in business-critical fields (quantity, price, payment amount). This can be exploited to inflate balances, receive credit for purchases, or bypass monetary validation.

Remediation: Validate that all numeric inputs are within expected positive ranges. Apply server-side bounds checking for all quantity, price, and amount fields.

OWASP Web: A04:2025

HIGH FR-155 — Business Logic Flaw — Price Manipulation

Description: The application trusts client-submitted pricing data without server-side verification. An attacker can manipulate price parameters to purchase items at an arbitrary price.

Remediation: Never trust client-submitted prices. Fetch prices from the server-side data store using product IDs and compute totals server-side. Treat price as a read-only server-computed field.

OWASP Web: A04:2025

MEDIUM FR-156 — Business Logic Flaw — Coupon/Discount Abuse

Description: Coupon or discount codes can be applied multiple times per order, stacked beyond intended limits, or applied to ineligible items. Insufficient validation allows financial loss through discount abuse.

Remediation: Enforce server-side usage limits per coupon and per user. Validate coupon applicability rules on the server. Implement transactional locks to prevent race condition exploitation.

OWASP Web: A04:2025

HIGH FR-157 — Business Logic Flaw — Workflow Step Bypass

Description: Multi-step workflows (checkout, verification, approval) can be bypassed by directly accessing later steps without completing earlier steps. Server-side workflow state is not enforced.

Remediation: Track workflow state server-side and enforce step ordering. Verify prerequisites are complete before allowing advancement to subsequent steps.

OWASP Web: A04:2025

HIGH FR-158 — Business Logic Flaw — Race Condition

Description: A race condition was detected in a critical business operation (e.g., balance check-then-debit, coupon redemption, token verification). Concurrent requests can cause the operation to be performed multiple times before state is updated.

Remediation: Implement database-level row locking or optimistic concurrency control for critical operations. Use atomic transactions. Implement idempotency keys to prevent duplicate processing.

OWASP Web: A04:2025

MEDIUM FR-159 — Rate Limiting Not Enforced on Sensitive Endpoint

Description: No rate limiting is applied to sensitive endpoints such as OTP verification, coupon redemption, password reset, or API calls. Attackers can make unlimited requests to brute-force codes or automate abuse.

Remediation: Implement per-IP and per-user rate limiting on all sensitive endpoints. Use exponential backoff or CAPTCHA challenges after threshold violations.

OWASP Web: A04:2025

HIGH FR-160 — Insecure Direct Object Reference in File Download

Description: File download endpoints use user-supplied filenames or IDs to retrieve files without ownership validation or path sanitization. Users can download files belonging to other users or access arbitrary files on the filesystem.

Remediation: Validate file ownership on every download request. Use indirect file references (GUIDs) instead of filesystem paths. Sanitize filenames and resolve canonical paths before access.

OWASP Web: A01:2025

INFO FR-161 — Screenshot Captured — Web Application Surface

Description: A screenshot of the target web application was captured. This records the visual surface of the application for documentation and change tracking purposes.

Remediation: No remediation required. Informational finding for documentation purposes.

OWASP Web: A05:2025

INFO FR-162 — FFUF Directory/File Discovered

Description: Content discovery via ffuf identified a directory or file not linked from the main application. Hidden paths may contain sensitive functionality, backups, or configuration files.

Remediation: Review discovered paths and apply appropriate access controls. Remove any paths that expose sensitive content or unused functionality.

OWASP Web: A05:2025

HIGH FR-163 — FFUF — Administrative Path Discovered

Description: ffuf content discovery identified an administrative interface or control panel at a predictable path. Administrative paths accessible without authentication represent a critical security risk.

Remediation: Restrict access to administrative paths by IP whitelist, VPN, or network segmentation. Enforce strong authentication on all administrative endpoints.

OWASP Web: A05:2025

LOW FR-164 — shcheck — Missing Security Header

Description: Security header analysis via shcheck identified one or more missing or misconfigured HTTP security headers. Missing security headers increase exposure to common browser-based attacks.

Remediation: Implement the missing security headers identified by shcheck. Refer to the OWASP Secure Headers Project for recommended header values and configurations.

OWASP Web: A05:2025

INFO FR-165 — Crawl — Undocumented Endpoint Discovered

Description: Application crawling discovered an endpoint not listed in sitemap.xml, robots.txt, or API documentation. Undocumented endpoints may contain legacy, debug, or unprotected functionality.

Remediation: Review all discovered endpoints and ensure they are properly secured and documented. Remove or disable any endpoints that are no longer required.

OWASP Web: A05:2025

INFO FR-166 — Crawl — External Domain Reference Found

Description: The application references external domains for resources (CDNs, third-party scripts, fonts). External dependencies introduce supply chain risk if those domains are compromised or the resources are modified.

Remediation: Audit all external resource dependencies. Use Subresource Integrity (SRI) hashes for external scripts and stylesheets. Consider self-hosting critical dependencies.

OWASP Web: A06:2025

INFO FR-167 — TLS Certificate Transparency Log Entry

Description: Certificate Transparency logs reveal all certificates issued for the target domain and its subdomains. This information exposes the full scope of the application's TLS-protected surface.

Impact: Certificate Transparency logs reveal all certificates ever issued for the domain, exposing subdomain naming patterns, internal service names, and historical infrastructure that may still be accessible.

Remediation: Informational. Review discovered subdomains for security implications. Ensure all discovered subdomains are accounted for and secured.

OWASP Web: A05:2025

MEDIUM FR-168 — Authentication — Concurrent Session Not Restricted

Description: The application allows unlimited concurrent sessions for a single user account. This makes it impossible to detect or prevent session sharing or account compromise based on active session count.

Remediation: Implement concurrent session controls with configurable limits. Notify users of new sessions and provide session management (view and terminate active sessions).

OWASP Web: A07:2025

MEDIUM FR-169 — HTTP Methods: Unsafe Methods Enabled

Description: The web server responds to dangerous HTTP methods including PUT (file upload), DELETE (file deletion), or TRACE (XST — Cross-Site Tracing). These methods may enable unauthorized modification of server content or session token theft.

Remediation: Disable unused HTTP methods at the web server level. Explicitly allow only the HTTP methods required by the application. Disable TRACE globally.

OWASP Web: A05:2025

MEDIUM FR-170 — Clickjacking Vulnerability

Description: The application does not implement anti-clickjacking protections (X-Frame-Options or CSP frame-ancestors). The page can be embedded in an attacker-controlled iframe to trick users into performing unintended actions.

Remediation: Add 'X-Frame-Options: DENY' or 'Content-Security-Policy: frame-ancestors none' to all application responses. Use the CSP frame-ancestors directive for more granular control.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

OWASP Web: A05:2025

NIST 800-53: SC-18, CM-6

PCI DSS 4: 6.2.4

HIGH FR-171 — Sensitive Data Exposure — PII in Response

Description: API responses or page content expose personally identifiable information (PII) such as email addresses, phone numbers, SSNs, or financial data that should not be visible to the requesting user or at all.

Remediation: Implement response filtering to include only fields necessary for the requesting user's context. Apply data minimization principles. Ensure sensitive fields are encrypted at rest and masked in API responses.

OWASP Web: A02:2025

CRITICAL FR-172 — Insecure Password Storage (Cleartext or Weak Hash)

Description: Evidence suggests passwords are stored in cleartext, as reversible encryption, or using a weak unsalted hash algorithm (MD5, SHA-1). Password compromise leads to immediate credential exposure.

Remediation: Store passwords using a modern adaptive hashing algorithm (bcrypt, Argon2id, or scrypt) with an appropriate cost factor. Never store passwords in cleartext or using reversible encryption.

OWASP Web: A02:2025

HIGH FR-173 — Subdomain Takeover — S3 Bucket Not Found

Description: A subdomain's DNS CNAME points to an AWS S3 bucket that returns a NoSuchBucket error. An attacker can create an S3 bucket with the matching name and serve content from the trusted subdomain.

Remediation: Delete the dangling CNAME record or create and properly configure the S3 bucket. Implement S3 bucket name reservation for subdomains.

OWASP Web: A05:2025

HIGH FR-174 — Subdomain Takeover — GitHub Pages

Description: A subdomain's DNS CNAME points to a GitHub Pages site that no longer exists or is unclaimed. An attacker can create a matching GitHub repository with Pages enabled to take over the subdomain.

Remediation: Remove the dangling CNAME record. If GitHub Pages are still required, recreate the repository and verify the custom domain configuration.

OWASP Web: A05:2025

HIGH FR-175 — Subdomain Takeover — Heroku

Description: A subdomain's DNS CNAME points to a Heroku application that has been deleted or is unclaimed. An attacker can provision a new Heroku app with the matching domain to take over the subdomain.

Remediation: Remove the dangling DNS record. If the Heroku app is still required, redeploy it and verify the custom domain binding.

OWASP Web: A05:2025

HIGH FR-176 — Prototype Pollution in JavaScript

Description: Prototype pollution was detected. User-controlled JSON or query parameter keys such as __proto__, constructor, or prototype are merged into application objects, potentially polluting the JavaScript prototype chain and affecting all objects.

Remediation: Sanitize keys before merging user-supplied objects. Use Object.create(null) for dictionaries. Validate that __proto__ and constructor keys are rejected in user input.

OWASP Web: A03:2025

CRITICAL FR-177 — HTTP Request Smuggling

Description: HTTP request smuggling was detected due to inconsistent interpretation of Content-Length and Transfer-Encoding headers between the front-end proxy and back-end server. This can enable cache poisoning, request hijacking, or security control bypass.

Remediation: Ensure consistent HTTP parsing between all front-end and back-end components. Normalize ambiguous Transfer-Encoding headers at the edge. Upgrade to HTTP/2 where possible.

OWASP Web: A05:2025

HIGH FR-178 — Web Cache Poisoning

Description: Web cache poisoning was detected. The caching layer reflects unkeyed request headers (X-Forwarded-Host, X-Original-URL) into cached responses. An attacker can poison the cache to serve malicious content to all users.

Remediation: Review cache key configuration to include all headers that influence response content. Validate and sanitize headers before reflecting them in responses.

OWASP Web: A03:2025

HIGH FR-179 — GraphQL Authorization Bypass

Description: GraphQL queries can access data from unauthorized objects or users by bypassing field-level authorization. Inline fragment spreading or alias tricks may circumvent per-field permission checks.

Remediation: Implement field-level authorization checks using a library such as graphql-shield. Apply authorization at the resolver level, not just the query level.

OWASP Web: A01:2025

LOW FR-180 — Information Disclosure: Internal Path in Response

Description: Internal filesystem paths (e.g., /var/www/html/, C:\inetpub\wwwroot\) are disclosed in HTTP responses, error pages, or HTTP headers. These paths aid attackers in fingerprinting the server environment.

Remediation: Configure custom error pages. Remove all internal path references from HTTP responses. Review template and error handling code for inadvertent path disclosure.

OWASP Web: A05:2025

HIGH FR-181 — Access Matrix — Unauthenticated Access to Authenticated Endpoint

Description: An endpoint designated as requiring authentication is accessible without any session token or authentication credentials. Authentication enforcement is missing for this route.

Remediation: Implement authentication middleware that applies to all routes requiring login. Use a deny-by-default access control policy where routes must be explicitly marked as public.

OWASP Web: A01:2025

HIGH FR-182 — Access Matrix — Lower-Role Access to Higher-Role Endpoint

Description: An endpoint restricted to a higher-privileged role (admin, manager) is accessible by a lower-privileged authenticated user. Role-based access control enforcement is missing or inadequate for this endpoint.

Remediation: Enforce role-based authorization on all privileged endpoints. Validate the user's role server-side on every request. Implement centralized authorization that cannot be bypassed.

OWASP Web: A01:2025

HIGH FR-183 — Access Matrix — User A Can Read User B Data

Description: Authenticated user A can read data owned by user B by manipulating object identifiers in API requests. Object-level authorization is not enforced for read operations.

Remediation: Validate object ownership on every read operation. Implement server-side checks that confirm the requesting user is authorized to view the specific object.

OWASP Web: A01:2025

CRITICAL FR-184 — Access Matrix — User A Can Modify User B Data

Description: Authenticated user A can modify or delete data owned by user B by manipulating object identifiers in API requests. Object-level authorization is not enforced for write operations.

Remediation: Validate object ownership on every write and delete operation. Require explicit ownership or permission grants before allowing modifications to another user's data.

OWASP Web: A01:2025

CRITICAL FR-185 — Access Matrix — Admin Functionality Accessible by Regular User

Description: Administrative functions (user management, system configuration, data export) are accessible to regular authenticated users without elevated privileges. The access control matrix has gaps in administrative endpoint protection.

Remediation: Implement strict role-based access control with a separate administrative role. Enforce role checks at the API handler level for all administrative operations.

OWASP Web: A01:2025

MEDIUM FR-186 — HTTP Security Header — X-Frame-Options Incorrectly Configured

Description: The X-Frame-Options header is present but misconfigured (e.g., set to ALLOWALL or using an invalid value). An incorrect configuration may still allow the page to be framed, enabling clickjacking attacks.

Remediation: Set X-Frame-Options to 'DENY' or 'SAMEORIGIN'. Validate the header value is correctly parsed by target browsers.

OWASP Web: A05:2025

MEDIUM FR-187 — Content-Security-Policy — Unsafe-Eval Allowed

Description: The Content-Security-Policy header contains 'unsafe-eval', which allows the use of eval(), setTimeout(), setInterval() with string arguments, and new Function(). This significantly weakens XSS protections.

Remediation: Remove 'unsafe-eval' from the CSP. Refactor code that relies on eval() to use safer alternatives. Review all dynamic code execution patterns.

OWASP Web: A05:2025

MEDIUM FR-188 — SSL/TLS Forward Secrecy: Not Supported

Description: The server does not support cipher suites that provide Perfect Forward Secrecy (PFS). Without PFS, a compromise of the server's private key allows decryption of all previously captured TLS sessions.

Remediation: Enable ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) cipher suites. Disable static RSA key exchange. Prefer ECDHE-RSA or ECDHE-ECDSA cipher suites.

OWASP Web: A02:2025

LOW FR-189 — TLS OCSP Stapling Not Configured

Description: OCSP stapling is not configured on the server. Without stapling, clients must query the OCSP responder directly to check certificate revocation status, introducing latency and potential privacy leakage.

Remediation: Enable OCSP stapling in the web server configuration (ssl_stapling on in Nginx; SSLUseStapling on in Apache). Include the OCSP stapling cache configuration.

OWASP Web: A02:2025

CRITICAL FR-190 — GraphQL SQL Injection via Argument

Description: SQL injection was detected via GraphQL query arguments. Unsanitized argument values are passed to underlying database queries without parameterization.

Remediation: Use parameterized queries or ORM methods in all GraphQL resolvers. Sanitize and validate all argument values. Apply input type constraints at the GraphQL schema level.

OWASP Web: A03:2025

MEDIUM FR-191 — Sensitive Data in GET Request Parameters

Description: Sensitive data (passwords, session tokens, personal information) is transmitted in GET request query parameters. GET parameters are logged in server logs, browser history, and Referer headers, exposing sensitive values.

Remediation: Transmit sensitive data via POST request bodies over HTTPS. Never include credentials, session tokens, or sensitive identifiers in URL query parameters.

OWASP Web: A02:2025

MEDIUM FR-192 — Missing Rate Limiting on Password Reset

Description: The password reset endpoint does not enforce rate limiting. An attacker can repeatedly request password resets for target accounts, potentially triggering email flooding or token enumeration.

Remediation: Implement rate limiting on the password reset endpoint (per IP and per account). Add CAPTCHA after a threshold of requests.

OWASP Web: A07:2025

MEDIUM FR-193 — Insecure Redirect After Authentication

Description: The post-authentication redirect URL is controlled by a user-supplied parameter (e.g., next=, redirect=, returnUrl=) without validation. An attacker can craft a phishing URL that redirects users to a malicious site after successful login.

Remediation: Validate post-login redirect URLs against a whitelist. Use relative paths for redirects. Never redirect to externally supplied URLs without validation.

OWASP Web: A01:2025

INFO FR-194 — Lack of Security.txt File

Description: The application does not have a security.txt file at /.well-known/security.txt. The security.txt standard (RFC 9116) allows security researchers to identify and report vulnerabilities responsibly.

Remediation: Create a security.txt file at /.well-known/security.txt specifying contact information, disclosure policy, and PGP keys for secure communications.

OWASP Web: A05:2025

HIGH FR-195 — HTTP/2 Rapid Reset Attack Exposure

Description: The server supports HTTP/2 and may be vulnerable to the HTTP/2 Rapid Reset attack (CVE-2023-44487). An attacker can open and cancel streams at high speed to cause resource exhaustion and denial of service.

Remediation: Apply patches from the web server vendor for CVE-2023-44487. Implement HTTP/2 stream limits and reset rate limiting. Update to a patched version of the HTTP/2 implementation.

OWASP Web: A04:2025

INFO FR-196 — CDN Active

Description: A Content Delivery Network (CDN) was identified in front of the target via response headers or Server fingerprinting. TLS findings reflect the CDN edge configuration. Cache poisoning may be in scope. Header values and security posture may differ at the origin server.

Impact: Active CDN detection reveals the content delivery and security infrastructure protecting the application. An attacker uses this to identify CDN-specific bypass techniques, origin server discovery methods, and CDN configuration weaknesses.

Remediation: Restrict origin server to accept connections only from CDN IP ranges. Ensure security headers are set at the origin. Review CDN cache key configuration to prevent web cache poisoning.

OWASP Web: A05:2025

INFO FR-197 — WAF / Edge Security Platform Active

Description: A WAF or edge security platform was identified in front of the target via response headers or body signatures. WAF rules may suppress injection probes — absence of a finding does not confirm absence of the vulnerability. Bot-protection may interrupt automated probes.

Remediation: Keep WAF rule sets up to date covering OWASP Top 10 2025. Do not rely solely on WAF protection — fix underlying vulnerabilities. Review WAF bypass techniques relevant to the identified platform.

OWASP Web: A05:2025

HIGH FR-198 — WAF/CDN IP Block Detected

Description: The WAF or CDN is blocking all requests from the scanner's IP address. All subsequent results from this point forward may be unreliable as every request returns a WAF block page.

Impact: Detection of WAF/CDN IP ranges confirms that direct access to the origin server is mediated by a security proxy. An attacker targets CDN bypass techniques (IP history, DNS records, misconfigurations) to reach the unprotected origin.

Remediation: Rotate scanner IP or use authorized IP whitelisting for the pentest engagement. Notify the client if the scanner is being rate-limited or blocked.

OWASP Web: A05:2025

INFO FR-199 — WAF/CDN Session Termination Detected

Description: The WAF or CDN revoked the authenticated session mid-scan (HTTP 401 or login redirect returned on root URL probe). Authenticated scan results from this point may be incomplete.

Remediation: Re-authenticate and resume the scan. Consider using static session tokens or IP-whitelisting for the scanner in the WAF configuration.

OWASP Web: A05:2025

INFO FR-200 — WAF/CDN Challenge Page Active

Description: The WAF or CDN is serving a JavaScript challenge or CAPTCHA page instead of real content. Automated probe results may be incomplete or inaccurate while the challenge is active.

Remediation: Request the client whitelist the scanner IP in the WAF configuration for the duration of the assessment.

OWASP Web: A05:2025

MEDIUM FR-201 — Potential CDN Origin Bypass

Description: A request with IP spoofing headers (X-Forwarded-For, X-Real-IP) returned a different Server header, suggesting the origin server may be reachable without passing through the CDN. Direct access to the origin bypasses CDN-level WAF and rate-limiting.

Remediation: Restrict origin server to accept connections only from CDN IP ranges. Implement firewall rules to block direct internet access to the origin.

OWASP Web: A05:2025

HIGH FR-202 — Web Cache Poisoning

Description: An unkeyed request header was reflected in a cached response. An attacker can inject this header with a malicious value and have the CDN serve that value to all subsequent users who receive the cached response.

Remediation: Ensure all headers that influence the response are included in the CDN cache key. Remove unkeyed header reflection from the application.

OWASP Web: A04:2025

INFO FR-203 — Wildcard (*) Detected

Description: A wildcard/catch-all response was detected — the server returns the same response for all unknown paths. Directory brute-forcing may be unreliable; all path-based findings are validated against the wildcard baseline.

Remediation: Review server-side routing to ensure 404 responses are returned for truly non-existent paths rather than wildcard catch-all responses.

Effort: Low

OWASP Web: A05:2025

MITRE ATT&CK: T1595.003 (Reconnaissance), T1083 (Discovery)

NIST 800-53: CM-8, CM-7, AC-3

PCI DSS 4: 6.5.1

INFO FR-204 — CMS Detected

Description: A Content Management System (CMS) was identified from page source signatures, meta tags, or response headers. A known CMS allows attackers to target version-specific vulnerabilities and enumerate plugins/themes.

Remediation: Ensure the CMS and all plugins/themes are kept up to date. Remove version disclosure from meta generator tags.

Effort: Low

OWASP Web: A05:2025

MITRE ATT&CK: T1592.002 (Reconnaissance), T1595.002 (Reconnaissance)

NIST 800-53: CM-8, SI-2, CM-7

PCI DSS 4: 6.3.3

INFO FR-205 — Web Structure Identified

Description: The web application framework or structure type was classified (e.g., SPA, SSR Hybrid, Server-Rendered, Static HTML, API-first) from response characteristics. This informs subsequent testing phases.

Remediation: No direct remediation required. Ensure the application exposes only necessary fingerprinting signals.

OWASP Web: A05:2025

INFO FR-206 — Single Page Application Detected

Description: A Single Page Application (SPA) was identified. Client-side routing and dynamic content loading may prevent traditional crawler-based endpoint discovery. JavaScript analysis is used to supplement crawling.

Remediation: No direct remediation required.

OWASP Web: A05:2025

LOW FR-207 — Information Disclosure: Sensitive Path in robots.txt

Description: The robots.txt file discloses path patterns intended to be hidden from search engines. These paths are still accessible by attackers and their disclosure aids reconnaissance.

Remediation: Remove sensitive paths from robots.txt. Use proper access controls to restrict access to sensitive areas rather than relying on search engine exclusion.

OWASP Web: A05:2025

LOW FR-208 — Information Disclosure: Server Header

Description: The HTTP Server response header reveals the web server software name and version, reducing the attacker's reconnaissance effort needed to identify version-specific vulnerabilities.

Impact: The Server header discloses the web server software and version, enabling an attacker to search for known vulnerabilities specific to that version. This information reduces the reconnaissance effort required for targeted exploitation and is a prerequisite for version-specific exploit selection.

Remediation: Remove or genericise the Server response header in the web server configuration (e.g., ServerTokens Prod in Apache; server_tokens off in nginx).

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1592.002 (Reconnaissance)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.2.4

LOW FR-209 — Information Disclosure: X-Powered-By Header

Description: The X-Powered-By response header discloses the application framework, language, or runtime version, reducing the attacker's effort needed to identify version-specific vulnerabilities.

Impact: The X-Powered-By header reveals the application framework and version (e.g., PHP, ASP.NET), enabling targeted vulnerability research. An attacker uses this to narrow exploit selection to framework-specific attacks.

Remediation: Remove or suppress the X-Powered-By header at the application framework or reverse-proxy level.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1592.002 (Reconnaissance)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.2.4

LOW FR-210 — Information Disclosure: X-AspNet-Version Header

Description: The X-AspNet-Version header discloses the exact .NET framework version in use, assisting attackers in identifying version-specific vulnerabilities.

Impact: The X-AspNet-Version header discloses the exact ASP.NET runtime version, enabling an attacker to identify applicable CVEs and select exploits specific to that runtime version.

Remediation: Set <httpRuntime enableVersionHeader='false' /> in Web.config and configure the reverse proxy to strip this header.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1592.002 (Reconnaissance)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.2.4

LOW FR-211 — Information Disclosure: Via Header

Description: The Via response header discloses internal proxy or gateway infrastructure details, including software versions and internal host names.

Impact: The Via header reveals proxy infrastructure including reverse proxy software and internal routing topology. This information enables an attacker to identify proxy-specific bypass techniques and map the internal network architecture.

Remediation: Configure reverse proxies to suppress or genericise the Via header.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1592.002 (Reconnaissance)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.2.4

MEDIUM FR-212 — Information Disclosure: Debug/Trace Headers

Description: Debug or trace response headers (e.g., X-Debug-Info, X-Request-Id with sensitive stack details, X-Trace) expose internal application state, timing, or infrastructure details that assist attackers.

Impact: Debug and trace headers leak internal application state, stack traces, request identifiers, and server-side processing details. This information dramatically accelerates vulnerability discovery by revealing code paths, framework internals, and error handling behavior.

Remediation: Strip all debug and trace headers from production responses. Review reverse proxy and application framework header emission configuration.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025

MITRE ATT&CK: T1592.002 (Reconnaissance)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.5.1

INFO FR-213 — Unknown Header Identified

Description: An unrecognised HTTP response header was identified. Custom or proprietary headers may disclose internal platform details, testing infrastructure, or undocumented API features.

Remediation: Review all custom response headers and remove those that disclose internal implementation details.

OWASP Web: A05:2025

LOW FR-214 — Software Version Disclosed

Description: Software version information was identified in response headers, HTML meta tags, error pages, or JavaScript files. A known version allows attackers to rapidly identify applicable CVEs.

Impact: Disclosed software versions allow an attacker to search vulnerability databases for known CVEs affecting that specific version, reducing the effort required for targeted exploitation. Version information also reveals the organization's patching cadence and maintenance practices.

Remediation: Remove version disclosure from all response surfaces. Suppress generator tags, version comments, and version-bearing headers.

Effort: Low

OWASP Web: A05:2025

MITRE ATT&CK: T1592.002 (Reconnaissance), T1595.002 (Reconnaissance)

NIST 800-53: CM-8, SI-2, CM-7

PCI DSS 4: 6.3.3

LOW FR-215 — Virtual Host Discovered

Description: A virtual host was identified via Host header fuzzing or DNS enumeration. Additional virtual hosts on the same IP may have weaker security configurations or expose internal applications.

Remediation: Restrict virtual host binding to expected Host headers. Return consistent responses for unrecognised Host header values.

Effort: Low

OWASP Web: A05:2025

MITRE ATT&CK: T1592.002 (Reconnaissance), T1595.002 (Reconnaissance)

NIST 800-53: CM-8, SI-2, CM-7

PCI DSS 4: 6.3.3

HIGH FR-216 — Subdomain Takeover — Dangling CNAME

Description: A CNAME DNS record points to an unclaimed external service endpoint. An attacker can claim this endpoint and serve malicious content under the target's domain, enabling phishing, credential theft, and cookie theft.

Remediation: Remove dangling CNAME records from DNS. Ensure external service accounts are active while DNS records reference them.

OWASP Web: A05:2025

MEDIUM FR-217 — Subdomain Takeover Indicator

Description: A response pattern suggesting a potential subdomain takeover was detected. The subdomain may be claimable on the identified external platform.

Remediation: Verify whether the external service account has been deprovisioned. Remove the DNS record or re-claim the service endpoint.

OWASP Web: A05:2025

HIGH FR-218 — DNS Zone Transfer Permitted (AXFR)

Description: The DNS server permits full zone transfer (AXFR) requests, allowing any external host to retrieve all DNS records for the domain. This exposes internal hostnames, IP addresses, and infrastructure topology.

Impact: Permitted zone transfers expose the complete DNS zone contents including all hostnames, IP addresses, and service records. This provides an attacker with a comprehensive map of the organization's infrastructure without active scanning.

Remediation: Restrict AXFR to authorised secondary DNS servers only. Configure ACLs on the DNS server to deny zone transfer requests from untrusted sources.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2025

MITRE ATT&CK: T1590.002 (Reconnaissance), T1018 (Discovery)

NIST 800-53: SC-20, CM-7, AC-3

PCI DSS 4: 1.3.2, 6.5.1

INFO FR-219 — Interesting Endpoint Discovered

Description: An interesting URL or endpoint was discovered during crawling or discovery. The endpoint may expose sensitive functionality, administrative interfaces, or API capabilities.

Remediation: Review discovered endpoints and ensure appropriate access controls are in place.

Effort: Low

OWASP Web: A05:2025

MITRE ATT&CK: T1595.003 (Reconnaissance), T1083 (Discovery)

NIST 800-53: CM-8, CM-7, AC-3

PCI DSS 4: 6.5.1

INFO FR-220 — Authenticated Interesting Endpoint

Description: An interesting endpoint was discovered while authenticated. The endpoint may expose functionality that should be restricted to specific roles only.

Remediation: Review the endpoint and apply least-privilege role-based access controls.

Effort: Low

OWASP Web: A02:2025

MITRE ATT&CK: T1595.003 (Reconnaissance), T1083 (Discovery)

NIST 800-53: CM-8, CM-7, AC-3

PCI DSS 4: 6.5.1

HIGH FR-221 — Sensitive File Exposed

Description: A sensitive file was found accessible on the web server. Sensitive files may contain credentials, configuration data, private keys, source code, or database contents.

Remediation: Remove or restrict access to sensitive files. Ensure web root contains only publicly accessible content.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2025

MITRE ATT&CK: T1552.001 (Credential Access)

NIST 800-53: CM-6, CM-7

PCI DSS 4: 3.4.1

CRITICAL FR-222 — Sensitive Path Accessible

Description: A sensitive path was found accessible that should require authentication or should not be publicly reachable. Accessing this path may expose administrative functionality, configuration, or credentials.

Remediation: Apply authentication and authorisation controls to all sensitive paths. Implement a default-deny access policy.

Effort: Low

OWASP Web: A01:2025

MITRE ATT&CK: T1595.003 (Reconnaissance), T1083 (Discovery)

NIST 800-53: CM-8, CM-7, AC-3

PCI DSS 4: 6.5.1

HIGH FR-223 — Admin Panel Exposed

Description: An administrative panel or management interface was found publicly accessible. Exposure of admin panels increases the attack surface for brute-force, credential stuffing, and privilege escalation attacks.

Remediation: Restrict admin panel access by IP allowlist. Require multi-factor authentication for all administrative access. Do not expose admin interfaces to the public internet.

OWASP Web: A01:2025

HIGH FR-224 — Exposed Admin/Debug Endpoint

Description: A debug or administrative endpoint was found publicly accessible. These endpoints may expose configuration data, heap dumps, environment variables, or allow remote code execution.

Remediation: Remove debug endpoints from production deployments. Restrict access to any legitimate admin endpoints by IP allowlist and authentication.

OWASP Web: A05:2025

INFO FR-225 — Web Files Downloaded

Description: Downloadable files (e.g., backups, exports, documents) were identified on the web server. Downloadable files may contain sensitive information including credentials, source code, or internal data.

Remediation: Review all downloadable files and ensure they do not expose sensitive information. Remove backup files from web-accessible directories.

OWASP Web: A05:2025

INFO FR-226 — Web Screenshot Captured

Description: A screenshot of the web application was captured using a headless browser. This provides visual context for the application's UI, authentication flows, and security controls.

Impact: Visual captures of web pages provide immediate insight into application functionality, branding, and potential entry points without active interaction. Screenshots reveal login forms, admin panels, and application state that inform targeted attacks.

Remediation: No remediation required. Screenshots are captured for assessment documentation purposes.

OWASP Web: A05:2025

LOW FR-227 — Hidden Parameter Discovered

Description: A hidden form parameter or non-visible request parameter was discovered. Hidden parameters may be used to pass state or control values that are not exposed in the UI but are processed server-side.

Remediation: Review hidden parameters and ensure they do not bypass security controls or expose sensitive functionality.

Effort: Low

OWASP Web: A05:2025

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1550.001 (Defense Evasion), T1589 (Reconnaissance)

NIST 800-53: IA-5, SI-10

PCI DSS 4: 8.3.1

INFO FR-228 — Non-Login Form Detected

Description: A non-authentication form was detected in the application. Forms may be entry points for injection attacks, CSRF, or data manipulation vulnerabilities.

Remediation: Ensure all forms are protected against CSRF and injection. Apply input validation and output encoding.

Effort: Low

OWASP Web: A04:2025

MITRE ATT&CK: T1078 (Initial Access), T1589 (Reconnaissance)

NIST 800-53: IA-2, AC-2

PCI DSS 4: 8.2.1

INFO FR-229 — Login Page Detected

Description: An authentication login page was identified. The login page is the primary target for brute-force, credential stuffing, and authentication bypass attacks.

Remediation: Implement account lockout, rate limiting, CAPTCHA, and MFA on all login pages.

Effort: Low

OWASP Web: A07:2025

MITRE ATT&CK: T1078 (Initial Access), T1589 (Reconnaissance)

NIST 800-53: IA-2, AC-2

PCI DSS 4: 8.2.1

INFO FR-230 — Application Identified at Login Page

Description: The application technology or platform was identified from the login page appearance, form fields, or response headers. This aids attacker reconnaissance of version-specific authentication vulnerabilities.

Remediation: Suppress technology-identifying indicators from login pages.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

OWASP Web: A05:2025

MITRE ATT&CK: T1590 (Reconnaissance)

NIST 800-53: CM-8, RA-2

PCI DSS 4: 12.5.1

INFO FR-231 — Authentication Method Identified

Description: The authentication method used by the application was identified (e.g., form-based login, HTTP Basic, Digest, NTLM, Token, TOTP MFA). Understanding the auth method helps target appropriate attack vectors.

Remediation: Use strong, modern authentication mechanisms. Ensure credentials are transmitted only over encrypted channels.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

OWASP Web: A07:2025

MITRE ATT&CK: T1590 (Reconnaissance)

NIST 800-53: CM-8, RA-2

PCI DSS 4: 12.5.1

INFO FR-232 — Password Reset Endpoint Exposed

Description: A password reset endpoint was identified. Password reset flows are frequently targeted for account takeover via insecure token handling, predictable tokens, or host header injection.

Remediation: Ensure password reset tokens are cryptographically random, single-use, and short-lived. Validate the Host header in reset link generation.

Effort: Moderate

OWASP Web: A07:2025

MITRE ATT&CK: T1078 (Initial Access), T1110 (Credential Access)

NIST 800-53: IA-5, AC-2

PCI DSS 4: 8.3.6

INFO FR-233 — Active Session Management Interface Detected

Description: An active session management interface was detected (e.g., a page showing currently active sessions). This interface may expose session identifiers, user details, or allow unauthorised session termination.

Remediation: Restrict session management interfaces to authenticated users with appropriate roles. Ensure session identifiers are not exposed in the UI.

OWASP Web: A07:2025

INFO FR-234 — File Upload Endpoint Detected

Description: A file upload endpoint was detected. File upload functionality is a common attack vector for web shell upload, client-side XSS via crafted files, and server-side processing vulnerabilities.

Remediation: Validate file type by content inspection (not extension alone). Store uploads outside the web root. Disable execution of uploaded files. Implement file size limits and antivirus scanning.

Effort: Low

OWASP Web: A04:2025

MITRE ATT&CK: T1595.003 (Reconnaissance), T1083 (Discovery)

NIST 800-53: CM-8, CM-7, AC-3

PCI DSS 4: 6.5.1

LOW FR-235 — Information Disclosure: WordPress Version

Description: The WordPress version was identified. A known version allows attackers to rapidly identify version-specific CVEs affecting WordPress core.

Remediation: Remove version disclosure from generator meta tags and restrict access to files that reveal version information. Keep WordPress core updated to the latest stable release.

OWASP Web: A06:2025

HIGH FR-236 — WordPress Vulnerability / Misconfiguration

Description: A WordPress-specific vulnerability or security misconfiguration was identified. WordPress misconfigurations may allow unauthenticated access, information disclosure, or remote code execution.

Remediation: Apply all available WordPress security patches. Review and harden WordPress security settings per the WordPress hardening guide.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

OWASP Web: A06:2025

MITRE ATT&CK: T1190 (Initial Access), T1499 (Impact)

NIST 800-53: CM-7, AC-3

PCI DSS 4: 6.5.1

HIGH FR-237 — WordPress Users Exposed via REST API

Description: WordPress usernames were enumerated via the REST API /wp-json/wp/v2/users endpoint. Exposed usernames enable targeted brute-force and credential stuffing attacks against wp-login.php.

Remediation: Disable username exposure via the REST API by filtering the response or disabling the endpoint with appropriate plugins. Implement account lockout on wp-login.php.

OWASP Web: A01:2025

HIGH FR-238 — WordPress User Enumeration via Author Archives

Description: WordPress usernames were enumerated by probing author archive URLs (?author=N). The server redirected to user-specific author archive pages revealing valid usernames.

Remediation: Prevent author archive enumeration by redirecting /?author=N requests or using a security plugin to obfuscate author slugs.

OWASP Web: A01:2025

HIGH FR-239 — WordPress Debug Log Exposed

Description: The WordPress debug log (wp-content/debug.log) is publicly accessible. Debug logs may contain database credentials, file paths, error messages, and other sensitive internal information.

Remediation: Disable WP_DEBUG and WP_DEBUG_LOG in production. Remove the debug.log file and restrict access to wp-content/ directory.

OWASP Web: A05:2025

CRITICAL FR-240 — WordPress wp-config.php Source Code Exposed

Description: The WordPress configuration file (wp-config.php) or a backup of it is accessible and returns source code. This file contains database credentials, authentication keys, and salts.

Remediation: Move wp-config.php one directory above the web root. Block access to backup files matching wp-config patterns via .htaccess or server configuration.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A02:2025

MITRE ATT&CK: T1552.001 (Credential Access), T1190 (Initial Access)

NIST 800-53: CM-6, AC-3, IA-5

PCI DSS 4: 6.5.1, 8.3.2

MEDIUM FR-241 — WordPress wp-cron.php Publicly Accessible

Description: The WordPress wp-cron.php file is publicly accessible and can be triggered by external requests. Unrestricted access allows attackers to trigger scheduled tasks at will, potentially causing resource exhaustion or unintended side effects.

Remediation: Disable the default WP-Cron mechanism and replace it with a real server cron job. Block direct external access to wp-cron.php via web server configuration.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

OWASP Web: A05:2025

MITRE ATT&CK: T1190 (Initial Access), T1499 (Impact)

NIST 800-53: CM-7, AC-3

PCI DSS 4: 6.5.1

INFO FR-242 — WordPress Multisite Installation Detected

Description: A WordPress Multisite installation was detected. Multisite installations have a larger attack surface as vulnerabilities in one site may affect all sites in the network.

Remediation: Ensure all sites in the Multisite network are monitored and updated. Apply network-wide security controls.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025

MITRE ATT&CK: T1592.002 (Reconnaissance), T1083 (Discovery)

NIST 800-53: CM-7, CM-8

PCI DSS 4: 6.5.1

INFO FR-243 — WordPress Plugins Detected in Page Source

Description: WordPress plugin names were identified from page source references to wp-content/plugins/. Known plugin names allow attackers to check for plugin-specific CVEs.

Remediation: Dequeue unused plugins and obfuscate plugin asset paths where possible. Keep all plugins updated.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A06:2025

MITRE ATT&CK: T1592.002 (Reconnaissance), T1083 (Discovery)

NIST 800-53: CM-7, CM-8

PCI DSS 4: 6.5.1

INFO FR-244 — WordPress Parent Theme Detected

Description: A WordPress parent theme was identified. Known theme names allow attackers to check for theme-specific CVEs and misconfigurations.

Remediation: Keep all themes updated. Remove unused themes.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A06:2025

MITRE ATT&CK: T1592.002 (Reconnaissance), T1083 (Discovery)

NIST 800-53: CM-7, CM-8

PCI DSS 4: 6.5.1

HIGH FR-245 — WordPress Backup/Export File Exposed

Description: A WordPress backup or export file was found accessible on the web server. These files may contain the full database dump including user credentials, content, and configuration.

Remediation: Remove backup files from web-accessible directories. Store backups outside the document root or with access restrictions.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2025

MITRE ATT&CK: T1552.001 (Credential Access), T1530 (Collection)

NIST 800-53: CM-6, AC-3, SC-28

PCI DSS 4: 6.5.1, 3.3.1

CRITICAL FR-246 — WordPress Configuration Backup Exposed

Description: A WordPress configuration backup file was found accessible. Configuration backups may expose database credentials, salts, and authentication keys.

Remediation: Remove configuration backup files from web-accessible directories. Ensure backup files are stored securely outside the web root.

OWASP Web: A02:2025

MEDIUM FR-247 — WordPress Directory Listing Enabled

Description: Directory listing is enabled on a WordPress directory (wp-content, plugins, themes, or uploads). This allows enumeration of installed plugins, themes, media files, and backup files.

Remediation: Disable directory listing via the web server configuration. Add Options -Indexes to .htaccess or equivalent in nginx configuration.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025

MITRE ATT&CK: T1592.002 (Reconnaissance), T1083 (Discovery)

NIST 800-53: CM-7, CM-8

PCI DSS 4: 6.5.1

HIGH FR-248 — PHP Error Log Exposed

Description: A PHP error log file is publicly accessible. Error logs may contain database credentials, file system paths, internal function names, SQL queries, and stack traces.

Remediation: Configure PHP to log errors to a file outside the web root. Restrict web server access to log files.

OWASP Web: A05:2025

HIGH FR-249 — TimThumb Script Detected

Description: The TimThumb image resizing script was detected. Outdated versions of TimThumb contain remote file inclusion vulnerabilities that allow attackers to download and execute remote PHP code.

Remediation: Remove TimThumb from the application. If required, update to the latest version (2.8.14+) and restrict the allowed domain list.

Effort: Moderate

OWASP Web: A06:2025

MITRE ATT&CK: T1190 (Initial Access), T1505.003 (Persistence)

NIST 800-53: SI-2, CM-6

PCI DSS 4: 6.3.3, 6.5.1

HIGH FR-250 — Sensitive WordPress Path Accessible

Description: A sensitive WordPress file or directory was found publicly accessible. This may expose credentials, configuration, or internal application data.

Remediation: Restrict access to all sensitive WordPress paths via web server configuration. Review WordPress hardening guidelines.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

OWASP Web: A05:2025

MITRE ATT&CK: T1190 (Initial Access), T1499 (Impact)

NIST 800-53: CM-7, AC-3

PCI DSS 4: 6.5.1

INFO FR-251 — Discovery: SSL/TLS Certificate

Description: TLS certificate identity and validity metadata was extracted including subject CN, issuer, Subject Alternative Names (SANs), and expiry date. This provides reference context for the certificate lifecycle and scope.

Impact: Certificate details including issuer, validity period, subject alternative names, and key parameters provide an attacker with infrastructure intelligence. This information reveals hosting relationships, internal hostnames, and certificate management practices that inform targeted attacks.

Remediation: Ensure certificate expiry is monitored with automated renewal. Verify all expected FQDNs are listed in the SAN extension.

OWASP Web: A02:2025

HIGH FR-252 — SSL/TLS Certificate: Expired

Description: The server's TLS certificate has passed its expiry date, causing browser trust errors and indicating a breakdown in certificate lifecycle management.

Impact: An expired certificate causes browser warnings that train users to bypass security prompts, and in many configurations disables certificate pinning. An attacker can present their own certificate to users conditioned to click through warnings, enabling silent interception of all encrypted traffic.

Remediation: Renew the certificate immediately and implement automated renewal (e.g., ACME/Let's Encrypt) to prevent future expiry.

OWASP Web: A02:2025

HIGH FR-253 — SSL/TLS Certificate: Hostname Mismatch

Description: The TLS certificate's Subject Alternative Names do not cover the target hostname. Clients will display a certificate mismatch warning, enabling trivial MITM attacks.

Impact: A hostname mismatch indicates the certificate was issued for a different domain, causing browser warnings and potentially indicating a misconfigured or compromised service. Users who accept the mismatch become vulnerable to MITM attacks.

Remediation: Reissue the certificate to include the target hostname in the Subject Alternative Name extension.

OWASP Web: A02:2025

MEDIUM FR-254 — SSL/TLS Certificate: Self-Signed

Description: The server presented a self-signed TLS certificate not anchored to a publicly trusted CA, preventing clients from verifying the server's identity and enabling trivial MITM attacks.

Impact: Self-signed certificates are not validated by any trusted certificate authority, meaning clients cannot verify the server's identity. An attacker can trivially generate their own self-signed certificate and perform man-in-the-middle attacks without detection.

Remediation: Replace self-signed certificates with certificates issued by a trusted CA. Use ACME/Let's Encrypt for automated issuance.

OWASP Web: A02:2025

LOW FR-255 — SSL/TLS DNS: Missing CAA Record

Description: No CAA (Certification Authority Authorization) DNS record exists for the domain. Without CAA, any certificate authority can issue certificates for this domain, increasing mis-issuance risk.

Impact: Without a CAA (Certificate Authority Authorization) DNS record, any certificate authority can issue certificates for the domain. An attacker who compromises a less-secure CA or exploits a CA validation flaw can obtain a legitimate certificate for the domain, enabling transparent man-in-the-middle attacks that bypass certificate validation.

Remediation: Add a CAA record specifying the authorised CA(s) for certificate issuance.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

OWASP Web: A05:2025

MITRE ATT&CK: T1588.004 (Resource Development)

NIST 800-53: SC-20, SC-23

PCI DSS 4: 4.2.1

MEDIUM FR-256 — SSL/TLS Vulnerability: SWEET32

Description: 3DES cipher suites are accepted, making the server susceptible to the SWEET32 birthday attack (CVE-2016-2183). An attacker can recover plaintext from long-lived sessions using 3DES by collecting enough ciphertext blocks.

Impact: SWEET32 exploits the birthday bound weakness in 64-bit block ciphers (3DES, Blowfish) used in TLS. After capturing approximately 32GB of ciphertext from a long-lived session, an attacker can recover plaintext blocks, potentially exposing session cookies and authentication tokens.

Remediation: Disable all 3DES cipher suites. Use AEAD ciphers (AES-GCM) only.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2025

NIST 800-53: SC-8, SC-28

PCI DSS 4: 4.2.1

MEDIUM FR-257 — SSL/TLS Vulnerability: BEAST

Description: TLSv1.0 is enabled with CBC cipher suites, making the server susceptible to the BEAST attack (CVE-2011-3389). BEAST allows an active MITM to partially decrypt TLS-encrypted session data.

Impact: BEAST (Browser Exploit Against SSL/TLS) exploits a vulnerability in TLS 1.0's CBC-mode cipher initialization to decrypt HTTPS cookies and authentication tokens. An attacker with network access can inject chosen plaintext to recover session secrets, enabling session hijacking.

Remediation: Disable TLSv1.0 and CBC cipher suites. Use TLS 1.2/1.3 with AEAD ciphers only.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2025

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1557 (Collection)

NIST 800-53: SC-8, SC-28, IA-5

PCI DSS 4: 4.2.1

MEDIUM FR-258 — SSL/TLS Vulnerability: LUCKY13

Description: CBC cipher suites are accepted, making the server susceptible to the LUCKY13 timing attack (CVE-2013-0169). LUCKY13 allows an attacker to recover plaintext from CBC-mode TLS using timing side-channels.

Impact: LUCKY13 (CVE-2013-0169) is a timing side-channel attack against CBC-mode cipher suites in TLS. An attacker with network-level access can recover plaintext from encrypted sessions by measuring processing time differences.

Remediation: Prefer AEAD cipher suites (AES-GCM/AES-CCM) over CBC-mode ciphers.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2025

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1557 (Collection)

NIST 800-53: SC-8, SC-28, IA-5

PCI DSS 4: 4.2.1

INFO FR-259 — TLS Version Identified

Description: The negotiated TLS protocol version was identified via a socket-level probe. This provides baseline TLS version context when sslscan/testssl.sh are unavailable.

Remediation: Ensure TLS 1.2 or 1.3 is negotiated. Disable TLS 1.0 and 1.1.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2025

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1557 (Collection)

NIST 800-53: SC-8, SC-28, IA-5

PCI DSS 4: 4.2.1

MEDIUM FR-260 — SSL/TLS Ciphers: Weak Cipher

Description: A weak or deprecated cipher suite was identified in the server's TLS configuration. Weak ciphers may allow passive decryption of TLS traffic by a well-resourced attacker.

Remediation: Disable all weak cipher suites. Use only AEAD ciphers (AES-128-GCM, AES-256-GCM, ChaCha20-Poly1305). Enable TLS 1.3 only for new deployments.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2025

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28, CM-6

PCI DSS 4: 4.2.1, 2.2.4

CRITICAL FR-261 — Heartbleed (CVE-2014-0160) Vulnerability Detected

Description: The server is vulnerable to Heartbleed (CVE-2014-0160). Attackers can read up to 64 KB of server memory per request, exposing private keys, session tokens, and credentials without authentication.

Remediation: Update OpenSSL to 1.0.1g+ or 1.0.2+. Revoke and reissue all certificates. Invalidate all active session tokens.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2025

MITRE ATT&CK: T1552 (Credential Access), T1040 (Credential Access)

NIST 800-53: SI-2, SC-8, RA-5

PCI DSS 4: 6.3.3

CISA KEV

INFO FR-262 — SSL/TLS Grade

Description: testssl.sh assigned an overall TLS grade to the target. The grade summarises the TLS configuration quality across protocol versions, cipher suites, and certificate strength.

Impact: The SSL/TLS grade reflects the overall strength of the server's TLS configuration including protocol versions, cipher suites, and certificate properties. A low grade indicates multiple weaknesses that collectively reduce the confidentiality and integrity of encrypted communications.

Remediation: Remediate identified TLS weaknesses to achieve a grade of A or better.

OWASP Web: A02:2025

LOW FR-263 — Missing Security Header

Description: One or more HTTP security headers are absent from the server response. Missing security headers weaken the browser's ability to enforce content security policies, prevent clickjacking, and mitigate XSS.

Remediation: Configure all recommended security headers: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.

OWASP Web: A05:2025

LOW FR-264 — Permissive Security Header: Content-Security-Policy

Description: The Content-Security-Policy header is present but contains permissive directives such as 'unsafe-inline', 'unsafe-eval', or wildcard ('*') sources that significantly weaken its XSS protection.

Remediation: Replace permissive CSP directives with specific, trusted origins. Use nonces or hashes instead of 'unsafe-inline'.

OWASP Web: A05:2025

LOW FR-265 — Permissive Security Header: X-Frame-Options

Description: The X-Frame-Options header is set to ALLOW-FROM or is absent, allowing the page to be embedded in iframes from arbitrary origins and enabling clickjacking attacks.

Remediation: Set X-Frame-Options to DENY or SAMEORIGIN. Prefer the frame-ancestors CSP directive for modern browsers.

OWASP Web: A05:2025

LOW FR-266 — Permissive Security Header: Strict-Transport-Security

Description: The Strict-Transport-Security header is present but has an insufficient max-age value or is missing the includeSubDomains directive.

Remediation: Set HSTS max-age to at least 31536000 (1 year) and include the includeSubDomains directive. Consider adding to the HSTS preload list.

OWASP Web: A05:2025

LOW FR-267 — Permissive Security Header: Referrer-Policy

Description: The Referrer-Policy header allows sensitive URL information to be included in the Referer header sent to third-party origins, potentially leaking authentication tokens or PII.

Remediation: Set Referrer-Policy to 'strict-origin-when-cross-origin' or 'no-referrer'.

OWASP Web: A05:2025

LOW FR-268 — Permissive Security Header: X-Content-Type-Options

Description: The X-Content-Type-Options header is missing or set to a value other than 'nosniff', allowing browsers to MIME-sniff the content type and execute uploaded files as scripts.

Remediation: Set X-Content-Type-Options: nosniff on all responses.

OWASP Web: A05:2025

LOW FR-269 — Permissive Security Header: Cache-Control

Description: Sensitive pages lack appropriate Cache-Control directives, allowing browser or proxy caches to store sensitive data. Cached sensitive pages may be retrieved by other users of shared devices.

Remediation: Set 'Cache-Control: no-store, no-cache, must-revalidate' on all authenticated and sensitive pages.

OWASP Web: A05:2025

LOW FR-270 — Missing Cache-Control on Sensitive Page

Description: An authenticated or sensitive page does not set Cache-Control headers to prevent caching. The page content may be stored in browser or proxy caches and retrieved by subsequent users.

Remediation: Add 'Cache-Control: no-store, no-cache, must-revalidate' to all pages that display authenticated or sensitive data.

OWASP Web: A05:2025

LOW FR-271 — Misconfigured Expect-CT Header (max-age=0 with enforce)

Description: The Expect-CT header is set with max-age=0 and the enforce directive. This configuration is contradictory and ineffective for certificate transparency enforcement.

Remediation: Remove the enforce directive or set an appropriate max-age value for Expect-CT. Consider relying on the browser's built-in CT enforcement instead.

OWASP Web: A05:2025

INFO FR-272 — Endpoint-Specific Security Header Found

Description: A security header was found present on a specific endpoint but absent on the main application root. Inconsistent header coverage may leave some pages vulnerable despite partial protection.

Remediation: Ensure security headers are applied consistently across all application endpoints via server-level configuration rather than per-page.

Effort: Low

OWASP Web: A05:2025

MITRE ATT&CK: T1595.003 (Reconnaissance), T1083 (Discovery)

NIST 800-53: CM-8, CM-7, AC-3

PCI DSS 4: 6.5.1

CRITICAL FR-273 — SQL Injection (Error-Based)

Description: Error-based SQL injection was detected. Database error messages containing SQL syntax are returned in response to crafted input, confirming the application is vulnerable to SQL injection and disclosing database version/structure information.

Remediation: Use parameterised queries or prepared statements. Never construct SQL queries from user input. Suppress detailed database error messages in production.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2025

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, SA-11, RA-5

PCI DSS 4: 6.2.4, 6.3.2

CRITICAL FR-274 — SQL Injection Confirmed by sqlmap

Description: sqlmap confirmed SQL injection on the target parameter. SQL injection allows attackers to read, modify, or delete database contents and may enable operating system command execution.

Remediation: Use parameterised queries or prepared statements. Apply input validation. Restrict database account permissions to the minimum required.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2025

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, SA-11, RA-5

PCI DSS 4: 6.2.4, 6.3.2

CRITICAL FR-275 — Second-Order SQL Injection

Description: A second-order (stored) SQL injection vector was identified. User-supplied input stored in the database is later included in SQL queries without sanitisation when retrieved and processed.

Remediation: Apply parameterised queries at all database interaction points, not just at the input entry point. Sanitise data on retrieval as well as input.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2025

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, SA-11, RA-5

PCI DSS 4: 6.2.4, 6.3.2

CRITICAL FR-276 — OS Command Injection

Description: OS command injection was detected. User-supplied input is passed to an operating system shell without sanitisation, allowing arbitrary command execution on the server.

Remediation: Never pass user input to shell functions. Use language-native APIs instead of shell commands. If shell commands are required, use allowlisted inputs only with strict sanitisation.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2025

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, CM-6, SA-11

PCI DSS 4: 6.2.4

CISA KEV

CRITICAL FR-277 — Remote Code Execution via Code Injection

Description: Server-side code injection leading to remote code execution was detected. User-supplied input is evaluated as server-side code (PHP, Python, Ruby, etc.), allowing arbitrary code execution.

Remediation: Never evaluate user-supplied input as code. Use a template engine that auto-escapes by default. Sanitise and validate all user input.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2025

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution), T1499 (Impact)

NIST 800-53: SI-10, AC-3, CM-7

PCI DSS 4: 6.2.4, 6.5.1

HIGH FR-278 — Reflected Cross-Site Scripting (XSS)

Description: Reflected XSS was detected. User-supplied input is immediately reflected in the server response without encoding, allowing attackers to inject and execute arbitrary JavaScript in the victim's browser via a crafted link.

Remediation: Apply context-sensitive output encoding for all user-controlled data. Implement a Content-Security-Policy header to restrict script execution.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

OWASP Web: A03:2025

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1189 (Initial Access), T1059.007 (Execution)

NIST 800-53: SI-10, SC-18

PCI DSS 4: 6.2.4

CRITICAL FR-279 — Stored Cross-Site Scripting (XSS)

Description: Stored XSS was detected. User-supplied input is persisted and later rendered in the browser without encoding, allowing an attacker to execute JavaScript in the context of any user who views the affected page.

Remediation: Apply context-sensitive output encoding at render time. Implement Content-Security-Policy. Validate and sanitise all input before storage.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

OWASP Web: A03:2025

MITRE ATT&CK: T1059.007 (Execution)

NIST 800-53: SI-10, SC-18

PCI DSS 4: 6.2.4

HIGH FR-280 — DOM-Based Cross-Site Scripting (XSS)

Description: DOM-based XSS was detected. JavaScript in the page reads attacker-controlled data from an insecure source (URL fragment, query string, postMessage) and writes it to a dangerous sink without encoding.

Remediation: Avoid writing attacker-controllable data to dangerous DOM sinks (innerHTML, document.write, eval). Use textContent or safe DOM APIs. Apply a strict Content-Security-Policy.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

OWASP Web: A03:2025

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1189 (Initial Access), T1059.007 (Execution)

NIST 800-53: SI-10, SC-18

PCI DSS 4: 6.2.4

HIGH FR-281 — XSS Confirmed by dalfox

Description: dalfox confirmed a Cross-Site Scripting (XSS) vulnerability with a working payload that executes in the browser. XSS enables session hijacking, credential theft, and UI redirection.

Remediation: Apply context-sensitive output encoding. Implement a strict Content-Security-Policy. Validate and sanitise all user-supplied input.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

OWASP Web: A03:2025

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1189 (Initial Access), T1059.007 (Execution)

NIST 800-53: SI-10, SC-18

PCI DSS 4: 6.2.4

MEDIUM FR-282 — CSV / Formula Injection

Description: CSV/formula injection was detected. User-supplied input containing spreadsheet formula characters (=, +, -, @) is included in CSV exports without sanitisation and may execute in spreadsheet applications opened by staff.

Remediation: Prefix cell values containing formula characters with a single quote or sanitise them before CSV export. Warn users about opening untrusted CSV files.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

OWASP Web: A03:2025

MITRE ATT&CK: T1059 (Execution), T1566.002 (Initial Access)

NIST 800-53: SI-10, SI-7

PCI DSS 4: 6.2.4

MEDIUM FR-283 — CRLF Injection

Description: CRLF injection was detected. Carriage return and line feed characters in user input are reflected in HTTP response headers, allowing attackers to inject arbitrary headers or split responses.

Remediation: Strip CRLF characters from all user input used in HTTP header values. Apply output encoding at HTTP header construction points.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP Web: A03:2025

MITRE ATT&CK: T1190 (Initial Access), T1539 (Collection)

NIST 800-53: SI-10, SC-8

PCI DSS 4: 6.2.4, 6.5.1

HIGH FR-284 — Log Injection / CRLF in Log Entries

Description: Log injection was detected. User-supplied input containing CRLF characters is written to application logs without sanitisation, allowing attackers to forge log entries and cover their tracks.

Remediation: Sanitise all user input included in log messages. Remove or encode CRLF characters before logging.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

OWASP Web: A09:2025

MITRE ATT&CK: T1562.006 (Defense Evasion), T1070 (Defense Evasion)

NIST 800-53: AU-9, SI-10, AU-12

PCI DSS 4: 10.3.1, 6.2.4

MEDIUM FR-285 — HTTP Parameter Pollution (HPP)

Description: HTTP Parameter Pollution was detected. Duplicate query or body parameters with different values are processed inconsistently, potentially bypassing input validation or authentication checks.

Remediation: Consistently parse HTTP parameters and reject or handle duplicate parameter names explicitly. Ensure security controls operate on the same parameter value the application uses.

OWASP Web: A04:2025

MEDIUM FR-286 — HTTP Method Tampering

Description: An unexpected HTTP method was accepted by the server. Accepting non-standard methods (e.g., TRACE, PUT, DELETE, PATCH) may bypass WAF rules or expose administrative functionality.

Remediation: Restrict accepted HTTP methods to those explicitly required by the application. Return 405 Method Not Allowed for all other methods.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

OWASP Web: A04:2025

OWASP API: API8:2023 – Security Misconfiguration

NIST 800-53: CM-6, CM-7

PCI DSS 4: 6.2.4

MEDIUM FR-287 — HTTP Methods: Unsafe Methods Enabled

Description: The HTTP TRACE method is enabled. TRACE echoes the full request including HTTP headers back to the client, enabling Cross-Site Tracing (XST) attacks that may expose HttpOnly cookies via XSS.

Remediation: Disable the HTTP TRACE method in the web server configuration (TraceEnable Off in Apache; disabling in nginx).

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

OWASP Web: A05:2025

MITRE ATT&CK: T1185 (Collection), T1539 (Collection)

NIST 800-53: CM-7, SC-8

PCI DSS 4: 6.2.4, 6.5.1

CRITICAL FR-288 — Server-Side Request Forgery (SSRF)

Description: Server-Side Request Forgery (SSRF) was detected. User-supplied URLs or hostnames are used by the server to make outbound requests without validation, allowing attackers to probe internal services, bypass firewall rules, and access cloud metadata endpoints.

Remediation: Validate and allowlist all server-side request targets. Block requests to private IP ranges and cloud metadata endpoints. Use a dedicated outbound request proxy with allowlisting.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

OWASP Web: A10:2025

OWASP API: API7:2023 – Server Side Request Forgery

MITRE ATT&CK: T1190 (Initial Access), T1552.005 (Credential Access)

NIST 800-53: SI-10, SC-7

PCI DSS 4: 6.2.4

HIGH FR-289 — Blind SSRF — Internal Network Probing

Description: Blind SSRF was detected via out-of-band interaction. The server made a DNS or HTTP request to an attacker-controlled host, confirming that user-supplied URLs trigger server-side requests. Internal network probing may be possible.

Remediation: Validate and allowlist all server-side request targets. Use an SSRF-safe HTTP client library that blocks private IP ranges by default.

OWASP Web: A10:2025

CRITICAL FR-290 — Insecure Deserialization — Serialized Object Accepted

Description: A serialised object was accepted by the application without signature verification. Insecure deserialisation can lead to remote code execution, privilege escalation, or denial of service depending on the deserialisable gadget chains available.

Remediation: Avoid deserialising objects from untrusted sources. If required, sign serialised data and verify signatures before deserialisation. Use safer serialisation formats (JSON) where possible.

OWASP Web: A08:2025

CRITICAL FR-291 — Insecure Deserialization — YAML Tag Injection

Description: A YAML tag injection payload was accepted by the application. YAML parsers that support arbitrary Python object instantiation via !! tags (e.g., PyYAML) can be exploited for remote code execution.

Remediation: Use safe YAML loaders (yaml.safe_load in Python). Disable arbitrary Python object instantiation in the YAML parser.

OWASP Web: A08:2025

HIGH FR-292 — Insecure Deserialization — Error Disclosure

Description: A deserialisation error was triggered by a crafted payload and the error message was returned in the response. Error disclosure confirms the parameter is processed by a deserialiser and may guide further exploitation.

Remediation: Suppress deserialisation errors in production. Apply the remediation for insecure deserialisation.

OWASP Web: A08:2025

HIGH FR-293 — Verbose Error Messages — Stack Trace Disclosed

Description: A detailed stack trace or internal error message was returned in response to a crafted request. Stack traces disclose source file paths, class names, function names, and line numbers that assist further exploitation.

Remediation: Configure the application to return generic error pages in production. Log detailed errors server-side only.

OWASP Web: A05:2025

HIGH FR-294 — Credentials/Secret in JavaScript

Description: Credentials, API keys, tokens, or other secrets were identified in client-side JavaScript source files. Client-side secrets are visible to all users and attackers who access the page.

Remediation: Move all credentials and API keys to server-side configuration. Use environment variables and secret management solutions. Rotate any exposed credentials immediately.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2025

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1552.001 (Credential Access)

NIST 800-53: IA-5

PCI DSS 4: 3.4.1

HIGH FR-295 — Sensitive Information in Source

Description: Sensitive information (credentials, internal URLs, private keys, PII, or internal comments) was identified in the HTML source of the page.

Remediation: Remove all sensitive data from page source. Use server-side rendering to avoid embedding sensitive values in HTML. Conduct regular source code reviews.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A02:2025

MITRE ATT&CK: T1592 (Reconnaissance), T1083 (Discovery)

NIST 800-53: SI-12, CM-7

PCI DSS 4: 6.5.1

CRITICAL FR-296 — Weak or Default Credentials Accepted

Description: Weak, default, or commonly-used credentials were successfully authenticated. Default or weak credentials allow attackers to gain privileged access without effort.

Remediation: Change all default credentials immediately. Enforce a strong password policy. Implement MFA. Conduct periodic credential audits.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2025

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1078.001 (Initial Access)

NIST 800-53: IA-5, CM-6

PCI DSS 4: 8.3.1, 2.2.1

CISA KEV

HIGH FR-297 — Missing Rate Limiting / Brute-Force Protection

Description: The authentication endpoint does not implement rate limiting or brute-force protection. Attackers can submit unlimited login attempts to perform credential stuffing or password brute-forcing.

Remediation: Implement progressive account lockout, CAPTCHA after failed attempts, and IP-based rate limiting on the login endpoint.

OWASP Web: A07:2025

MEDIUM FR-298 — Insufficient Auth Failure Logging / No Brute-Force Detection

Description: Authentication failures are not logged or no alerting is configured for repeated failures. Without logging, brute-force attacks may go undetected until after a successful compromise.

Remediation: Log all authentication failures with timestamp, source IP, and username. Configure alerts for repeated failures from a single IP. Integrate with a SIEM for real-time detection.

OWASP Web: A09:2025

MEDIUM FR-299 — Timing Attack — Non-Constant-Time Authentication

Description: A statistically significant timing difference was observed between valid and invalid authentication attempts. Timing oracle attacks allow attackers to enumerate valid usernames or infer partial credential validity.

Remediation: Use constant-time comparison functions for all credential verification. Ensure responses are returned after a fixed delay regardless of outcome.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2025

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1110 (Credential Access), T1522 (Credential Access)

NIST 800-53: IA-3, SC-8

PCI DSS 4: 8.3.1

CRITICAL FR-300 — JWT None Algorithm Authentication Bypass

Description: The JWT library accepts tokens with the 'none' algorithm, meaning the signature field is empty and no verification is performed. Attackers can forge arbitrary JWT payloads to impersonate any user including administrators.

Remediation: Explicitly allowlist accepted JWT algorithms. Reject tokens with 'none' algorithm. Use a well-maintained JWT library with secure defaults.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A02:2025

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1550.001 (Defense Evasion)

NIST 800-53: IA-5, SC-8

PCI DSS 4: 4.2.1, 8.3.6

CRITICAL FR-301 — JWT Vulnerability: 'none' Algorithm Accepted

Description: The application accepted a JWT token with the 'none' algorithm specified in the header, bypassing signature verification. This allows forging of arbitrary JWT claims.

Remediation: Reject all tokens with 'none' algorithm. Explicitly specify and enforce the expected signature algorithm server-side.

OWASP Web: A02:2025

CRITICAL FR-302 — JWT Vulnerability Confirmed by jwt_tool

Description: jwt_tool confirmed a JWT vulnerability that allows token forgery or authentication bypass. JWT vulnerabilities enable impersonation of arbitrary users including administrators.

Remediation: Implement strict JWT validation: verify the signature algorithm, reject 'none' algorithm, validate all claims (exp, aud, iss). Rotate signing keys.

OWASP Web: A02:2025

MEDIUM FR-303 — JWT — Missing Expiry Claim (No exp)

Description: The JWT token does not contain an 'exp' (expiry) claim. Tokens without expiry never become invalid, meaning a stolen token grants permanent access until the signing key is rotated.

Remediation: Include an 'exp' claim in all JWTs. Set a short token lifetime appropriate for the use case. Implement token refresh flows.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A02:2025

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1550.001 (Defense Evasion), T1539 (Collection)

NIST 800-53: IA-5, SC-23, AC-12

PCI DSS 4: 8.2.4, 8.3.9

INFO FR-304 — JWT Token Identified: Algorithm

Description: A JWT token was identified in the application. The JWT header algorithm has been extracted for analysis.

Remediation: Ensure JWT tokens are signed with a strong algorithm (RS256, ES256, or HS256 with a sufficiently random secret). Avoid 'none' or weak algorithms.

OWASP Web: A02:2025

HIGH FR-305 — Potentially Predictable Session Token

Description: The session token appears to have low entropy or a predictable pattern. Predictable tokens allow attackers to brute-force or enumerate valid sessions and impersonate other users.

Remediation: Use a cryptographically secure random number generator for session token generation. Tokens must have at least 128 bits of entropy.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2025

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1539 (Collection), T1110.001 (Credential Access)

NIST 800-53: IA-5, SC-23

PCI DSS 4: 8.2.1, 8.3.6

HIGH FR-306 — Low-Entropy Session Token

Description: The session token has low statistical entropy as measured across multiple sample tokens. Low-entropy tokens can be brute-forced to hijack arbitrary user sessions.

Remediation: Generate session tokens using a CSPRNG. Ensure tokens have at least 128 bits of randomness.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2025

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1539 (Collection), T1110.001 (Credential Access)

NIST 800-53: IA-5, SC-23

PCI DSS 4: 8.2.1, 8.3.6

HIGH FR-307 — Session Fixation Vulnerability

Description: The application does not rotate the session identifier after successful authentication. An attacker can set a known session ID, trick the victim into authenticating, and then use the known ID to hijack the authenticated session.

Remediation: Regenerate the session identifier immediately after every successful login. Invalidate the pre-authentication session ID.

OWASP Web: A07:2025

HIGH FR-308 — Session Not Invalidated After Logout

Description: The server-side session is not invalidated after the user logs out. The session token remains valid for an extended period after logout, allowing session reuse if the token is captured.

Remediation: Invalidate server-side session state on logout. Expire the session cookie immediately on the client. Do not rely solely on client-side cookie deletion.

OWASP Web: A07:2025

HIGH FR-309 — Session Not Invalidated Server-Side After Logout

Description: The pre-logout session token remains valid server-side after the logout request. An attacker who obtains a session token can continue to use it indefinitely after the legitimate user has logged out.

Remediation: Implement server-side session invalidation on logout. Maintain a server-side session store that immediately marks tokens as invalid on logout.

OWASP Web: A07:2025

MEDIUM FR-310 — Session Timeout Absent or Excessive

Description: The session does not expire after a reasonable period of inactivity, or no session timeout is configured. Long-lived sessions increase the window of opportunity for session hijacking attacks.

Remediation: Implement server-side session timeout. Expire idle sessions after 15-30 minutes for sensitive applications. Set appropriate cookie Max-Age/Expires attributes.

OWASP Web: A07:2025

MEDIUM FR-311 — Excessive Session Timeout Configured

Description: The session cookie or JWT has an excessive lifetime (e.g., multiple days or weeks) that does not reflect the risk level of the application. Long-lived tokens extend the exposure window after theft.

Remediation: Set session lifetimes appropriate to the application sensitivity. Use refresh token patterns for long-lived access.

OWASP Web: A07:2025

MEDIUM FR-312 — Session Cookie SameSite=None Without Secure Flag

Description: A session cookie is set with SameSite=None but without the Secure flag. Without Secure, the cookie is transmitted over plaintext HTTP when SameSite=None is used, enabling cross-site transmission of session tokens.

Remediation: Always set the Secure flag alongside SameSite=None. Enforce HTTPS for all endpoints that issue cookies.

OWASP Web: A02:2025

MEDIUM FR-313 — Missing Secure Cookie Attribute: Secure

Description: A non-session cookie lacks the Secure attribute. Without Secure, the cookie is transmitted over unencrypted HTTP connections.

Remediation: Set the Secure flag on all cookies. Enforce HTTPS site-wide.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A02:2025

MITRE ATT&CK: T1539 (Collection), T1185 (Collection)

NIST 800-53: SC-8, IA-5, SC-23

PCI DSS 4: 6.4.1, 6.5.10

MEDIUM FR-314 — Missing Secure Cookie Attribute: HttpOnly

Description: A non-session cookie lacks the HttpOnly attribute. Without HttpOnly, client-side JavaScript can read the cookie value, enabling theft via XSS.

Remediation: Set the HttpOnly flag on all cookies that do not require JavaScript access.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A02:2025

MITRE ATT&CK: T1539 (Collection), T1185 (Collection)

NIST 800-53: SC-8, IA-5, SC-23

PCI DSS 4: 6.4.1, 6.5.10

MEDIUM FR-315 — Missing Secure Cookie Attribute: SameSite

Description: A cookie lacks the SameSite attribute. Without SameSite, the cookie is sent with cross-site requests, enabling CSRF attacks.

Remediation: Set SameSite=Strict or SameSite=Lax on all cookies. Use SameSite=None only when cross-site sharing is required (and always with Secure).

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A04:2025

MITRE ATT&CK: T1539 (Collection), T1185 (Collection)

NIST 800-53: SC-8, IA-5, SC-23

PCI DSS 4: 6.4.1, 6.5.10

MEDIUM FR-316 — Misconfigured Secure Cookie Attribute: SameSite

Description: A cookie has a misconfigured SameSite attribute (e.g., SameSite=None without Secure). Misconfigured SameSite settings can negate CSRF protections or expose cookies over plaintext HTTP.

Remediation: Audit all cookie SameSite configurations. Set SameSite=Strict where possible and always pair SameSite=None with Secure.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A04:2025

MITRE ATT&CK: T1539 (Collection), T1185 (Collection)

NIST 800-53: SC-8, IA-5, SC-23

PCI DSS 4: 6.4.1, 6.5.10

MEDIUM FR-317 — No Logout (Logoff) Function Detected

Description: No logout or logoff function was identified in the application. Without an explicit logout mechanism, users cannot terminate their sessions, and sessions remain active until they expire naturally.

Remediation: Implement a logout endpoint that invalidates the server-side session and clears session cookies. Make the logout function visible and accessible from all authenticated pages.

OWASP Web: A07:2025

MEDIUM FR-318 — No Concurrent Session Limit Detected

Description: The application allows unlimited concurrent sessions for a single user account. Without a concurrent session limit, compromised credentials can be exploited from multiple locations simultaneously without detection.

Remediation: Implement a concurrent session limit appropriate to the application's risk profile. Alert users when new sessions are established from new locations.

OWASP Web: A07:2025

INFO FR-319 — Concurrent Session Limit Enforced

Description: The application enforces a concurrent session limit. When a new session is established, existing sessions are invalidated. This limits the damage from compromised credentials.

Remediation: No remediation required. This is a positive security control.

OWASP Web: A07:2025

HIGH FR-320 — CORS Misconfiguration Allowing Credential Leakage

Description: The CORS configuration reflects arbitrary origins with Access-Control-Allow-Credentials: true. This allows attacker-controlled websites to make credentialed cross-origin requests and read the response, enabling session hijacking and sensitive data theft.

Remediation: Do not reflect arbitrary origins in Access-Control-Allow-Origin when credentials are enabled. Maintain an explicit allowlist of trusted origins.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

OWASP Web: A05:2025

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1189 (Initial Access)

NIST 800-53: CM-6, SC-8

PCI DSS 4: 6.2.4

HIGH FR-321 — JSONP Endpoint — Cross-Origin Data Leakage

Description: A JSONP endpoint was identified. JSONP endpoints allow any website to read the response content by including a script tag, bypassing the Same-Origin Policy and enabling cross-origin data exfiltration.

Remediation: Replace JSONP with CORS. If JSONP must be retained, validate the callback parameter against a strict allowlist and enforce authentication.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

OWASP Web: A05:2025

OWASP API: API7:2023 – Server Side Request Forgery

MITRE ATT&CK: T1185 (Collection), T1530 (Collection)

NIST 800-53: AC-4, SC-8

PCI DSS 4: 6.4.1, 6.5.1

HIGH FR-322 — Cross-Site Request Forgery (CSRF) — Missing Token

Description: A state-changing request (POST, PUT, PATCH, DELETE) does not include a CSRF token or other origin verification mechanism. Attackers can trick authenticated users into making unintended requests from any website.

Remediation: Implement CSRF protection using synchroniser tokens, double-submit cookies, or SameSite=Strict/Lax cookies. Verify the Origin or Referer header for same-site enforcement.

OWASP Web: A04:2025

HIGH FR-323 — Unauthenticated Access to Protected Path

Description: A path or endpoint that should require authentication returned a successful response (HTTP 200) without providing valid credentials. This allows unauthenticated users to access protected functionality or data.

Remediation: Apply authentication middleware to all protected routes. Adopt a default-deny access policy.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A01:2025

OWASP API: API5:2023 – Broken Function Level Authorization

MITRE ATT&CK: T1190 (Initial Access), T1078 (Initial Access)

NIST 800-53: AC-3, AC-2

PCI DSS 4: 7.2.1, 8.2.1

HIGH FR-324 — Debug Mode Enabled / Developer Console Exposed

Description: A debug mode or developer console is enabled and publicly accessible. Debug interfaces may expose command execution, environment variables, stack traces, and database query information.

Remediation: Disable debug mode in production. Remove all debug endpoints and developer consoles from production deployments.

OWASP Web: A05:2025

HIGH FR-325 — Cross-User Data Leakage (IDOR)

Description: Data belonging to one user was returned when authenticated as a different user by manipulating object identifiers. This constitutes Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization (BOLA).

Remediation: Implement server-side authorisation checks on every request that accesses user-specific data. Never rely on client-supplied IDs as the sole access control mechanism.

OWASP Web: A01:2025

HIGH FR-326 — Broken Object Level Authorization (IDOR / BOLA)

Description: Object-level authorisation is insufficient. Manipulation of object identifiers (IDs, UUIDs, slugs) allows access to resources belonging to other users without being authorised.

Remediation: Validate that the authenticated user is authorised to access the requested object on every API call. Use indirect object references or verify ownership server-side.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2025

OWASP API: API1:2023 – Broken Object Level Authorization

MITRE ATT&CK: T1078 (Defense Evasion)

NIST 800-53: AC-3

PCI DSS 4: 7.2.1

HIGH FR-327 — Broken Function Level Authorization (BFLA)

Description: Function-level authorisation is insufficient. A lower-privileged user can access administrative or elevated-privilege endpoints by directly requesting them.

Remediation: Implement role-based access control checks on every function/endpoint. Deny access by default and explicitly grant it based on user role.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2025

OWASP API: API5:2023 – Broken Function Level Authorization

MITRE ATT&CK: T1078 (Privilege Escalation), T1068 (Privilege Escalation)

NIST 800-53: AC-3, AC-6

PCI DSS 4: 7.2.1

HIGH FR-328 — BFLA: Role Can Access Admin Path

Description: A lower-privileged role was able to access an administrative path. This demonstrates a broken function-level access control vulnerability.

Remediation: Restrict all admin paths to authorised roles only. Implement server-side role checks on every request to administrative endpoints.

OWASP Web: A01:2025

HIGH FR-329 — Mass Assignment / Privilege Escalation via Parameter Binding

Description: The application binds user-supplied request parameters directly to server-side objects without filtering. This allows attackers to set properties they should not be able to modify, including role, privilege, or verified status.

Remediation: Explicitly allowlist the parameters that can be bound from user input. Never bind the entire request body to a domain object without filtering.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A04:2025

OWASP API: API6:2023 – Unrestricted Access to Sensitive Business Flows

MITRE ATT&CK: T1078 (Privilege Escalation)

NIST 800-53: AC-3, SI-10

PCI DSS 4: 6.2.4

HIGH FR-330 — API Endpoint Returns Same Data for All Users

Description: An API endpoint returns identical data regardless of the authenticated user's identity. This may indicate missing authorisation checks, allowing cross-user data leakage.

Remediation: Implement per-user data filtering at the API layer. Ensure all data responses are scoped to the authenticated user's authorised objects.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A01:2025

OWASP API: API1:2023 – Broken Object Level Authorization

MITRE ATT&CK: T1530 (Collection), T1213 (Collection)

NIST 800-53: AC-3, AC-4

PCI DSS 4: 7.2.1

MEDIUM FR-331 — Exposed Metrics Endpoint with Sensitive Data

Description: An application metrics or health check endpoint is publicly accessible and exposes sensitive information such as database credentials, internal hostnames, configuration values, or memory contents.

Remediation: Restrict metrics endpoints to internal networks or require authentication. Remove sensitive data from metric exports.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2025

OWASP API: API7:2023 – Server Side Request Forgery

MITRE ATT&CK: T1592.002 (Reconnaissance), T1552.001 (Credential Access)

NIST 800-53: CM-7, AC-3, SI-12

PCI DSS 4: 6.5.1, 1.3.2

HIGH FR-332 — Business Logic — Hidden Price/Value Field Tampering

Description: A hidden form field or request parameter controlling a monetary or critical value (e.g., price, quantity, discount) can be modified by the client to alter server-side business logic outcomes.

Remediation: Validate all price and value calculations server-side. Never trust client-supplied price or quantity fields. Recompute values from authoritative server-side data at checkout/submission.

OWASP Web: A04:2025

HIGH FR-333 — Business Logic — Numeric Field Accepts Negative/Zero Value

Description: A numeric field (e.g., quantity, amount) accepts negative or zero values that the business logic does not validate, potentially enabling free items, credit generation, or account balance manipulation.

Remediation: Implement server-side range validation for all numeric inputs. Reject negative or zero values where they are not business-valid.

OWASP Web: A04:2025

HIGH FR-334 — Business Logic — Potential Race Condition (Duplicate Submission)

Description: Rapid concurrent submissions of the same request produce responses suggesting duplicate processing. A race condition may allow double-spending, duplicate coupon redemption, or bypassing single-use controls.

Remediation: Implement idempotency tokens for state-changing requests. Use database-level transactions and atomic operations to prevent race conditions.

OWASP Web: A04:2025

HIGH FR-335 — Business Logic — Workflow Step Directly Accessible

Description: A multi-step workflow step is directly accessible without completing preceding steps. This allows skipping of security controls, validation steps, or payment steps in the workflow.

Remediation: Enforce workflow state server-side. Verify that all prerequisite steps have been completed before allowing access to subsequent steps. Use server-side state machine validation.

OWASP Web: A04:2025

LOW FR-336 — GraphQL Field Suggestions Enabled

Description: GraphQL field suggestions are enabled. When an invalid field name is queried, the server responds with suggestions for similar valid field names. This assists attackers in enumerating the GraphQL schema without introspection access.

Remediation: Disable field suggestions in the GraphQL server configuration (e.g., in Apollo Server, disable suggestions via the formatError hook).

OWASP Web: A05:2025

MEDIUM FR-337 — GraphQL Batch Query Attack Possible

Description: GraphQL batch query execution is enabled without rate limiting. Batching allows multiple operations in a single request, enabling brute-force attacks on authentication fields and bypassing per-request rate limits.

Remediation: Limit the number of operations allowed in a single GraphQL batch request. Apply per-operation rate limiting.

OWASP Web: A04:2025

HIGH FR-338 — Public Exploit Available

Description: A public exploit was found matching an identified software component or version. The existence of a public exploit significantly lowers the bar for an attacker to successfully compromise the application.

Remediation: Apply the relevant security patch or upgrade the affected software component immediately. If patching is not immediately possible, implement compensating controls.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A06:2025

MITRE ATT&CK: T1190 (Initial Access), T1203 (Execution)

NIST 800-53: SI-2, RA-5, RA-3

PCI DSS 4: 6.3.3

HIGH FR-339 — Information Disclosure: Credentials in URL Query Parameters

Description: Credentials or session tokens were found transmitted in URL query parameters. URL query parameters are stored in browser history, web server logs, and HTTP referer headers, leading to inadvertent credential exposure.

Remediation: Transmit credentials exclusively in the HTTP request body or Authorization header. Never include sensitive values in URLs.

OWASP Web: A02:2025

INFO FR-340 — WAF/CDN Possible Session Termination

Description: An unexpected HTTP status was returned by the target, suggesting a possible session termination by WAF bot-detection heuristics. The authenticated session may no longer be valid.

Remediation: Verify that the authenticated session is still valid. If the session was terminated, re-authenticate and resume the scan.

OWASP Web: A07:2025 Identification and Authentication Failures

INFO FR-341 — Admin Panel Exposed: {apath}

INFO FR-342 — CDN Active: {_recon_cdn}

Impact: Active CDN detection reveals the content delivery and security infrastructure protecting the application. An attacker uses this to identify CDN-specific bypass techniques, origin server discovery methods, and CDN configuration weaknesses.

INFO FR-343 — CMS Detected: {cms}

INFO FR-344 — Credentials/Secret in JavaScript: {secret_type}

INFO FR-345 — Deprecated Protocol Enabled: {_tsf_proto}

INFO FR-346 — Endpoint-Specific Security Header Found: {_hn}

INFO FR-347 — Exposed Admin/Debug Endpoint: {path}

INFO FR-348 — Hidden Parameter Discovered: {param}

INFO FR-349 — HTTP Header Fingerprints {_fp_tech}: {hdr_name}

INFO FR-350 — HTTP Header Fingerprints {_pn_fp_tech}: {pname}

INFO FR-351 — HTTP Method Tampering: {method} Accepted

INFO FR-352 — JWT Token Identified: Algorithm {alg}

INFO FR-353 — Missing Security Header: {_hdr_name}

Impact: Missing HTTP security headers reduce the browser's ability to enforce security boundaries, potentially exposing the application to client-side attacks. Each absent header represents a defense-in-depth layer that an attacker can bypass.

INFO FR-354 — Missing Security Header: {_hn}

Impact: Missing HTTP security headers reduce the browser's ability to enforce security boundaries, potentially exposing the application to client-side attacks. Each absent header represents a defense-in-depth layer that an attacker can bypass.

INFO FR-355 — Missing Security Header: {hdr_name}

Impact: Missing HTTP security headers reduce the browser's ability to enforce security boundaries, potentially exposing the application to client-side attacks. Each absent header represents a defense-in-depth layer that an attacker can bypass.

INFO FR-356 — Missing Security Header: {hdr}

Impact: Missing HTTP security headers reduce the browser's ability to enforce security boundaries, potentially exposing the application to client-side attacks. Each absent header represents a defense-in-depth layer that an attacker can bypass.

INFO FR-357 — Nuclei: {ntitle}

INFO FR-358 — PHP Error Log Exposed: {_el}

INFO FR-359 — Potential CDN Origin Bypass: {_recon_cdn}

INFO FR-360 — Public Exploit Available: {term}

INFO FR-361 — Sensitive File Exposed: {fpath}

INFO FR-362 — Sensitive Information in Source: {_sp_label}

INFO FR-363 — Sensitive Path Accessible: {cpath}

INFO FR-364 — Sensitive WordPress Path Accessible: {_ep}

INFO FR-365 — Server-Side Request Forgery (SSRF) — {ssrf_desc}

INFO FR-366 — Software Version Disclosed: {_vname} {_vver}

Impact: Disclosed software versions allow an attacker to search vulnerability databases for known CVEs affecting that specific version, reducing the effort required for targeted exploitation. Version information also reveals the organization's patching cadence and maintenance practices.

INFO FR-367 — SSL/TLS Grade: {_ts_grade}

Impact: The SSL/TLS grade reflects the overall strength of the server's TLS configuration including protocol versions, cipher suites, and certificate properties. A low grade indicates multiple weaknesses that collectively reduce the confidentiality and integrity of encrypted communications.

INFO FR-368 — SSL/TLS Vulnerability (Potential): {_tsf_id}

INFO FR-369 — SSL/TLS Vulnerability: {_tsf_id}

INFO FR-370 — Subdomain Takeover Indicator ({service})

INFO FR-371 — Subdomain Takeover — Dangling CNAME ({service})

INFO FR-372 — TimThumb Script Detected: {_t_name}{_tv2_str}

INFO FR-373 — Unauthenticated {_bi_name} Access: {_bi_desc}

INFO FR-374 — Unknown Header Identified: {hdr_name}

INFO FR-375 — Unknown Header Identified: {pname}

INFO FR-376 — Virtual Host Discovered: {full_vhost}

INFO FR-377 — WAF / Edge Security Platform Active: {_waf_names}

INFO FR-378 — WAF/CDN Challenge Page Active: {waf_cdn}

INFO FR-379 — WAF/CDN IP Block Detected: {waf_cdn}

Impact: Detection of WAF/CDN IP ranges confirms that direct access to the origin server is mediated by a security proxy. An attacker targets CDN bypass techniques (IP history, DNS records, misconfigurations) to reach the unprotected origin.

INFO FR-380 — WAF/CDN Possible Session Termination: {waf_cdn}

INFO FR-381 — WAF/CDN Session Termination Detected: {waf_cdn}

INFO FR-382 — Web Cache Poisoning: {_wcp_hdr} Reflected

INFO FR-383 — Wildcard (*) Detected: {url}

INFO FR-384 — WordPress Backup/Export File Exposed: {_bkp}

INFO FR-385 — WordPress Configuration Backup Exposed: {_cb}

INFO FR-386 — WordPress Directory Listing Enabled: {_dp}

INFO FR-387 — WordPress Parent Theme Detected: {_pt_name}{_pt_ver_str}

INFO FR-388 — WordPress Plugins Detected in Page Source ({len(_passive_plugins)} plugin(s))

INFO FR-389 — WordPress User Enumeration via Author Archives ({len(_author_users)} user(s))

INFO FR-390 — WordPress Users Exposed via REST API ({len(_ru_extracted)} user(s))

INFO FR-391 — Information Disclosure: WordPress Version

INFO FR-392 — Authentication Failure Detected

INFO FR-393 — Login Page Identified

INFO FR-394 — Missing Security Headers

Impact: Missing HTTP security headers reduce the browser's ability to enforce security boundaries, potentially exposing the application to client-side attacks including XSS, clickjacking, and MIME-type confusion. Implementing these headers is a low-effort, high-value hardening measure.

INFO FR-395 — Multi-Factor Authentication Detected

INFO FR-396 — No Web Structure Identified

Impact: The absence of web directory structure may indicate a single-page application, API-only service, or heavily restricted web root. This finding informs testing methodology — the tester should pivot to API enumeration and client-side analysis.

INFO FR-397 — SSL/TLS Certificate: Chain Incomplete

Impact: An incomplete certificate chain prevents clients from validating the certificate's trust path. Some clients may reject the connection outright, while others silently proceed without full validation, creating inconsistent security posture across the user base.

Remediation: Replace certificates with validity exceeding 398 days (Apple/browser-enforced limit). Ensure all certificates include Subject Alternative Names (SANs). Fix incomplete certificate chains by installing intermediate CA certificates. Automate certificate renewal with Let's Encrypt or ACME protocol. Use certificates with RSA-2048+ or ECDSA-256+ keys.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1552.004 (Credential Access)

NIST 800-53: SC-17, IA-5

PCI DSS 4: 4.2.1

INFO FR-398 — SSL/TLS Certificate: Long Duration

Impact: Long-lived certificates increase the window of exposure if the private key is compromised. Industry best practice limits certificate lifetime to reduce the impact of key compromise and ensure regular rotation of cryptographic material.

Remediation: Replace certificates with validity exceeding 398 days (Apple/browser-enforced limit). Ensure all certificates include Subject Alternative Names (SANs). Fix incomplete certificate chains by installing intermediate CA certificates. Automate certificate renewal with Let's Encrypt or ACME protocol. Use certificates with RSA-2048+ or ECDSA-256+ keys.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1552.004 (Credential Access)

NIST 800-53: SC-17, IA-5

PCI DSS 4: 4.2.1

INFO FR-399 — SSL/TLS Certificate: Missing SAN

Impact: A certificate without Subject Alternative Names (SAN) relies solely on the Common Name field for hostname validation. Modern browsers require SAN entries and may reject CN-only certificates, causing service interruptions and security warnings.

Remediation: Replace certificates with validity exceeding 398 days (Apple/browser-enforced limit). Ensure all certificates include Subject Alternative Names (SANs). Fix incomplete certificate chains by installing intermediate CA certificates. Automate certificate renewal with Let's Encrypt or ACME protocol. Use certificates with RSA-2048+ or ECDSA-256+ keys.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1552.004 (Credential Access)

NIST 800-53: SC-17, IA-5

PCI DSS 4: 4.2.1

INFO FR-400 — SSL/TLS Certificate: Serial Number Entropy

Impact: Low entropy in certificate serial numbers indicates weak random number generation in the issuing CA's infrastructure. This can enable serial number prediction attacks that facilitate certificate forgery.

Remediation: Informational: review the certificate issuer chain to confirm only trusted, internal or public CAs are authorised to issue certificates for this domain. Enrol the domain in Certificate Transparency monitoring (e.g., crt.sh alerts) to detect unauthorised issuance. Verify serial number entropy meets CABF Baseline Requirements (>= 64 bits).

Effort: Low

MITRE ATT&CK: T1596.003 (Reconnaissance)

NIST 800-53: SC-17

PCI DSS 4: 4.2.1

INFO FR-401 — SSL/TLS Certificate: Weak Encryption Method

Impact: Certificates signed with weak algorithms (SHA-1, MD5) are vulnerable to collision attacks that allow an attacker to forge a certificate with the same signature, enabling man-in-the-middle attacks that bypass certificate validation entirely.

Remediation: Replace certificates with validity exceeding 398 days (Apple/browser-enforced limit). Ensure all certificates include Subject Alternative Names (SANs). Fix incomplete certificate chains by installing intermediate CA certificates. Automate certificate renewal with Let's Encrypt or ACME protocol. Use certificates with RSA-2048+ or ECDSA-256+ keys.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1552.004 (Credential Access)

NIST 800-53: SC-17, IA-5

PCI DSS 4: 4.2.1

INFO FR-402 — SSL/TLS Cipher: No Cipher Order Configured

Impact: Without server-enforced cipher order, the client's cipher preference is used, which may select weaker ciphers over stronger alternatives. An attacker can manipulate the client to negotiate weak ciphers through downgrade attacks.

Remediation: Disable SSLv2, SSLv3, TLS 1.0, and TLS 1.1. Remove NULL, EXPORT, RC4, DES, 3DES, and ANON cipher suites. Enable server cipher order preference. Configure TLS session tickets securely or disable. Use testssl.sh or SSLLabs to validate. Require TLS 1.2 as minimum with TLS 1.3 preferred.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28, CM-6

PCI DSS 4: 4.2.1, 2.2.4

INFO FR-403 — SSL/TLS Ciphers: Obsolete Ciphers

Impact: Obsolete cipher suites such as RC4 and CBC-mode ciphers are vulnerable to known cryptographic attacks including CVE-2013-2566 (RC4 key stream bias) and CVE-2015-2808 (Bar Mitzvah attack). An attacker performing passive traffic capture can recover plaintext from sessions negotiated with these ciphers, compromising the confidentiality of all transmitted data including credentials and session tokens.

Remediation: Disable SSLv2, SSLv3, TLS 1.0, and TLS 1.1. Remove NULL, EXPORT, RC4, DES, 3DES, and ANON cipher suites. Enable server cipher order preference. Configure TLS session tickets securely or disable. Use testssl.sh or SSLLabs to validate. Require TLS 1.2 as minimum with TLS 1.3 preferred.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28, CM-6

PCI DSS 4: 4.2.1, 2.2.4

INFO FR-404 — SSL/TLS Session: Long Duration

Impact: Excessively long TLS session lifetimes increase the window for session resumption attacks and reduce the effectiveness of forward secrecy. Compromised session tickets remain valid for the entire session duration.

Remediation: Disable SSLv2, SSLv3, TLS 1.0, and TLS 1.1. Remove NULL, EXPORT, RC4, DES, 3DES, and ANON cipher suites. Enable server cipher order preference. Configure TLS session tickets securely or disable. Use testssl.sh or SSLLabs to validate. Require TLS 1.2 as minimum with TLS 1.3 preferred.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28, CM-6

PCI DSS 4: 4.2.1, 2.2.4

HIGH FR-405 — BFLA: Role '{low_role}' Can Access Admin Path

Description: A lower-privileged role can access an administrative endpoint that should be restricted to higher-privilege roles, indicating a Broken Function Level Authorization (BFLA) vulnerability.

Impact: An attacker with a low-privilege account can access administrative functionality, potentially managing users, configurations, or sensitive data beyond their intended authorization level.

Remediation: Implement server-side role-based access control checks on all administrative endpoints. Deny access for roles below the required privilege level and return 403 Forbidden.

Effort: Moderate

OWASP Web: A01:2025 Broken Access Control

OWASP API: API5:2023 Broken Function Level Authorization

MITRE ATT&CK: T1078 (Initial Access)

NIST 800-53: AC-3, AC-6

PCI DSS 4: 7.2.2

MEDIUM FR-406 — CBC Mode Cipher Suites Accepted

Description: The server accepts TLS cipher suites using Cipher Block Chaining (CBC) mode, which are vulnerable to padding oracle attacks such as BEAST and LUCKY13.

Impact: An attacker may exploit CBC padding oracle vulnerabilities to decrypt TLS traffic or recover plaintext data from encrypted sessions.

Remediation: Disable CBC-mode cipher suites on the server. Prefer AEAD ciphers such as AES-GCM or ChaCha20-Poly1305.

Effort: Moderate

OWASP Web: A02:2025 Cryptographic Failures

NIST 800-53: SC-8, SC-13

PCI DSS 4: 4.2.1

MEDIUM FR-407 — SSL/TLS Forward Secrecy: Cipher Suites

Description: The server accepts cipher suites that do not provide forward secrecy (e.g., RSA key exchange without ECDHE or DHE), meaning past sessions can be decrypted if the server's private key is compromised.

Impact: If the server's private key is later compromised, all previously recorded TLS sessions using these cipher suites can be retroactively decrypted, exposing all historical encrypted communications.

Remediation: Configure the server to only accept cipher suites with forward secrecy (ECDHE or DHE key exchange). Disable static RSA key exchange.

Effort: Moderate

OWASP Web: A02:2025 Cryptographic Failures

NIST 800-53: SC-8, SC-12

PCI DSS 4: 4.2.1

HIGH FR-408 — HTTP Request Smuggling — CL.0 Client-Side Desync

Description: The server is vulnerable to CL.0 client-side desync, a variant of HTTP request smuggling where the server ignores a Content-Length header on requests to specific endpoints, causing the connection to desynchronize.

Impact: An attacker can poison the connection between a victim's browser and the server, hijacking subsequent requests to steal credentials, bypass access controls, or deliver malicious responses to other users.

Remediation: Ensure all server components and reverse proxies consistently handle Content-Length headers. Disable HTTP/1.1 connection reuse where not required, or upgrade to HTTP/2 end-to-end.

Effort: Significant

OWASP Web: A05:2025 Security Misconfiguration

MITRE ATT&CK: T1557 (Credential Access)

NIST 800-53: SI-10, SC-7

HIGH FR-409 — HTTP Request Smuggling — CL.TE Desync

Description: The front-end server uses Content-Length while the back-end uses Transfer-Encoding, allowing an attacker to smuggle a second request within the body of the first.

Impact: An attacker can bypass security controls, poison web caches, hijack other users' requests, or escalate privileges by injecting malicious requests that bypass the front-end proxy.

Remediation: Ensure all servers in the chain use the same method to determine request boundaries. Configure the front-end to normalize ambiguous requests and reject those with both CL and TE headers.

Effort: Significant

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: SI-10, SC-7

HIGH FR-410 — HTTP Request Smuggling — TE Obfuscation Desync

Description: The server is vulnerable to Transfer-Encoding obfuscation, where variations of the TE header (e.g., extra whitespace, line folding, chunked1) cause front-end and back-end to disagree on request boundaries.

Impact: An attacker can exploit TE header parsing differences to smuggle requests past the front-end, enabling cache poisoning, request hijacking, and access control bypass.

Remediation: Reject requests with obfuscated Transfer-Encoding headers. Ensure all proxies and servers normalize and validate TE headers identically.

Effort: Significant

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: SI-10, SC-7

HIGH FR-411 — HTTP Request Smuggling — TE.CL Desync

Description: The front-end server uses Transfer-Encoding while the back-end uses Content-Length, allowing an attacker to smuggle a second request by manipulating chunked encoding boundaries.

Impact: An attacker can bypass security controls, poison web caches, hijack other users' requests, or escalate privileges by injecting malicious requests past the front-end proxy.

Remediation: Ensure all servers in the chain agree on request boundary determination. Configure back-end servers to prefer Transfer-Encoding over Content-Length, or reject ambiguous requests.

Effort: Significant

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: SI-10, SC-7

HIGH FR-412 — Host-Header SSRF Surface ({label})

Description: The application reflects or acts upon the Host header value in server-side operations, creating a potential Server-Side Request Forgery (SSRF) attack surface via host header injection.

Impact: An attacker can manipulate the Host header to redirect internal server requests to attacker-controlled infrastructure, potentially accessing internal services, exfiltrating data, or bypassing authentication mechanisms.

Remediation: Validate the Host header against an allowlist of expected hostnames. Do not use the Host header value in server-side URL construction or redirect logic.

Effort: Moderate

OWASP Web: A10:2025 Server-Side Request Forgery

MITRE ATT&CK: T1090 (Command and Control)

NIST 800-53: SI-10, AC-4

HIGH FR-413 — JWT Signing Secret Brute-Force Recovered ({alg})

Description: The JWT signing secret was recovered through brute-force or dictionary attack, allowing an attacker to forge valid tokens with arbitrary claims.

Impact: An attacker can create forged JWT tokens with elevated privileges, impersonate any user, bypass authentication entirely, and gain unauthorized access to all application functionality.

Remediation: Use a cryptographically strong random secret (256+ bits of entropy) for HMAC-based JWT signing. Consider switching to asymmetric signing (RS256/ES256) where the private key never leaves the server.

Effort: Easy

OWASP Web: A02:2025 Cryptographic Failures

MITRE ATT&CK: T1110 (Credential Access)

NIST 800-53: IA-5, SC-12

PCI DSS 4: 8.3.6

INFO FR-414 — Load Balancer Detected: {_lb_label}

Description: A load balancer, CDN, or reverse proxy was detected in front of the target application based on response headers, cookies, or behavioral fingerprints.

Impact: Knowledge of the load balancing infrastructure helps an attacker understand the network topology and may reveal vendor-specific vulnerabilities or bypass techniques for WAF/IDS systems.

Remediation: Suppress load balancer identification headers (e.g., Via, X-Served-By, X-Cache) in client-facing responses. This is informational and does not require immediate remediation.

Effort: Easy

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: SI-11

LOW FR-415 — Missing Subresource Integrity — {entry['tag']} from {entry['host']}

Description: An HTML page loads a script or stylesheet from an external CDN or third-party host without a Subresource Integrity (SRI) hash attribute, allowing a compromised CDN to inject malicious code.

Impact: If the external CDN is compromised, an attacker can inject arbitrary JavaScript or CSS into pages that include the resource, enabling cross-site scripting, credential theft, or session hijacking for all users.

Remediation: Add integrity and crossorigin attributes to all <script> and <link> tags loading external resources. Generate SRI hashes using sha384 or sha512.

Effort: Easy

OWASP Web: A08:2025 Software and Data Integrity Failures

NIST 800-53: SI-7

MEDIUM FR-416 — Nikto: {_nik_title}

Description: A web server vulnerability or misconfiguration was identified by the Nikto scanner that does not map to a known Fracture finding category. The specific details are in the finding title.

Impact: The specific impact depends on the vulnerability identified. Nikto findings typically indicate server misconfigurations, information disclosure, or known software vulnerabilities that could be exploited for unauthorized access or data exposure.

Remediation: Review the specific Nikto finding details and apply the recommended remediation for the identified vulnerability or misconfiguration.

Effort: Moderate

OWASP Web: A06:2025 Vulnerable and Outdated Components

NIST 800-53: SI-2

MEDIUM FR-417 — Non-Standard Cipher Suites Accepted

Description: The server accepts non-standard or experimental TLS cipher suites that may not have undergone the same level of cryptographic review as standard IANA-registered suites.

Impact: Non-standard cipher suites may contain implementation flaws or use untested cryptographic constructions, potentially allowing an attacker to exploit weaknesses for traffic decryption or session compromise.

Remediation: Configure the server to accept only well-known, IANA-registered cipher suites. Remove any experimental, vendor-specific, or non-standard cipher suites from the configuration.

Effort: Moderate

OWASP Web: A02:2025 Cryptographic Failures

NIST 800-53: SC-8, SC-13

PCI DSS 4: 4.2.1

HIGH FR-418 — Reflected Cross-Site Scripting (XSS) — POST Parameter

Description: A POST request parameter is reflected in the server's response without proper output encoding, allowing injection of malicious JavaScript that executes in the victim's browser context.

Impact: An attacker can craft a malicious form submission that, when submitted by a victim, executes arbitrary JavaScript in their browser. This enables session hijacking, credential theft, account takeover, and delivery of malicious content.

Remediation: Implement context-aware output encoding for all user-supplied data reflected in HTML responses. Use Content-Security-Policy to mitigate residual XSS risks.

Effort: Moderate

OWASP Web: A03:2025 Injection

MITRE ATT&CK: T1059.007 (Execution)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

MEDIUM FR-419 — SHA-1 HMAC Cipher Suites Accepted

Description: The server accepts TLS cipher suites using SHA-1 for HMAC authentication. SHA-1 is considered cryptographically weak due to demonstrated collision attacks.

Impact: While practical exploitation of SHA-1 HMAC in TLS is currently difficult, the use of SHA-1 does not meet modern cryptographic standards. Future attacks may make exploitation feasible, and compliance frameworks increasingly prohibit SHA-1.

Remediation: Configure the server to prefer cipher suites using SHA-256 or SHA-384 for HMAC. Disable all SHA-1-based cipher suites.

Effort: Moderate

OWASP Web: A02:2025 Cryptographic Failures

NIST 800-53: SC-13

PCI DSS 4: 4.2.1

MEDIUM FR-420 — SSL/TLS Forward Secrecy: {_tsf_id}

Description: A specific forward secrecy configuration issue was identified by testssl. The finding ID provides details on the exact cipher suite or key exchange mechanism lacking forward secrecy.

Impact: Without forward secrecy, if the server's long-term private key is compromised at any point in the future, all previously recorded encrypted sessions using affected cipher suites can be retroactively decrypted.

Remediation: Enable forward secrecy by configuring the server to use ECDHE or DHE key exchange exclusively. Disable static RSA key exchange and any cipher suites that do not provide forward secrecy.

Effort: Moderate

OWASP Web: A02:2025 Cryptographic Failures

NIST 800-53: SC-8, SC-12

PCI DSS 4: 4.2.1

LOW FR-421 — SSL/TLS Vulnerability: Lucky13 [UNCONFIRMED]

Description: The server may be vulnerable to the LUCKY13 timing attack, a padding oracle attack against TLS CBC-mode cipher suites that exploits timing differences in MAC verification.

Impact: A sophisticated attacker on the network path could potentially recover plaintext from TLS-encrypted sessions by measuring timing variations in the server's response to crafted ciphertext. The attack is theoretically possible but practically difficult to exploit.

Remediation: Disable CBC-mode cipher suites and prefer AEAD ciphers (AES-GCM, ChaCha20-Poly1305). If CBC must be supported, ensure the TLS implementation includes constant-time MAC verification.

Effort: Moderate

OWASP Web: A02:2025 Cryptographic Failures

NIST 800-53: SC-8, SC-13

MEDIUM FR-422 — TLSv1.3 Not Supported

Description: The server does not support TLS 1.3, the latest version of the Transport Layer Security protocol, which provides improved security and performance over TLS 1.2.

Impact: Without TLS 1.3, the server lacks protections including mandatory forward secrecy, removal of legacy cipher suites, encrypted handshake, and 0-RTT resumption. Clients connecting with TLS 1.2 may use weaker cipher suites.

Remediation: Enable TLS 1.3 support on the server. Most modern web servers and load balancers support TLS 1.3 with a configuration change.

Effort: Easy

OWASP Web: A02:2025 Cryptographic Failures

NIST 800-53: SC-8

PCI DSS 4: 4.2.1

HIGH FR-423 — Vulnerable Component: {pname} {version}

Description: A third-party software component with known vulnerabilities was identified in the application's technology stack. The specific component name and version are in the finding title.

Impact: Known vulnerabilities in third-party components can be exploited by attackers using publicly available exploit code. Impact ranges from information disclosure to remote code execution depending on the specific vulnerability.

Remediation: Update the identified component to the latest patched version. If an update is not available, evaluate compensating controls or consider replacing the component with a maintained alternative.

Effort: Moderate

OWASP Web: A06:2025 Vulnerable and Outdated Components

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, RA-5

PCI DSS 4: 6.3.1

MEDIUM FR-424 — {proto} Enabled

Description: A deprecated or insecure protocol version is enabled on the server. The specific protocol (e.g., SSLv3, TLSv1.0, TLSv1.1) is identified in the finding title.

Impact: Deprecated protocols contain known vulnerabilities (POODLE for SSLv3, BEAST for TLSv1.0) that allow attackers to decrypt encrypted traffic. Compliance frameworks universally prohibit these protocols.

Remediation: Disable the deprecated protocol on the server and enforce TLS 1.2 as the minimum supported version, with TLS 1.3 preferred.

Effort: Easy

OWASP Web: A02:2025 Cryptographic Failures

NIST 800-53: SC-8

PCI DSS 4: 4.2.1

MEDIUM FR-425 — Cookie Prefix Violation: __Host-

Description: A cookie using the __Host- prefix does not meet RFC 6265bis requirements (must have Secure flag, Path=/, no Domain attribute).

Impact: An attacker may be able to set or overwrite the cookie from a subdomain or insecure context, bypassing the intended isolation guarantee.

Remediation: Ensure __Host- cookies include the Secure attribute, set Path=/, and omit the Domain attribute.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: SC-23

PCI DSS 4: 6.2.4

MEDIUM FR-426 — Cookie Prefix Violation: __Secure-

Description: A cookie using the __Secure- prefix is missing the Secure flag required by RFC 6265bis.

Impact: The cookie may be transmitted over unencrypted HTTP, exposing its value to network attackers.

Remediation: Set the Secure attribute on all __Secure- prefixed cookies.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: SC-23

PCI DSS 4: 6.2.4

LOW FR-427 — HSTS Not Preload-Ready

Description: The Strict-Transport-Security header is present but does not meet browser preload list requirements.

Impact: The site remains vulnerable to SSL-stripping on first visit until the HSTS header is received.

Remediation: Set max-age to at least 31536000 and add the includeSubDomains and preload directives.

Effort: Easy

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: SC-8

PCI DSS 4: 4.2.1

INFO FR-428 — Missing Cross-Origin Isolation Header: {header}

Description: One or more cross-origin isolation headers (COOP, COEP, CORP) are not set.

Impact: Without cross-origin isolation, the application may be susceptible to Spectre-class side-channel attacks or cross-origin information leaks.

Remediation: Set Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, and Cross-Origin-Resource-Policy headers as appropriate.

Effort: Moderate

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: SC-7

MEDIUM FR-429 — JavaScript Source Map Exposed

Description: A .js.map source map file is publicly accessible, exposing the original unminified source code.

Impact: Attackers can read original variable names, comments, internal API endpoints, and business logic to find vulnerabilities.

Remediation: Remove source map files from production deployments or restrict access to authenticated users.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

MITRE ATT&CK: T1592.004 (Reconnaissance)

NIST 800-53: SC-28

PCI DSS 4: 6.2.4

MEDIUM FR-430 — Inline Source Map in JavaScript Bundle

Description: A JavaScript bundle contains an inline sourceMappingURL data URI embedding the original source code.

Impact: The full original source code is delivered to every visitor, exposing internal logic and potential secrets.

Remediation: Remove inline source maps from production builds; configure the build tool to exclude sourceMappingURL from output.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: SC-28

LOW FR-431 — Content-Type Confusion

Description: The server responds with a Content-Type that does not match the requested Accept header without X-Content-Type-Options enforcement.

Impact: Browsers may interpret content differently than intended, potentially enabling MIME sniffing attacks.

Remediation: Set X-Content-Type-Options: nosniff and ensure Content-Type headers accurately reflect response body format.

Effort: Easy

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: SI-10

HIGH FR-432 — Server-Side Prototype Pollution

Description: The application processes JSON input containing __proto__ or constructor.prototype properties, allowing modification of object prototypes.

Impact: An attacker can inject properties into all JavaScript objects on the server, potentially achieving RCE, privilege escalation, or denial of service.

Remediation: Sanitize JSON input to strip __proto__ and constructor keys, or use Object.create(null) for parsed objects.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

OWASP Web: A03:2025 Injection

MITRE ATT&CK: T1059.007 (Execution)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

MEDIUM FR-433 — Potential Client-Side Prototype Pollution

Description: JavaScript files use known prototype pollution sinks such as Object.assign, _.merge, or $.extend with user-controllable input.

Impact: An attacker may be able to manipulate client-side object prototypes via URL parameters or form input, leading to XSS or logic bypass.

Remediation: Replace unsafe merge operations with Object.assign using Object.create(null) targets, or use libraries with prototype pollution protection.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP Web: A03:2025 Injection

NIST 800-53: SI-10

CRITICAL FR-434 — Server-Side Include (SSI) Injection

Description: The application processes SSI directives embedded in user input, allowing execution of server-side commands.

Impact: An attacker can execute arbitrary OS commands on the server, read sensitive files, or include remote content.

Remediation: Disable SSI processing or sanitize all user input to remove SSI directive syntax.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2025 Injection

MITRE ATT&CK: T1059 (Execution)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

HIGH FR-435 — Edge Side Include (ESI) Injection

Description: The application reflects user input through an ESI-capable cache layer, allowing injection of ESI include directives.

Impact: An attacker can perform SSRF through the cache layer, access internal services, or steal cached content from other users.

Remediation: Sanitize all user input to strip ESI tags, or disable ESI processing on the caching layer for user-controlled content.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A03:2025 Injection

MITRE ATT&CK: T1090 (Command and Control)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

HIGH FR-436 — Email Header Injection

Description: A contact or email form accepts CRLF sequences in input fields, allowing injection of additional email headers.

Impact: An attacker can inject Bcc/Cc headers to use the application as a spam relay, or modify email content for phishing.

Remediation: Strip or reject CRLF sequences in all fields used to construct email headers.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

OWASP Web: A03:2025 Injection

MITRE ATT&CK: T1566.002 (Initial Access)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

HIGH FR-437 — Unicode Normalization Bypass in Authentication

Description: The login form processes Unicode lookalike characters differently than expected, potentially mapping them to valid usernames.

Impact: An attacker can bypass authentication controls by submitting visually similar Unicode characters that normalize to a valid account name.

Remediation: Apply Unicode NFKC normalization consistently before all authentication comparisons, and reject non-ASCII usernames if not expected.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

NIST 800-53: IA-5

PCI DSS 4: 8.3.1

HIGH FR-438 — WebSocket Endpoint Missing Authentication

Description: A WebSocket endpoint accepts upgrade requests without requiring authentication credentials.

Impact: An attacker can connect to the WebSocket and access real-time data or perform actions without authenticating.

Remediation: Require authentication tokens or session cookies during the WebSocket upgrade handshake.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

NIST 800-53: IA-9

PCI DSS 4: 8.3.1

MEDIUM FR-439 — WebSocket Missing Origin Validation

Description: A WebSocket endpoint accepts connections from arbitrary origins without validating the Origin header.

Impact: An attacker can establish cross-site WebSocket connections from a malicious page, enabling cross-site WebSocket hijacking.

Remediation: Validate the Origin header during WebSocket upgrade and reject connections from untrusted origins.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A01:2025 Broken Access Control

NIST 800-53: SC-23

HIGH FR-440 — WebSocket Message Injection (XSS)

Description: The WebSocket endpoint reflects user-supplied message content without sanitization, enabling script injection.

Impact: An attacker can inject malicious scripts through WebSocket messages that execute in other connected clients' browsers.

Remediation: Sanitize all WebSocket message content before rendering in the client, and implement server-side input validation.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

OWASP Web: A03:2025 Injection

MITRE ATT&CK: T1059.007 (Execution)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

HIGH FR-441 — Web Cache Deception

Description: Appending a static file extension to authenticated URLs causes the CDN/proxy to cache and serve sensitive content publicly.

Impact: An attacker can trick users into visiting crafted URLs, causing their authenticated page content to be cached and retrievable by anyone.

Remediation: Configure the cache to respect Cache-Control headers and never cache responses based solely on URL extension; use Vary headers appropriately.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: SC-28

HIGH FR-442 — OAuth redirect_uri Open Redirect

Description: The OAuth authorization endpoint does not strictly validate the redirect_uri parameter, allowing redirection to attacker-controlled domains.

Impact: An attacker can steal authorization codes or tokens by redirecting users to a malicious callback URL.

Remediation: Enforce exact-match validation of redirect_uri against pre-registered values.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

MITRE ATT&CK: T1556 (Credential Access)

NIST 800-53: IA-8

MEDIUM FR-443 — OAuth Missing State Parameter (CSRF)

Description: The OAuth authorization flow does not require or validate a state parameter for CSRF protection.

Impact: An attacker can forge authorization requests and link their own OAuth account to a victim's session.

Remediation: Generate a cryptographically random state parameter per authorization request and validate it on the callback.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

NIST 800-53: IA-8

HIGH FR-444 — Information Disclosure: OAuth Token via URL

Description: The OAuth implementation uses the implicit flow, placing access tokens in URL fragments.

Impact: Access tokens can be stolen via browser history, proxy logs, or Referer header leakage to third-party resources.

Remediation: Migrate from the implicit flow to the authorization code flow with PKCE; never expose tokens in URLs.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

NIST 800-53: SC-12

HIGH FR-445 — OAuth Scope Escalation

Description: The OAuth authorization server grants elevated scopes beyond what the client originally requested.

Impact: An attacker can obtain tokens with broader permissions than intended.

Remediation: Enforce strict scope validation on the authorization server; only grant explicitly requested and pre-approved scopes.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2025 Broken Access Control

NIST 800-53: AC-6

CRITICAL FR-446 — MFA Bypass — Direct Navigation

Description: Protected pages are accessible by direct URL navigation after initial authentication, bypassing the MFA verification step.

Impact: An attacker who compromises a password can access the account without completing the second authentication factor.

Remediation: Enforce MFA completion as a server-side session state check on every protected endpoint, not just the login flow.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2025 Identification and Authentication Failures

MITRE ATT&CK: T1556 (Credential Access)

NIST 800-53: IA-2

PCI DSS 4: 8.4.2

MEDIUM FR-447 — MFA Missing Rate Limiting on OTP

Description: The MFA verification endpoint does not enforce rate limiting on OTP submission attempts.

Impact: An attacker can brute-force short OTP codes within the validity window to bypass MFA.

Remediation: Implement rate limiting and account lockout on the MFA verification endpoint after a small number of failed attempts.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

MITRE ATT&CK: T1110 (Credential Access)

NIST 800-53: IA-2

PCI DSS 4: 8.4.2

INFO FR-448 — API Endpoint Missing Rate Limiting

Description: An API endpoint does not enforce rate limiting, responding to 10 rapid requests without throttling.

Impact: An attacker can abuse the endpoint for data enumeration, credential stuffing, or resource exhaustion.

Remediation: Implement rate limiting on all API endpoints using token bucket or sliding window algorithms.

Effort: Moderate

OWASP Web: A04:2025 Insecure Design

NIST 800-53: SC-5

MEDIUM FR-449 — GraphQL Alias-Based Batching

Description: The GraphQL endpoint processes aliased duplicate queries in a single request, bypassing per-query rate limiting.

Impact: An attacker can issue hundreds of queries in one request to enumerate data or bypass authentication rate limits.

Remediation: Implement query complexity analysis that counts aliases as separate operations, and enforce per-operation rate limits.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A04:2025 Insecure Design

NIST 800-53: SC-5

MEDIUM FR-450 — GraphQL Circular Fragment Accepted

Description: The GraphQL endpoint accepts queries with circular fragment references that could cause infinite recursion.

Impact: An attacker can craft queries with circular fragments to cause excessive server-side processing or crashes.

Remediation: Implement fragment cycle detection in the GraphQL query validator to reject circular references.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

OWASP Web: A04:2025 Insecure Design

NIST 800-53: SC-5

INFO FR-451 — GraphQL Field Duplication Not Limited

Description: The GraphQL endpoint processes queries with many duplicated fields without limiting the result set.

Impact: An attacker can amplify response size by duplicating fields, potentially causing increased bandwidth usage.

Remediation: Implement query complexity limits that account for field duplication.

Effort: Moderate

OWASP Web: A04:2025 Insecure Design

NIST 800-53: SC-5

MEDIUM FR-452 — GraphQL Debug Extensions Exposed

Description: The GraphQL response includes an extensions field containing debug information.

Impact: Debug information reveals internal implementation details, query performance characteristics, and potential injection points.

Remediation: Disable GraphQL debug extensions in production environments.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: CM-7

MEDIUM FR-453 — HTTP/2 Cleartext Upgrade (h2c) Accepted

Description: The server or reverse proxy accepts HTTP/2 cleartext upgrade requests.

Impact: An attacker can use h2c smuggling to bypass proxy-level security controls, WAF rules, and access restrictions.

Remediation: Configure the reverse proxy to reject Upgrade: h2c requests or strip the header before forwarding.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: SC-8

HIGH FR-454 — h2c Smuggling — Internal Endpoint Accessible

Description: An internal endpoint that is blocked at the proxy level becomes accessible when requested via an h2c upgrade connection.

Impact: An attacker can access admin panels, monitoring dashboards, or internal APIs by tunneling through the h2c upgrade.

Remediation: Block h2c upgrades at the reverse proxy and implement authentication on all internal endpoints regardless of network position.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A01:2025 Broken Access Control

MITRE ATT&CK: T1090 (Command and Control)

NIST 800-53: AC-3

PCI DSS 4: 1.3.1

MEDIUM FR-455 — Information Disclosure: Internal IP in HTTP Response

Description: The HTTP response body or headers contain one or more RFC 1918 private IP addresses (10/8, 172.16/12, 192.168/16), disclosing internal network topology.

Impact: An attacker learns internal addressing, which aids lateral-movement planning, infrastructure mapping, and targeted exploitation of internal services.

Remediation: Remove internal IP addresses from HTTP response bodies, error messages, and headers. Configure application error handling to suppress internal details. Review proxy and load-balancer configurations to strip internal addresses from forwarded headers.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

MITRE ATT&CK: T1018 (Discovery)

NIST 800-53: SC-8, SI-11

PCI DSS 4: 6.5.10

MEDIUM FR-456 — Application Responses Identify Valid Accounts

Description: Login endpoint responses differ between valid and invalid usernames, allowing attackers to enumerate valid accounts through status codes, body length, error messages, or timing differences.

Impact: An attacker can confirm which usernames exist in the system, enabling targeted credential attacks (brute force, credential stuffing) and social engineering.

Remediation: Return identical responses (status code, body length, content, and timing) for all login attempts regardless of whether the username exists. Use generic error messages like 'Invalid credentials'.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

MITRE ATT&CK: T1078 (Initial Access)

NIST 800-53: IA-5

PCI DSS 4: 6.2.4

HIGH FR-457 — Authorization Gaps — Unauthenticated Access to Restricted Paths

Description: Administrative or restricted paths are accessible without authentication, indicating missing or misconfigured access controls.

Impact: An attacker can access administrative functions, sensitive data, or configuration interfaces without valid credentials, potentially leading to full application compromise.

Remediation: Implement proper access controls on all administrative and restricted paths. Deny access by default and require authentication and appropriate authorization.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

OWASP Web: A01:2025 Broken Access Control

OWASP API: API1:2023 Broken Object Level Authorization

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: AC-3

PCI DSS 4: 7.2.1

MEDIUM FR-458 — HTTP Parameter Pollution (Reflected)

Description: Duplicate HTTP parameters are processed and reflected in responses, potentially allowing attackers to bypass input validation or inject malicious content.

Impact: An attacker can inject a second parameter value that overrides or appends to the first, bypassing WAF rules, input filters, or business logic validation.

Remediation: Validate and reject duplicate parameters. Use framework-level parameter parsing that selects only the first occurrence. Encode all reflected user input.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

OWASP Web: A03:2025 Injection

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

MEDIUM FR-459 — Improper Error Handling — Server Error Exposed

Description: Server returns HTTP 5xx error responses with detailed error information including stack traces, database errors, or debug output.

Impact: Detailed error messages disclose implementation details (language, framework, file paths, database type, SQL queries) that aid targeted exploitation.

Remediation: Implement custom error pages that suppress stack traces. Disable debug mode in production. Log detailed errors server-side only.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-11

PCI DSS 4: 6.5.5

MEDIUM FR-460 — Insecure HTTPS to HTTP Redirect Detected

Description: Redirect chains downgrade from HTTPS to HTTP, exposing session tokens, credentials, and sensitive data to network-level interception.

Impact: An attacker performing a man-in-the-middle attack can intercept credentials, session tokens, and sensitive data transmitted over the unencrypted HTTP connection.

Remediation: Ensure all redirects maintain HTTPS. Configure HSTS to prevent protocol downgrades. Review server redirect configurations.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2025 Cryptographic Failures

MITRE ATT&CK: T1557 (Credential Access)

NIST 800-53: SC-8

PCI DSS 4: 4.2.1

MEDIUM FR-460b — Form Submits to HTTP from HTTPS Page

Description: Forms on HTTPS pages submit data to HTTP endpoints, exposing form data (potentially including credentials) to network interception.

Impact: Credentials or sensitive data submitted through the form travel over unencrypted HTTP, vulnerable to man-in-the-middle interception.

Remediation: Change all form action URLs to use HTTPS. Enable HSTS.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2025 Cryptographic Failures

NIST 800-53: SC-8

PCI DSS 4: 4.2.1

LOW FR-461 — Information Disclosure: Internal Hostname in HTTP Response

Description: HTTP response headers or body contain internal hostnames (.local, .internal, .corp, .lan, etc.), disclosing naming conventions and network topology.

Impact: Internal hostnames reveal infrastructure naming patterns and topology, aiding reconnaissance and potentially enabling blind SSRF attacks when callback parameters exist.

Remediation: Remove internal hostnames from HTTP response headers (Server, Via, X-Powered-By, X-Backend-Server) and response bodies. Configure reverse proxies to strip internal routing headers.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

MITRE ATT&CK: T1018 (Discovery)

NIST 800-53: SC-8, SI-11

PCI DSS 4: 6.5.10

LOW FR-464 — Unhandled Application Exception Disclosed

Description: HTTP responses contain exception class names, stack traces, or debug output patterns from various frameworks (Python, Java, .NET, PHP, Node.js, Ruby, SQL).

Impact: Exception details disclose implementation language, framework version, file paths, database type, and SQL queries, significantly reducing the effort needed for targeted exploitation.

Remediation: Implement custom error pages. Disable debug mode in production. Log exceptions server-side only. Never expose stack traces in HTTP responses.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: SI-11

PCI DSS 4: 6.5.5

INFO FR-465 — Outdated or Unnecessary Website Detected

Description: The website shows indicators of being outdated, abandoned, or unnecessary: old copyright dates, 'under construction' text, default CMS/server pages, or stale Last-Modified headers.

Impact: Outdated or unnecessary websites expand the attack surface with unpatched software and forgotten configurations that are less likely to be monitored.

Remediation: Review whether this website is still needed. If not, decommission it. If needed, update its content and underlying software.

Effort: Moderate

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: CM-8

HIGH FR-466 — Log File Publicly Accessible

Description: The web server exposes log file(s) to unauthenticated users. Log files commonly contain internal IP addresses, stack traces, usernames, session tokens, SQL queries, and file system paths. CWE-532, CWE-200.

Impact: Attackers can harvest internal paths, database query patterns, user data, session tokens, and credentials from exposed log files. This information enables targeted exploitation of backend systems, privilege escalation, and lateral movement.

Remediation: Remove log files from web-accessible directories. Configure web servers to deny access to log file extensions (.log). Move log storage outside the document root. In Apache: <FilesMatch ".log$"> Require all denied </FilesMatch>. In nginx: location ~* \.log$ { deny all; }.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

MITRE ATT&CK: T1083 (Discovery)

NIST 800-53: SI-11

PCI DSS 4: 6.2.4

LOW FR-467 — Password Field With Autocomplete Enabled

Description: Password input fields do not set autocomplete='off', allowing browsers to cache entered passwords.

Impact: On shared workstations, cached passwords can be retrieved by subsequent users, compromising accounts.

Remediation: Set autocomplete='off' or autocomplete='new-password' on all password input fields.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A04:2025 Insecure Design

NIST 800-53: IA-5

PCI DSS 4: 6.2.4

CRITICAL FR-468 — Information Disclosure: Cloud Credentials in File

Description: Cloud or CI/CD credential file(s) are accessible via the web, containing API keys, access tokens, database passwords, and service account credentials. Covers AWS credentials, Docker config, Kubernetes config, NPM config, Git credentials, and PostgreSQL password files. CWE-540, CWE-200.

Impact: Attackers gain direct access to cloud infrastructure, container registries, Kubernetes clusters, or package repositories using the disclosed credentials. This enables data exfiltration, resource hijacking, supply chain attacks, and full infrastructure compromise.

Remediation: Immediately rotate all credentials found in exposed files. Remove credential files from the web-accessible directory. Add dot-files and credential paths to the web server deny list. Use IAM roles and managed identities instead of static credential files. Never store credential files in the document root.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2025 Security Misconfiguration

MITRE ATT&CK: T1552.001 (Credential Access)

NIST 800-53: SC-28, IA-5

PCI DSS 4: 2.2.1

CRITICAL FR-469 — Terraform State File Exposed

Description: Terraform state file is accessible via the web, containing infrastructure secrets, API keys, database passwords, and complete cloud resource inventory.

Impact: Full infrastructure credential compromise — database passwords, API keys, cloud resource details enabling lateral movement and data exfiltration.

Remediation: Store Terraform state in a secure remote backend (S3+DynamoDB, Terraform Cloud). Never serve state files via a web server.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2025 Security Misconfiguration

MITRE ATT&CK: T1552.001 (Credential Access)

NIST 800-53: SC-28

PCI DSS 4: 2.2.1

MEDIUM FR-470 — Sensitive Data Exposed in HTML Comments

Description: HTML comments in page source contain sensitive keywords such as passwords, API keys, connection strings, or tokens.

Impact: Credentials, API keys, or connection strings in HTML comments are visible to any user viewing page source, enabling direct account or service compromise.

Remediation: Remove sensitive data from HTML comments. Implement build processes that strip comments from production output. Conduct code reviews for comment hygiene.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

MITRE ATT&CK: T1552.001 (Credential Access)

NIST 800-53: SI-11

PCI DSS 4: 6.2.4

HIGH FR-471 — Exposed Admin/Debug Endpoint: /_ray/api/health

Description: Spatie Ray debug tool is accessible at /_ray/api/health. Ray allows remote code inspection and can expose application internals in production.

Impact: Attackers can inspect application state, variables, queries, and stack traces through the Ray debug interface, gaining deep application knowledge for exploitation.

Remediation: Remove Spatie Ray from production. Restrict debug tools to development environments only.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A09:2025 Security Logging and Monitoring Failures

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: AU-9

PCI DSS 4: 6.2.4

HIGH FR-472 — Exposed Admin/Debug Endpoint: Express.js Default Error

Description: Express.js default error handler returns stack traces to clients, disclosing file paths, module versions, and application structure.

Impact: Stack traces reveal internal file paths, module names, and line numbers that attackers use to plan targeted exploitation of known framework vulnerabilities.

Remediation: Implement custom error handlers in Express.js. Set NODE_ENV=production to suppress stack traces. Never return error details to clients.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A09:2025 Security Logging and Monitoring Failures

NIST 800-53: SI-11

PCI DSS 4: 6.2.4

MEDIUM FR-473 — WebDAV PROPFIND Response Discloses Server Information

Description: The server responds to unauthenticated PROPFIND requests with WebDAV property data, disclosing file metadata and directory structure.

Impact: Attackers can enumerate server directory structure and file metadata without authentication, mapping the application for targeted attacks.

Remediation: Disable WebDAV on the web server unless required. Restrict PROPFIND to authenticated users. Block PROPFIND at the reverse proxy.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

MITRE ATT&CK: T1083 (Discovery)

NIST 800-53: CM-7

PCI DSS 4: 2.2.4

MEDIUM FR-474 — WebDAV Methods Enabled

Description: The web server advertises WebDAV methods (PROPFIND, MKCOL, COPY, MOVE, LOCK, UNLOCK), enabling remote file manipulation capabilities.

Impact: WebDAV methods can allow unauthenticated file upload, modification, or deletion. Historical vulnerabilities like CVE-2017-7269 demonstrate RCE risk.

Remediation: Disable WebDAV unless explicitly required. If required, enforce authentication and restrict to authorized users only.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

MITRE ATT&CK: T1505.003 (Persistence)

NIST 800-53: CM-7

PCI DSS 4: 2.2.4

MEDIUM FR-475 — Password Reset Token Exposed in URL

Description: Password reset functionality includes the reset token in URL query parameters, exposing it in logs, browser history, and Referer headers.

Impact: Reset tokens in URLs can be harvested from server logs, proxy caches, browser history, and Referer headers, enabling account takeover.

Remediation: Transmit reset tokens via POST body or HTTP headers, not URL query parameters. Implement short-lived, single-use tokens.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

MITRE ATT&CK: T1528 (Credential Access)

NIST 800-53: IA-5

PCI DSS 4: 6.2.4

LOW FR-476 — Information Disclosure: ETag

Description: The ETag response header follows the Apache inode-size-mtime format, disclosing filesystem inode numbers that can fingerprint shared hosting.

Impact: Inode values reveal file identity and can be used to detect shared hosting, map filesystem structure, and fingerprint specific web servers.

Remediation: Configure Apache: FileETag MTime Size (remove INode). For nginx, ETag is based on modification time and size by default.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: SI-11

LOW FR-477 — Information Disclosure: Internal Hostname in SAN

Description: The TLS certificate's Subject Alternative Names include internal hostnames that disclose naming conventions and network topology.

Impact: Internal hostnames in certificates reveal naming conventions, infrastructure topology, and internal service locations to external attackers.

Remediation: Issue separate certificates for internal and external services. Remove internal hostnames from externally visible certificate SANs.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: SC-8

LOW FR-478 — Cloud Storage Bucket URL Exposed

Description: Cloud storage bucket URLs (AWS S3, Google Cloud Storage, Azure Blob) are exposed in page content, enabling cloud infrastructure reconnaissance.

Impact: Exposed bucket URLs enable attackers to test for misconfigured public access, potentially accessing sensitive data stored in the cloud.

Remediation: Serve static assets through a CDN with a custom domain. Restrict bucket access policies. Do not store sensitive data in publicly referenced buckets.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

MITRE ATT&CK: T1530 (Collection)

NIST 800-53: SC-7

HIGH FR-479 — Exposed Admin/Debug Endpoint: /_ignition/execute-solution

Description: Laravel Ignition execute-solution endpoint is accessible, potentially enabling remote code execution via CVE-2021-3129.

Impact: CVE-2021-3129 allows unauthenticated RCE through the Ignition execute-solution endpoint by chaining log file manipulation with PHP deserialization.

Remediation: Upgrade Laravel Ignition to a patched version. Remove debug tools from production. Set APP_DEBUG=false.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A09:2025 Security Logging and Monitoring Failures

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

CISA KEV

MEDIUM FR-480 — HTTP Methods: Unsafe Methods Enabled

Description: The server advertises potentially dangerous HTTP methods (PUT, DELETE, TRACE, PATCH, WebDAV) via OPTIONS that may allow file manipulation or cross-site tracing.

Impact: Unsafe methods can enable file upload (PUT), deletion (DELETE), cross-site tracing (TRACE), or remote file manipulation (WebDAV), depending on server configuration.

Remediation: Disable unnecessary HTTP methods in web server configuration. Only allow GET, POST, HEAD, and OPTIONS. Restrict WebDAV methods unless explicitly required.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: CM-7

PCI DSS 4: 2.2.4

LOW FR-481 — Overly Permissive Permissions-Policy Header

Description: The Permissions-Policy (or Feature-Policy) header grants wildcard (*) access to sensitive browser features such as camera, microphone, geolocation, or payment. This allows any third-party iframe or embedded content to access these device capabilities, increasing the risk of privacy violations and data exfiltration. CWE-16.

Impact: Third-party content embedded in iframes can access the user's camera, microphone, geolocation, or payment APIs without restriction. A compromised or malicious third-party script can silently activate these features for surveillance or data theft.

Remediation: Restrict sensitive features in the Permissions-Policy header to self only or disable them entirely. Replace wildcard (*) values with specific origins or empty allowlists: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=().

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: SI-10, SC-28

PCI DSS 4: 6.2.4

HIGH FR-482 — Expired TLS Certificate Detected

Description: The TLS certificate presented by the server has passed its notAfter date and is no longer valid. Expired certificates break trust chain validation and cause browser warnings, which train users to bypass security prompts. An expired certificate may also indicate a forgotten or unmaintained service.

Impact: Users encounter certificate warnings and may click through them, normalizing the bypass of TLS trust validation. An attacker could perform a man-in-the-middle attack more easily when users are conditioned to ignore certificate errors. The expired certificate may also indicate the service is unmaintained and potentially vulnerable.

Remediation: Renew the TLS certificate immediately through the issuing Certificate Authority. Configure automated certificate renewal (e.g. via certbot/ACME) and monitoring alerts for certificates approaching expiration.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

OWASP Web: A02:2025 Cryptographic Failures

MITRE ATT&CK: T1557 (Credential Access)

NIST 800-53: SC-8, SC-12, SC-17

PCI DSS 4: 4.2.1

MEDIUM FR-483 — Self-Signed TLS Certificate

Description: The server presents a self-signed TLS certificate that is not issued by a trusted Certificate Authority. Self-signed certificates are not validated by browsers or TLS clients by default, indicating the service may not be production-hardened or is using a private PKI without proper trust distribution.

Impact: Users must manually trust the certificate or bypass browser warnings, which normalizes ignoring TLS errors and makes man-in-the-middle attacks feasible. A self-signed certificate on an internet-facing service suggests it may be a development, staging, or unmaintained system with weaker security controls.

Remediation: Replace the self-signed certificate with one issued by a trusted public Certificate Authority (e.g. Let's Encrypt, DigiCert). If a private CA is required, ensure its root certificate is distributed to all intended clients.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A02:2025 Cryptographic Failures

NIST 800-53: SC-8, SC-12

PCI DSS 4: 4.2.1

MEDIUM FR-484 — TLS Certificate Hostname Mismatch

Description: The TLS certificate presented by the server does not match the hostname being accessed. The certificate's Common Name (CN) and Subject Alternative Name (SAN) entries do not include the domain name used to reach the service. This may indicate a misconfiguration, a shared certificate, or a reused certificate from a different service.

Impact: Browsers and TLS clients will reject the connection or display warnings, which users may bypass. A hostname mismatch can indicate the service was deployed hastily, is using a certificate intended for another domain, or is sharing infrastructure with other services — all of which leak information about the environment.

Remediation: Ensure the TLS certificate's Common Name (CN) or Subject Alternative Name (SAN) entries include all hostnames the server is accessed by. Reissue the certificate with the correct domain names if needed.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A02:2025 Cryptographic Failures

NIST 800-53: SC-8, SC-12

PCI DSS 4: 4.2.1

HIGH FR-485 — Revoked TLS Certificate Detected

Description: The TLS certificate presented by the server has been revoked by its issuing Certificate Authority. Certificate revocation typically occurs due to key compromise, CA compromise, or administrative decommission. A revoked certificate should not be trusted for any purpose.

Impact: A revoked certificate may indicate that the private key was compromised, potentially allowing an attacker to impersonate the server. Clients that check CRL/OCSP will reject the connection, but not all clients perform revocation checking, leaving some users vulnerable to man-in-the-middle attacks using the compromised key.

Remediation: Replace the revoked certificate immediately with a new certificate from a trusted CA. Investigate the reason for revocation — if key compromise is suspected, generate a new key pair. Rotate any credentials or secrets that may have been exposed.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A02:2025 Cryptographic Failures

MITRE ATT&CK: T1557 (Credential Access)

NIST 800-53: SC-8, SC-12, SC-17

PCI DSS 4: 4.2.1

INFO FR-486 — TLS Certificate SAN Enumeration

Description: The TLS certificate presented by the server contains multiple Subject Alternative Name (SAN) entries, revealing additional hostnames and services hosted on this infrastructure. SAN enumeration is a passive reconnaissance technique that exposes the scope of services behind a single certificate.

Impact: An attacker can enumerate additional attack surface by reviewing SAN entries, discovering internal hostnames, staging environments, or related services that may have weaker security controls. Shared certificates also indicate infrastructure relationships between the listed domains.

Remediation: Review SAN entries to ensure no unintended hostnames (internal names, staging environments, decommissioned services) are exposed. Use separate certificates for services that should not be associated publicly.

Effort: Moderate

CVSS Vector: N/A

OWASP Web: A02:2025 Cryptographic Failures

MITRE ATT&CK: T1596.003 (Reconnaissance)

NIST 800-53: SC-8

HIGH FR-487 — Ivanti Cloud Services Appliance (CSA) Detected

Description: The TLS certificate fingerprint identifies this host as an Ivanti Cloud Services Appliance (CSA). Ivanti CSA has been the target of multiple critical actively-exploited zero-day vulnerabilities including path traversal (CVE-2024-8963), SQL injection (CVE-2024-9379), OS command injection (CVE-2024-8190), and another OS command injection (CVE-2024-9380).

Impact: An attacker can chain these vulnerabilities to achieve unauthenticated remote code execution on the CSA appliance. Successful exploitation provides full administrative access to the appliance and the ability to pivot into the internal network. CISA has issued emergency directives for these vulnerabilities.

Remediation: Verify the Ivanti CSA is running the latest patched firmware version. Apply all available security patches immediately. If running CSA 4.6, migrate to CSA 5.0 as version 4.6 has reached end-of-life. Monitor CISA KEV catalogue for new Ivanti advisories.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A02:2025 Cryptographic Failures

MITRE ATT&CK: T1190 (Initial Access), T1133 (Persistence)

NIST 800-53: SI-2, RA-5, CM-8

PCI DSS 4: 6.3.3

CISA KEV

HIGH FR-488 — Pulse Secure / Ivanti Connect Secure VPN Detected

Description: The TLS certificate fingerprint identifies this host as a Pulse Secure / Ivanti Connect Secure VPN appliance. This product line has been the target of critical zero-day exploitation including authentication bypass (CVE-2023-46805) and command injection (CVE-2024-21887), which were chained for unauthenticated RCE.

Impact: An attacker can exploit known vulnerabilities to bypass authentication and execute arbitrary commands on the VPN appliance, gaining access to the internal network. VPN appliances are high-value targets as they provide direct access to corporate networks and are internet-facing by design.

Remediation: Verify the Ivanti Connect Secure appliance is running the latest patched firmware. Apply vendor mitigation XML and patches as directed by Ivanti advisories. Run the Ivanti Integrity Checker Tool (ICT) to detect signs of compromise. Consider factory-resetting the appliance if compromise is suspected.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A02:2025 Cryptographic Failures

MITRE ATT&CK: T1190 (Initial Access), T1133 (Persistence)

NIST 800-53: SI-2, RA-5, CM-8

PCI DSS 4: 6.3.3

CISA KEV

MEDIUM FR-489 — F5 BIG-IP Detected

Description: The TLS certificate fingerprint identifies this host as an F5 BIG-IP appliance. F5 BIG-IP has had critical remote code execution vulnerabilities including CVE-2023-46747 (authentication bypass to RCE) and CVE-2022-1388 (iControl REST unauthenticated RCE).

Impact: An attacker exploiting known F5 BIG-IP vulnerabilities can achieve unauthenticated remote code execution with root privileges on the appliance. As a load balancer/ADC, BIG-IP sits in a privileged network position with visibility into all traffic it proxies, including credentials and session tokens.

Remediation: Verify the F5 BIG-IP is running the latest patched firmware version. Restrict management interface access to trusted networks only. Disable iControl REST on external interfaces if not required.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A02:2025 Cryptographic Failures

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, RA-5

PCI DSS 4: 6.3.3

CISA KEV

HIGH FR-490 — Citrix NetScaler / ADC Detected

Description: The TLS certificate fingerprint identifies this host as a Citrix NetScaler or ADC appliance. Citrix ADC has been the target of critical zero-day exploitation including CVE-2023-4966 ('Citrix Bleed', session token leakage) and CVE-2023-3519 (unauthenticated RCE).

Impact: An attacker can exploit Citrix Bleed (CVE-2023-4966) to steal valid session tokens without authentication, bypassing MFA and gaining access to internal resources. CVE-2023-3519 allows unauthenticated remote code execution on the appliance itself. Both were widely exploited in the wild by ransomware operators.

Remediation: Apply Citrix security patches immediately. After patching Citrix Bleed, terminate all active sessions and rotate all credentials — the patch does not invalidate stolen session tokens. Run Citrix-provided IoC scanning tools to check for compromise.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A02:2025 Cryptographic Failures

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, RA-5

PCI DSS 4: 6.3.3

CISA KEV

MEDIUM FR-491 — Fortinet FortiGate Detected

Description: The TLS certificate fingerprint identifies this host as a Fortinet appliance (FortiGate, FortiWeb, or FortiOS-based). FortiOS has been the target of critical zero-day exploitation including CVE-2024-21762 (out-of-bound write in SSL VPN) and CVE-2023-27997 (heap buffer overflow in SSL VPN, 'XORtigate').

Impact: An attacker can exploit known FortiOS vulnerabilities to achieve pre-authentication remote code execution on the firewall appliance. As a perimeter firewall/VPN, FortiGate sits at the network boundary with full visibility into traffic and provides a pivot point into the internal network.

Remediation: Verify the Fortinet appliance is running the latest patched FortiOS firmware. Disable SSL VPN if not required. Restrict management interfaces to trusted networks. Enable logging and monitor for indicators of compromise.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A02:2025 Cryptographic Failures

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, RA-5

PCI DSS 4: 6.3.3

CISA KEV

MEDIUM FR-492 — Palo Alto Networks Detected

Description: The TLS certificate fingerprint identifies this host as a Palo Alto Networks appliance. PAN-OS has been the target of critical zero-day exploitation including CVE-2024-3400 (GlobalProtect command injection with CVSS 10.0), which was actively exploited before a patch was available.

Impact: An attacker can exploit CVE-2024-3400 to achieve unauthenticated remote code execution with root privileges on the firewall through the GlobalProtect gateway. As a next-generation firewall, Palo Alto devices provide full network visibility and can be used to intercept traffic, modify firewall rules, or pivot into the internal network.

Remediation: Verify the Palo Alto appliance is running the latest patched PAN-OS version. Apply hotfixes for CVE-2024-3400 immediately. Restrict management interface access and disable unused GlobalProtect portals. Monitor for indicators of compromise using Palo Alto's threat prevention signatures.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

OWASP Web: A02:2025 Cryptographic Failures

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, RA-5

PCI DSS 4: 6.3.3

CISA KEV

MEDIUM FR-493 — SonicWall Detected

Description: The TLS certificate fingerprint identifies this host as a SonicWall appliance. SonicWall has had critical vulnerabilities including CVE-2024-40766 (improper access control in SonicOS management and SSLVPN) which was actively exploited by ransomware operators.

Impact: An attacker can exploit known SonicWall vulnerabilities to gain unauthorized access to the firewall management interface or VPN services. SonicWall appliances are perimeter security devices and their compromise provides direct access to the internal network.

Remediation: Verify the SonicWall appliance is running the latest patched firmware version. Restrict SSLVPN and management interface access. Enable MFA for all VPN connections. Monitor for unauthorized access attempts.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A02:2025 Cryptographic Failures

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, RA-5

PCI DSS 4: 6.3.3

CISA KEV

MEDIUM FR-494 — Cisco ASA Detected

Description: The TLS certificate fingerprint identifies this host as a Cisco Adaptive Security Appliance (ASA). Cisco ASA is a widely-deployed firewall/VPN platform that has had numerous critical vulnerabilities over its lifetime, including path traversal, authentication bypass, and remote code execution flaws.

Impact: A Cisco ASA appliance at the network perimeter provides firewall, VPN, and NAT services. Its compromise gives an attacker the ability to modify access control rules, intercept VPN traffic, and pivot into the internal network. ASA's WebVPN and AnyConnect components have historically been targeted.

Remediation: Verify the Cisco ASA is running the latest patched firmware version. Restrict management access to trusted networks. Disable unused VPN profiles and WebVPN features. Monitor syslog for unauthorized access attempts.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

OWASP Web: A02:2025 Cryptographic Failures

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, RA-5

PCI DSS 4: 6.3.3

CISA KEV

MEDIUM FR-495 — VMware vSphere / ESXi Detected

Description: The TLS certificate fingerprint identifies this host as a VMware vSphere, vCenter, or ESXi host. VMware hypervisor products have been targeted by critical vulnerabilities and are high-value targets for ransomware operators who encrypt entire virtual machine datastores.

Impact: Compromise of a VMware hypervisor gives an attacker control over all virtual machines running on it, including the ability to access VM disks, snapshot memory, and intercept network traffic between VMs. ESXi-targeting ransomware (e.g. ESXiArgs) can encrypt entire datastores, taking down all hosted services simultaneously.

Remediation: Verify VMware ESXi/vCenter is running the latest patched version. Restrict management interfaces (port 443, 902) to a dedicated management VLAN. Disable SSH on ESXi hosts unless actively needed. Enable lockdown mode on ESXi hosts.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A02:2025 Cryptographic Failures

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, RA-5

PCI DSS 4: 6.3.3

CISA KEV

MEDIUM FR-496 — Sophos Firewall Detected

Description: The TLS certificate fingerprint identifies this host as a Sophos firewall appliance (XG Firewall, Sophos Firewall OS, or legacy Cyberoam). Sophos firewalls have had critical vulnerabilities including SQL injection and code injection flaws in their user portal and management interfaces.

Impact: An attacker exploiting Sophos firewall vulnerabilities can gain unauthorized access to the firewall management interface, modify security policies, and potentially achieve remote code execution. As a perimeter device, compromise provides a pivot point into the internal network and visibility into all traversing traffic.

Remediation: Verify the Sophos firewall is running the latest firmware version. Disable the User Portal on WAN-facing interfaces if not required. Restrict management access to trusted internal networks only. Enable automatic hotfix installation.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A02:2025 Cryptographic Failures

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, RA-5

PCI DSS 4: 6.3.3

CISA KEV

INFO FR-497 — Technology Stack Identified (Wappalyzer)

Description: Webanalyze (Wappalyzer engine) identified the technology stack running on the target web application. Technologies detected may include web servers, application frameworks, CMS platforms, JavaScript libraries, analytics tools, CDNs, and other components. Each identified technology can be checked against known vulnerability databases for version-specific issues.

Impact: Technology fingerprinting reveals the exact software stack in use, enabling targeted vulnerability research. An attacker can search for CVEs, default credentials, and known misconfigurations specific to each detected technology and version. Identifying the CMS, framework, and server version narrows the attack surface to known weaknesses.

Remediation: Ensure all identified technologies are running their latest patched versions. Remove version information from HTTP response headers where possible (e.g. ServerTokens Prod, server_tokens off). Remove unused technologies and frameworks to reduce attack surface.

Effort: Moderate

CVSS Vector: N/A

OWASP Web: A05:2025 Security Misconfiguration

MITRE ATT&CK: T1592.004 (Reconnaissance)

NIST 800-53: CM-8

PCI DSS 4: 6.3.2

INFO FR-498 — Hidden HTTP Parameters Discovered

Description: arjun discovered hidden HTTP parameters that are not present in crawled forms, links, or visible page elements. These parameters are accepted by the server but not publicly advertised, potentially exposing additional attack surface for injection, authentication bypass, or information disclosure.

Impact: Hidden parameters may accept unexpected input that bypasses client-side validation. An attacker who discovers hidden debug, admin, or configuration parameters can probe them for injection vulnerabilities, privilege escalation, or information disclosure. These parameters are often less hardened than publicly documented ones because developers assume they are not discoverable.

Remediation: Review all discovered hidden parameters for security implications. Remove any debug, test, or administrative parameters from production deployments. Ensure all accepted parameters are documented and subject to the same input validation and authorization controls as public parameters.

Effort: Moderate

CVSS Vector: N/A

OWASP Web: A01:2025 Broken Access Control

OWASP API: API9:2023 Improper Inventory Management

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: CM-7, SA-11

PCI DSS 4: 6.2.4

LOW FR-499 — Security-Sensitive Hidden Parameter

Description: arjun discovered a hidden HTTP parameter with a security-sensitive name pattern (such as admin, debug, test, secret, token, key, or password). These parameters suggest debug functionality, authentication bypasses, or configuration controls that should not be accessible in production.

Impact: Security-sensitive hidden parameters frequently enable debug modes, expose verbose error output, bypass authentication, or reveal API keys and tokens. An attacker who discovers a 'debug=true' parameter may gain access to stack traces, internal paths, and database queries. Parameters named 'token' or 'key' may accept forged credentials.

Remediation: Remove all debug, test, and administrative parameters from production deployments. If debug functionality is required, gate it behind strong authentication and restrict access to authorized personnel. Audit parameter names for sensitive patterns during code review.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A01:2025 Broken Access Control

OWASP API: API9:2023 Improper Inventory Management

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: CM-7, SC-28

PCI DSS 4: 6.2.4, 6.5.1

CRITICAL FR-500 — Server-Side Template Injection (SSTI) — SSTImap Confirmed

Description: SSTImap confirmed that the target application is vulnerable to Server-Side Template Injection (SSTI). User-supplied input is rendered directly within a server-side template engine without proper sanitization, allowing an attacker to inject template directives that execute arbitrary code on the server.

Impact: A confirmed SSTI vulnerability allows full remote code execution (RCE) on the server. An attacker can read/write arbitrary files, exfiltrate database credentials, pivot to internal networks, and fully compromise the application server. SSTI is one of the highest-impact web vulnerabilities because template engines run with the full privileges of the application process.

Remediation: Use sandboxed template engines that restrict template directives to safe operations. Never pass user input directly into template rendering functions. Use template engines' built-in auto-escaping features. If dynamic templates are required, use a strict allowlist of permitted template operations and sanitize all input before rendering.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2025 Injection

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, SA-11

PCI DSS 4: 6.2.4, 6.5.1

MEDIUM FR-501 — SSTI — Template Engine Identified

Description: SSTImap identified the template engine in use on the target application (e.g., Jinja2, Twig, Freemarker, Mako, Velocity, Smarty) but was unable to achieve code execution. The engine may have sandboxing or input filtering that prevents exploitation, but the presence of a detectable engine suggests user input reaches the template layer.

Impact: Template engine identification narrows the attack surface for targeted exploitation. Even if SSTImap could not achieve RCE, manual techniques or future bypass discoveries may succeed. The detection confirms that user input interacts with the template engine, which is a prerequisite for SSTI attacks.

Remediation: Ensure the template engine is properly sandboxed with restricted directive capabilities. Verify that user input does not reach template rendering functions. Apply input sanitization and output encoding at the template layer.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A03:2025 Injection

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

CRITICAL FR-502 — OS Command Injection — commix Confirmed

Description: commix confirmed that the target application is vulnerable to OS command injection. User-supplied input is incorporated into operating system commands without proper sanitization, allowing an attacker to execute arbitrary system commands on the underlying server with the privileges of the web application process.

Impact: Confirmed OS command injection allows full remote code execution. An attacker can read/write files, dump databases, install backdoors, establish reverse shells, pivot to internal networks, and fully compromise the server. This is a maximum-severity vulnerability that provides complete control over the affected system.

Remediation: Use parameterized OS commands or language-native APIs instead of shell execution. Never concatenate user input into shell commands. Apply strict input validation with allowlists for expected parameter values. Use subprocess calls with argument arrays instead of shell=True. Implement the principle of least privilege for the web application process.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2025 Injection

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, SA-11

PCI DSS 4: 6.2.4, 6.5.1

HIGH FR-503 — Blind Command Injection (Time-Based) — commix

Description: commix detected blind OS command injection via time-based techniques. The application's response time varied when time-delay payloads (e.g., sleep) were injected, indicating that user input is incorporated into operating system commands. While output is not directly reflected, the time-delay confirmation proves command execution occurs on the server.

Impact: Blind command injection is exploitable for full remote code execution even though command output is not returned in the response. An attacker can exfiltrate data character-by-character via time-based inference, establish out-of-band channels (DNS, HTTP callbacks), or write webshells to achieve interactive access. The impact is equivalent to confirmed command injection, with only exploitation complexity increased.

Remediation: Use parameterized OS commands or language-native APIs instead of shell execution. Never concatenate user input into shell commands. Apply strict input validation with allowlists. Use subprocess calls with argument arrays instead of shell=True.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2025 Injection

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, SA-11

PCI DSS 4: 6.2.4, 6.5.1

HIGH FR-504 — Web Cache Poisoning

Description: toxicache confirmed that the web cache can be poisoned. An unkeyed input (such as an HTTP header not included in the cache key) is reflected in the cached response. An attacker can send a request with a malicious header value, which gets cached and then served to all subsequent users requesting the same URL.

Impact: Web cache poisoning allows an attacker to serve malicious content to all users of the affected URL via the CDN or reverse proxy cache. This can be used for stored XSS (injecting JavaScript via unkeyed headers), phishing (redirecting users to attacker-controlled pages), denial of service (caching error responses), and defacement. The attack scales to all users because the poisoned response is served from cache.

Remediation: Configure the cache to key on all security-relevant headers. Remove or normalize unkeyed headers before caching. Implement cache-control headers (no-store for sensitive pages). Validate and sanitize all input reflected in responses, including HTTP headers. Use Vary headers to include all inputs that affect the response.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

OWASP Web: A05:2025 Security Misconfiguration

MITRE ATT&CK: T1557 (Credential Access)

NIST 800-53: SC-8, SI-10

PCI DSS 4: 6.2.4

MEDIUM FR-505 — Web Cache Deception

Description: toxicache detected that the web cache serves incorrect content to users due to path confusion or misconfigured caching rules. An attacker can craft URLs that cause the cache to store authenticated or personalized content and serve it to other users, or serve static content in place of dynamic responses.

Impact: Web cache deception can expose authenticated content (account pages, API responses with tokens, personal data) to unauthenticated users. An attacker tricks a victim into visiting a crafted URL that caches their authenticated response, then retrieves that cached content. This can leak session tokens, personal information, and CSRF tokens.

Remediation: Configure proper cache rules per content type. Never cache authenticated or personalized responses. Set Cache-Control: no-store on all dynamic/authenticated pages. Normalize URL paths before cache key generation to prevent path confusion attacks.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

MITRE ATT&CK: T1557 (Credential Access)

NIST 800-53: SC-8

PCI DSS 4: 6.2.4

LOW FR-506 — Unkeyed Header in Cache Response

Description: toxicache detected that the web cache does not include a specific HTTP header in its cache key, but the header's value is reflected in the cached response. This means the header could potentially be used for cache poisoning if an exploitable reflection point is found.

Impact: An unkeyed header that is reflected in the response is a prerequisite for web cache poisoning. While this finding alone does not confirm exploitation, it indicates that the cache configuration does not properly account for all inputs that influence the response. This is the foundation for cache poisoning attacks that can lead to stored XSS, phishing, or defacement at scale.

Remediation: Include all security-relevant HTTP headers in the cache key configuration. Review cache configuration to ensure that any header whose value appears in responses is either included in the cache key or stripped before caching.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

OWASP Web: A05:2025 Security Misconfiguration

NIST 800-53: SC-8

PCI DSS 4: 6.2.4

MEDIUM FR-507 — Session Token Exposed in URL

Description: Session-related parameter(s) appear in the URL query string. Tokens in URLs leak through browser history, Referer headers, proxy logs, and server access logs.

Impact: An attacker who obtains the URL (via Referer header, shared link, browser history, or proxy logs) gains immediate authenticated access to the victim's session without needing to compromise cookies or credentials directly.

Remediation: Transmit session tokens only via cookies (with Secure, HttpOnly, SameSite attributes) or Authorization headers. Never embed session identifiers in URL query parameters or path segments.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

MITRE ATT&CK: T1539 (Credential Access)

NIST 800-53: SC-23

PCI DSS 4: 6.2.4

MEDIUM FR-508 — Session Token in Page Links

Description: Page links embed session tokens in URL query parameters within href attributes, leaking tokens through Referer headers when users navigate to external sites.

Impact: Session tokens are transmitted to third-party servers via Referer headers when users click external links, allowing third parties or network observers to hijack user sessions.

Remediation: Remove session tokens from all hyperlinks. Use cookie-based session management exclusively. Set Referrer-Policy to no-referrer or same-origin.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

NIST 800-53: SC-23

PCI DSS 4: 6.2.4

LOW FR-509 — Overly Broad Cookie Domain Scope

Description: Session cookies are scoped to a parent domain rather than the application's specific hostname, allowing any subdomain under the parent to read these cookies.

Impact: A compromised sibling application on any subdomain under the parent domain can read and replay session cookies, enabling cross-application session hijacking without attacking the target directly.

Remediation: Set the cookie Domain attribute to the exact hostname of the application. Avoid using parent domain cookies unless required for cross-subdomain SSO.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

NIST 800-53: SC-23

PCI DSS 4: 6.2.4

INFO FR-510 — Cookie Path Scoped to Root

Description: Session cookies use Path=/ while the application resides at a subpath. Other applications on the same hostname can read these cookies.

Impact: Other applications sharing the same hostname (common in shared hosting or multi-tenant environments) can access session cookies, creating a cross-application information disclosure risk.

Remediation: Set the cookie Path attribute to the application's base URL path to limit cookie visibility to the application's URL space.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

NIST 800-53: SC-23

CRITICAL FR-511 — JWT Algorithm None Accepted

Description: A JWT token uses algorithm 'none', meaning the token has no signature verification. Any attacker can forge arbitrary tokens with any claims.

Impact: Complete authentication bypass. An attacker can craft JWTs with arbitrary claims (admin roles, any user identity) without needing the signing key, gaining unrestricted access to all application functionality.

Remediation: Enforce a strong signing algorithm (RS256, ES256) server-side. Reject tokens with alg=none. Use an allowlist of accepted algorithms.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2025 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

MITRE ATT&CK: T1550.001 (Lateral Movement)

NIST 800-53: IA-5, SC-13

PCI DSS 4: 6.2.4, 8.3.1

MEDIUM FR-512 — JWT Missing Expiration Claim

Description: A JWT token has no 'exp' (expiration) claim. Without expiration, a stolen token remains valid indefinitely.

Impact: A stolen or leaked JWT can be replayed indefinitely since it never expires, giving an attacker persistent unauthorized access until the signing key is rotated or the token is explicitly blacklisted.

Remediation: Include an 'exp' claim in all JWTs with a reasonable lifetime (15 minutes for access tokens, hours for refresh tokens). Validate expiration server-side on every request.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

MITRE ATT&CK: T1550.001 (Lateral Movement)

NIST 800-53: IA-5, AC-12

PCI DSS 4: 8.2.8

LOW FR-513 — JWT Excessive Lifetime

Description: A JWT token has an excessively long lifetime (>24 hours). Long-lived tokens increase the window for token theft and replay attacks.

Impact: Extended token lifetimes give attackers a wider window to intercept, steal, and reuse tokens. If a token is compromised, the attacker maintains access for the full remaining lifetime without needing to re-authenticate.

Remediation: Reduce JWT lifetime to 15-60 minutes for access tokens. Use refresh tokens for session continuity. Implement token revocation for compromised tokens.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

NIST 800-53: AC-12

PCI DSS 4: 8.2.8

MEDIUM FR-514 — JWT Contains Sensitive Data

Description: A JWT payload contains sensitive fields (passwords, SSNs, credit card numbers). JWT payloads are base64url-encoded (not encrypted) and readable by anyone with access to the token.

Impact: Sensitive information embedded in the JWT is exposed to anyone who intercepts the token (via logs, browser storage, network capture, or Referer headers). This is a direct data exposure vulnerability since JWTs are not encrypted by default.

Remediation: Remove sensitive data from JWT payloads. Store sensitive data server-side and reference it by ID. Use JWE (encrypted JWT) if payload confidentiality is required.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

OWASP API: API3:2023 Broken Object Property Level Authorization

NIST 800-53: SC-28

PCI DSS 4: 3.4.1

LOW FR-515 — JWT Missing Audience Claim

Description: A JWT token has no 'aud' (audience) claim. Without audience restriction, tokens intended for one service may be replayed against a different service that shares the same signing key.

Impact: Tokens can be cross-replayed between services that share signing infrastructure. An attacker with a token from a lower-privilege service can replay it against a higher-privilege service if no audience validation is performed.

Remediation: Include an 'aud' claim in all JWTs identifying the intended recipient. Validate the audience server-side and reject tokens with unexpected audience values.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

NIST 800-53: IA-5

MEDIUM FR-516 — Session Persists After Password Change

Description: Existing sessions remain valid after a password change. If an attacker has compromised a session, changing the password does not revoke their access.

Impact: A user who changes their password to recover from a compromise cannot fully revoke attacker access. The compromised session persists, and the attacker retains authenticated access until natural session expiry.

Remediation: Invalidate all existing sessions for the user when their password is changed. Force re-authentication on all devices.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

MITRE ATT&CK: T1539 (Credential Access)

NIST 800-53: AC-12

PCI DSS 4: 8.2.8

MEDIUM FR-517 — Excessive Session Cookie Lifetime

Description: A session cookie has an excessively long lifetime (>30 days), increasing the window for session hijacking via stolen cookies.

Impact: Extremely long-lived session cookies remain valid for weeks or months, giving attackers an extended window to exploit stolen cookies. Even if the user logs out from one device, the cookie on another compromised device remains usable.

Remediation: Set session cookie Max-Age/Expires to a reasonable duration (4-8 hours for standard apps, shorter for sensitive apps). Implement absolute server-side session timeout independent of cookie expiry.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

NIST 800-53: AC-12

PCI DSS 4: 8.2.8

MEDIUM FR-518 — Missing Referrer-Policy With External Links

Description: The authenticated page contains external links but no Referrer-Policy header is set. Browsers default to sending the full URL as the Referer header when users click external links, potentially leaking session tokens or sensitive URL parameters.

Impact: Session tokens, CSRF tokens, or other sensitive URL parameters are transmitted to third-party servers via the Referer header when users click external links. Third parties can use leaked tokens for session hijacking.

Remediation: Set Referrer-Policy header to 'strict-origin-when-cross-origin' or 'no-referrer' to prevent URL leakage. Apply via HTTP header or <meta> tag.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

NIST 800-53: SC-23

PCI DSS 4: 6.2.4

LOW FR-519 — Mixed Content on Authenticated Page

Description: The authenticated HTTPS page loads resources over plain HTTP. Mixed content allows a network attacker to inject malicious resources into the authenticated page via MITM.

Impact: A network-positioned attacker can modify HTTP-loaded resources (scripts, styles, images) in transit, injecting malicious content into the authenticated HTTPS page. This can lead to session hijacking, credential theft, or arbitrary code execution in the user's browser context.

Remediation: Load all resources over HTTPS. Use Content-Security-Policy: upgrade-insecure-requests to automatically upgrade HTTP to HTTPS.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

MITRE ATT&CK: T1557 (Credential Access)

NIST 800-53: SC-8

PCI DSS 4: 4.2.1

LOW FR-520 — Potential Session Puzzling

Description: The same session cookie name is assigned different values across functionally distinct paths (login, registration, password reset, profile). This may indicate session variable overloading where authentication state from one context can be leveraged in another.

Impact: An attacker may exploit session puzzling to escalate privileges by initiating a session in one security context (e.g. password reset flow) and presenting it to another context (e.g. authenticated dashboard) where the session variables carry unintended authority.

Remediation: Use separate session variables for each functional context (authentication, registration, password reset). Regenerate session IDs at each privilege boundary. Do not reuse session objects across security contexts.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

NIST 800-53: SC-23