Master Catalogue

wifite2 successfully recovered the WPA/WPA2/WPA3 pre-shared key (PSK) for the target SSID via offline dictionary attack ...

EAPHammer deployed a rogue AP that successfully impersonated the target WPA-Enterprise network, downgrades the 802.1X EA...

aircrack-ng recovered the WEP key using the PTW statistical attack against collected IVs. With the key an attacker can d...

asleap successfully cracked the MSCHAPv2 challenge/response captured by EAPHammer's rogue AP. MSCHAPv2 is inherently wea...

A client associated with the rogue AP and submitted a WPA PSK via a captive portal page that mimicked the target network...

A KARMA/MANA rogue AP responded to probe requests from clients seeking previously associated networks and captured crede...

EAPHammer with balanced negotiation captured credentials by accepting a weaker EAP method (e.g. PEAP/MSCHAPv2 or EAP-MD5...

A long random-subdomain DNS query (40 chars, characteristic of DNS tunneling tools) was successfully forwarded by the ca...

An evil-twin rogue AP with a self-signed cert successfully attracted a client supplicant which proceeded past server-cer...

No explicit default-deny (implicit permit-all) rule exists at the end of the access control list or policy group. Traffi...

A firewall rule permits all traffic from any source to any destination on all ports and protocols. This is the most dang...

A firewall rule permits Remote Desktop Protocol (RDP, TCP 3389) inbound from any source address. RDP is one of the most ...

A firewall rule permits SMB (TCP 445) from external/untrusted sources. SMB is the primary protocol used by ransomware (W...

A firewall rule permits database service ports (MySQL TCP 3306, MSSQL TCP 1433, PostgreSQL TCP 5432, Oracle TCP 1521) fr...

A firewall rule permits Elasticsearch (TCP 9200 HTTP API or 9300 transport) from external or untrusted sources. Elastics...

A firewall rule permits Redis (TCP 6379) or Memcached (TCP/UDP 11211) from external sources. Both services have no authe...

Firewall management interfaces (HTTPS, SSH, ASDM) are accessible from any source address, including untrusted networks.

Telnet is enabled as a device management protocol. Telnet provides no encryption, authentication challenge-response visi...

SSH or HTTPS management access is configured without a source IP restriction, allowing management access from any networ...

No firewall rules in this configuration have logging enabled. The firewall is operating without any security event loggi...

A WAN firewall rule permits all traffic with no source, destination, or service restrictions across SD-WAN sites.

Guest/visitor wireless or network segment can communicate with corporate resources. Executive environments are high-valu...

Permit rules covering identified executive subnets have logging disabled, creating a forensic blind spot in the highest-...

A certificate template allows enrollees to specify a Subject Alternative Name (SAN) in the certificate request, AND low-...

The Certificate Authority has the EDITF_ATTRIBUTESUBJECTALTNAME2 flag enabled. This CA-level configuration allows ANY ce...

Group Policy Preferences (GPP) XML files containing the 'cpassword' attribute were found in SYSVOL. Microsoft published ...

Event log clearing events detected (Event ID 1102/104). Clearing security logs destroys forensic evidence and is a stron...

WDigest authentication is configured to store plaintext credentials in memory (UseLogonCredential set to 1 at HKLM\SYSTE...

One or more Windows accessibility feature binaries (sethc.exe, utilman.exe, osk.exe, narrator.exe, magnify.exe, DisplayS...

One or more running processes match known malicious software signatures in the threat intelligence database. This is a s...

One or more processes are running as SYSTEM from user-writable locations (Users, AppData, Downloads, ProgramData, Temp)....

The system is vulnerable to PrintNightmare (CVE-2021-34527 / CVE-2021-1675). The Print Spooler service is running AND th...

A WordPress configuration backup file (e.g., wp-config.php.bak, wp-config.php~) was found accessible on the web server. ...

A configuration file (e.g., .env, config.php, settings.py, database.yml) is publicly accessible. Configuration files typ...

A .git directory or git repository index is accessible from the web root. An attacker can reconstruct the full source co...

A database file (e.g., .sqlite, .db, .mdb) is directly accessible from the web server. This exposes the entire database ...

The server supports SSLv2, making modern TLS connections vulnerable to the DROWN attack. An attacker can decrypt RSA-enc...

The server is running a version of OpenSSL vulnerable to Heartbleed (CVE-2014-0160). An attacker can read up to 64KB of ...

The server accepts JWTs with the algorithm set to 'none', bypassing signature verification entirely. An attacker can for...

The server is vulnerable to JWT algorithm confusion. By changing the algorithm from RS256 to HS256 and signing the token...

The JWT HMAC signing secret is weak or uses a common/guessable value. An attacker can brute-force the secret offline and...

The server accepts JWTs with an invalid or tampered signature. The server is processing the JWT payload without verifyin...

The JWT 'kid' (Key ID) header parameter is used in an unsafe SQL query or file path lookup without validation. An attack...

The server trusts the 'jwk' (JSON Web Key) header embedded in the JWT itself for signature verification. An attacker can...

SQL injection was detected. User-supplied input is incorporated into SQL queries without proper parameterization or esca...

Boolean-based blind SQL injection was detected. The application does not return error messages, but its behavior changes...

Time-based blind SQL injection was detected. The server introduces measurable response delays when injected time-delay S...

NoSQL injection was detected against a MongoDB, Elasticsearch, or similar NoSQL database. Unsanitized user input is used...

Operating system command injection was detected. User-supplied input is passed to a system shell command without sanitiz...

Server-Side Template Injection was detected. User input is embedded directly into a server-side template (Jinja2, Freema...

XML External Entity (XXE) injection was detected. The XML parser processes externally supplied entity references, allowi...

Remote File Inclusion (RFI) was detected. The application includes or requires files using a URL parameter that can be s...

Server-Side Request Forgery (SSRF) was detected. The application fetches remote resources at a URL controlled by the att...

SSRF was exploited to access the cloud provider's instance metadata service (AWS 169.254.169.254, GCP metadata.google.in...

The application or an integrated component (CMS, framework, admin panel) uses default or well-known credentials (admin/a...

The login form is vulnerable to SQL injection, allowing authentication bypass without valid credentials. Payloads such a...

Authentication can be bypassed by manipulating server responses (e.g., changing 'false' to 'true' in JSON responses, mod...

The /etc/passwd file is accessible via path traversal or misconfiguration. This file contains system user account inform...

The .env environment configuration file is publicly accessible. This file typically contains database credentials, API k...

A private cryptographic key file (.pem, .key, .p12, .pfx) was found accessible on the web server. Exposure of private ke...

Vertical privilege escalation was detected. A lower-privileged user can access administrative functionality or higher-pr...

Insecure deserialization was detected. The application deserializes user-supplied data (via pickle, Java ObjectInputStre...

Java object deserialization was identified with known gadget chain exploitability. Exploitation of known gadget chains (...

PHP's unserialize() function is called on user-controlled input. If the application's autoloaded classes contain exploit...

The file upload functionality allows uploading of executable files (PHP, JSP, ASP, Python, etc.) without restriction. An...

Mass assignment was exploited to modify a privileged field such as 'isAdmin', 'role', or 'permission_level' by including...

Evidence suggests passwords are stored in cleartext, as reversible encryption, or using a weak unsalted hash algorithm (...

HTTP request smuggling was detected due to inconsistent interpretation of Content-Length and Transfer-Encoding headers b...

Authenticated user A can modify or delete data owned by user B by manipulating object identifiers in API requests. Objec...

Administrative functions (user management, system configuration, data export) are accessible to regular authenticated us...

SQL injection was detected via GraphQL query arguments. Unsanitized argument values are passed to underlying database qu...

A sensitive path was found accessible that should require authentication or should not be publicly reachable. Accessing ...

The WordPress configuration file (wp-config.php) or a backup of it is accessible and returns source code. This file cont...

A WordPress configuration backup file was found accessible. Configuration backups may expose database credentials, salts...

The server is vulnerable to Heartbleed (CVE-2014-0160). Attackers can read up to 64 KB of server memory per request, exp...

Error-based SQL injection was detected. Database error messages containing SQL syntax are returned in response to crafte...

sqlmap confirmed SQL injection on the target parameter. SQL injection allows attackers to read, modify, or delete databa...

A second-order (stored) SQL injection vector was identified. User-supplied input stored in the database is later include...

OS command injection was detected. User-supplied input is passed to an operating system shell without sanitisation, allo...

Server-side code injection leading to remote code execution was detected. User-supplied input is evaluated as server-sid...

Stored XSS was detected. User-supplied input is persisted and later rendered in the browser without encoding, allowing a...

Server-Side Request Forgery (SSRF) was detected. User-supplied URLs or hostnames are used by the server to make outbound...

A serialised object was accepted by the application without signature verification. Insecure deserialisation can lead to...

A YAML tag injection payload was accepted by the application. YAML parsers that support arbitrary Python object instanti...

Weak, default, or commonly-used credentials were successfully authenticated. Default or weak credentials allow attackers...

The JWT library accepts tokens with the 'none' algorithm, meaning the signature field is empty and no verification is pe...

The application accepted a JWT token with the 'none' algorithm specified in the header, bypassing signature verification...

jwt_tool confirmed a JWT vulnerability that allows token forgery or authentication bypass. JWT vulnerabilities enable im...

The application processes SSI directives embedded in user input, allowing execution of server-side commands.

Protected pages are accessible by direct URL navigation after initial authentication, bypassing the MFA verification ste...

Cloud or CI/CD credential file(s) are accessible via the web, containing API keys, access tokens, database passwords, an...

Terraform state file is accessible via the web, containing infrastructure secrets, API keys, database passwords, and com...

SSTImap confirmed that the target application is vulnerable to Server-Side Template Injection (SSTI). User-supplied inpu...

commix confirmed that the target application is vulnerable to OS command injection. User-supplied input is incorporated ...

A JWT token uses algorithm 'none', meaning the token has no signature verification. Any attacker can forge arbitrary tok...

A GATT write to a device characteristic succeeded over an unpaired, unencrypted link (ATT Write Response with no securit...

A previously captured CAN frame was successfully replayed and accepted as a legitimate message by one or more nodes on t...

Responder successfully captured an NTLMv1 or NTLMv2 challenge-response hash in response to a poisoned LLMNR/NBT-NS reply...

Cleartext credentials (username/password) were observed in captured network traffic. The device transmitted authenticati...

The target accepted well-known default or factory-set credentials, granting unauthorised access.

A username and password pair was observed in plaintext within captured network traffic. The credentials were transmitted...

The device's LoRaWAN root AppKey (OTAA) or session keys (ABP) are default, all-zero, sequential, vendor-shared, or deriv...

A captured RFID credential was successfully replayed to the reader and accepted. No anti-replay protection is in place.

The card's GlobalPlatform Issuer Security Domain authenticated an SCP secure channel using the default test key set (40....

A serial console interface is accessible to an unauthenticated party via an exposed physical connector, a network-bridge...

One or more SMB shares are accessible without valid credentials, allowing unauthenticated users to read or write files a...

One or more SMB shares are accessible without valid credentials, allowing unauthenticated users to read or write files a...

Nessus Professional identified a critical severity vulnerability (CVSS ≥ 9.0). This typically represents unauthenticated...

The target is running a version of OpenSSL affected by CVE-2014-0160 (Heartbleed). The TLS heartbeat extension implement...

The web management interface accepted default manufacturer credentials. An attacker can gain full administrative access ...

The access point uses WEP, a cryptographically broken cipher whose RC4/IV key can be recovered from captured traffic usi...

A file's cryptographic hash (MD5, SHA1, or SHA256) matches a known threat indicator in the pr0t31n threat intelligence d...

A plaintext or reversibly hashed password was found in a breach database (Dehashed) for a target-domain email address. D...

GitDorker or TruffleHog identified a secret, API key, token, or private key in a public GitHub repository associated wit...

TREVORspray successfully authenticated to M365/Azure AD with a discovered credential. Full account access to Microsoft c...

The target accepted well-known default or factory-set credentials, granting unauthorised access.

The AI pipeline abandoned its primary task entirely when processing a file containing an injected instruction in its met...

The AI pipeline returned an attacker-controlled classification label instead of performing genuine content analysis. The...

The AI pipeline disclosed its system prompt or internal configuration in response to an injected instruction embedded in...

The AI pipeline abandoned its primary task when processing a PDF whose document-info metadata (Author, Subject, Keywords...

The AI pipeline processed a PDF containing a hidden text layer (white text on white background) with an injected instruc...

The AI pipeline followed an injected instruction delivered as synthesised speech in a WAV audio file. The speech-to-text...

The AI pipeline followed an injected instruction placed in the body text of a DOCX (Word) document. The document XML bod...

Siphon confirmed that an API endpoint that should require authentication is accessible without any credentials. The endp...

Siphon confirmed that an administrative API endpoint is accessible by a non-administrative user or by an unauthenticated...

Siphon confirmed a Broken Object Level Authorization (BOLA) vulnerability, also known as IDOR (Insecure Direct Object Re...

The API login endpoint accepts default credentials (e.g., admin/admin, admin/password, admin/1234, root/root, test/test,...

Siphon confirmed an authentication bypass via JSON type confusion (type juggling). By submitting a non-string value in t...

Siphon confirmed that the API accepts JWTs signed with the 'none' algorithm (alg: none, alg: None, alg: NONE). The 'none...

Siphon confirmed a SQL injection vulnerability in an API parameter. User-supplied input is incorporated into a SQL query...

Siphon confirmed a boolean-based blind SQL injection vulnerability where injecting boolean conditions into an API parame...

Siphon confirmed a time-based blind SQL injection vulnerability. Injecting time-delay functions (e.g., SLEEP(5), WAITFOR...

Siphon confirmed a NoSQL injection vulnerability. User-supplied input is incorporated into a NoSQL database query (Mongo...

Siphon confirmed OS command injection in an API parameter. User-supplied input is passed directly or with insufficient s...

Siphon confirmed Server-Side Template Injection (SSTI) in an API endpoint. User-supplied input is embedded directly into...

Siphon confirmed an algorithm confusion attack where the API normally uses RS256 (asymmetric RSA) but also accepts token...

Siphon confirmed that the API fetches the JWT verification key from the URL specified in the jku (JWK Set URL) or x5u (X...

Siphon confirmed that the JWT kid (key ID) header value is incorporated into a SQL query without parameterization when l...

Siphon successfully cracked the HMAC signing secret used by the API to sign JWTs using offline dictionary or brute-force...

Siphon confirmed that the SOAP API's WS-Security implementation accepts messages that fail one or more fundamental authe...

Siphon identified that the HMAC secret used to sign JWTs is weak — matching a known default value, a short string, a dic...

Siphon confirmed an XML External Entity (XXE) injection vulnerability where the API accepts XML input and the underlying...

Siphon observed a database error message in the response after injecting SQL metacharacters into a parameter, indicating...

The Docker Engine API is accessible without authentication. Endpoints such as /v1.24/containers/json and /v1.24/images/j...

PostgreSQL accepts connections as user 'postgres' without requiring a password, indicating trust authentication is confi...

Grafana accepts the default credentials admin:admin, granting full administrative access to the Grafana instance.

The server accepts SSLv2 connections. SSLv2 is fundamentally broken and vulnerable to the DROWN attack (CVE-2016-0800), ...

The server is vulnerable to Heartbleed (CVE-2014-0160). An attacker can read up to 64 KB of server process memory per re...

An SMB share is accessible without authentication (null session or guest access). Files and directories on the share are...

An NTLMv1 authentication hash was captured via Responder poisoning. NTLMv1 is trivially crackable in seconds using rainb...

A service accepted a known factory-default username and password combination. Default credentials are documented publicl...

Hydra discovered valid SSH credentials by brute-forcing the login service. An attacker can authenticate interactively an...

Nuclei's default-login template confirmed a vendor-default credential pair is accepted by a web application or managemen...

sqlmap detected a SQL injection vulnerability in a web application parameter. An attacker can extract, modify, or delete...

BloodHound-Python graph collection identified a privilege escalation path from a compromised account to Domain Admin rig...

A VNC service is accessible from the network without requiring authentication. An attacker has full graphical desktop ac...

The IPMI/BMC interface is vulnerable to an authentication bypass (CVE-2013-4786 / Cipher 0 attack) allowing unauthentica...

ODAT discovered valid credentials on an Oracle database listener (port 1521). An attacker with database access can exfil...

msdat discovered valid credentials on a Microsoft SQL Server (port 1433/1434). Attackers can query data, execute xp_cmds...

The target host has been positively confirmed as vulnerable to EternalBlue (MS17-010). The SMBv1 implementation in the W...

The target host exposes SMBv1 and does not appear to have the MS17-010 patch applied, indicating a high likelihood of vu...

The SMBv1 protocol is enabled on this host. SMBv1 is a legacy protocol deprecated by Microsoft in 2014 that contains the...

The IPMI 2.0 implementation on this host accepts Cipher Suite 0 (null authentication), allowing an unauthenticated attac...

The SSH server accepts the 'none' authentication method due to an authentication bypass vulnerability in libSSH (CVE-201...

The Redis server on this host is accessible without authentication. Redis provides no access control beyond an optional ...

The MySQL server accepts connections as the root user without a password from the network. This grants an attacker full ...

A VMware ESXi management interface (vSphere Client HTTPS on port 443, or ESXi Shell on port 22) is accessible from the n...

Valid credentials were used to authenticate to the SMB service with administrative privileges, and access to administrat...

Automated credential brute-force or password spraying discovered a valid username and password combination against a net...

Credentials (usernames, passwords, API keys, tokens, or connection strings) were discovered in plaintext within web-acce...

The target server is confirmed vulnerable to Heartbleed (CVE-2014-0160). The OpenSSL heartbeat extension does not proper...

The operating system running on this host has reached End-of-Life (EOL) status and is no longer receiving security updat...

The VNC server accepts connections with security type 1 (None), allowing any remote user to connect without providing cr...

The WinRM (Windows Remote Management) service responded to an unauthenticated SOAP/WS-Management request without requiri...

The Kubernetes API server is accessible without authentication. Unauthenticated requests can list, create, and modify cl...

The Kubelet API on port 10250 is accessible without authentication, allowing direct interaction with containers running ...

Memcached is accessible without authentication. The 'stats' command returned data successfully, confirming no authentica...

The RabbitMQ management UI is accessible with default credentials (guest/guest). The management API returned cluster ove...

The cloud instance metadata endpoint (169.254.169.254) is accessible from an internal web service, indicating potential ...

The Jenkins Groovy Script Console at /script is accessible without authentication, allowing execution of arbitrary Groov...

The host is vulnerable to CVE-2020-0796 (SMBGhost), a buffer overflow in SMBv3 compression handling in Windows 10 (1903/...

The FTP service accepted well-known default or factory-set credentials, granting authenticated access to the file transf...

brutespray confirmed that a network service accepts default or factory-preset credentials. The service responded with a ...

A complete WPA/WPA2 4-way handshake or PMKID was captured for the target SSID. While the PSK has not yet been recovered,...

The target WPA3 SAE implementation accepted an invalid elliptic-curve point during the SAE Commit exchange (attack mode ...

The target WPA3 SAE implementation is vulnerable to the SAE reflection attack (attack mode 0). By reflecting the AP's ow...

The target WPA3 SAE implementation is vulnerable to a secondary invalid curve attack variant (attack mode 2). This varia...

The target WPA3 SAE implementation accepted a SAE Commit message with a zero scalar value (attack mode 3). Sending a sca...

The target client or AP is vulnerable to the KRACK key reinstallation attack targeting the standard 4-way handshake (CVE...

The target is vulnerable to the KRACK Temporal PTK (TPTK) variant (CVE-2017-13078). This variant exploits the handling o...

The target is vulnerable to KRACK group key reinstallation (CVE-2017-13080). By replaying group key handshake message 1,...

The target network uses WEP (Wired Equivalent Privacy), which has been cryptographically broken since 2001 (CVE-2001-030...

hcxdumptool captured a PMKID or EAPOL hash for the target SSID without requiring a connected client or deauthentication....

One or more wireless clients associated to an attacker-controlled rogue AP that cloned the target SSID and BSSID. Client...

ARP cache poisoning was successfully performed on the rogue AP's subnet, placing the assessment system in a man-in-the-m...

Responder successfully poisoned LLMNR (Link-Local Multicast Name Resolution) and/or NBT-NS (NetBIOS Name Service) querie...

A TKIP ChopChop or fragmentation attack (Beck-Tews / Ohigashi-Morii) was confirmed against the target network. An attack...

The WPS PIN for a Wi-Fi Direct device was recovered via reaver or a Pixie Dust offline attack. An attacker with this PIN...

Unauthenticated clients on the open SSID can resolve arbitrary hostnames via external DNS resolvers (e.g. 1.1.1.1, 8.8.8...

Direct outbound traffic over IPv6 succeeded from an unauthenticated client on the open SSID, while IPv4 traffic was (or ...

The RADIUS server certificate used for EAP-TLS (or PEAP/TTLS server validation) uses a signature algorithm or RSA key le...

An SSID was observed broadcast across multiple BSSIDs with materially different authentication modes. Example: the same ...

On a Meraki SSID using Identity PSK (iPSK), the test confirmed that authentication is keyed primarily on MAC address — s...

From the guest SSID before completing the captive portal sign-in, DNS queries to external resolvers (e.g., 8.8.8.8) succ...

A firewall rule permits SSH (TCP 22) from untrusted or external sources. SSH brute-force attacks are extremely common ag...

A firewall rule permits Telnet (TCP 23). Telnet transmits all data including credentials in plaintext and has been depre...

A firewall rule permits Microsoft RPC (TCP 135) from external sources. MS-RPC is a critical Windows service used for DCO...

A firewall rule permits NetBIOS (UDP 137-138, TCP 139) traffic. NetBIOS is a legacy Windows protocol that enables reconn...

A firewall rule permits SNMP (UDP 161) from any source address. SNMP exposes device configurations, routing tables, and ...

SNMP is permitted through the firewall with likely v1/v2c community string authentication. SNMPv1 and v2c use cleartext ...

A firewall rule permits Windows Remote Management (WinRM, TCP 5985 HTTP or 5986 HTTPS) from external sources. WinRM prov...

A firewall rule permits TFTP (UDP 69). TFTP has no authentication mechanism — any client that can reach the TFTP server ...

HTTP (cleartext) is enabled for firewall or device management. All management traffic including credentials is transmitt...

HTTPS device management is accessible from any source IP address. While HTTPS provides encryption, unrestricted access e...

One or more permit (allow) rules do not have logging enabled. Traffic matching these rules is not captured in firewall l...

No DMZ zone or interface has been identified in the firewall configuration. Public-facing services appear to be placed i...

Permit rules exist that allow direct traffic from the external/internet zone to internal high-trust zones without passin...

The firewall configuration defines only a single zone or network interface. All traffic flows through a single segment w...

Permit rules allow traffic to private (RFC-1918) destination addresses from external zones without corresponding NAT tra...

BGP (TCP 179) or OSPF routing protocol traffic is permitted from external or untrusted sources. Routing protocol injecti...

MQTT broker ports (TCP 1883 unencrypted or 8883 TLS) are accessible from untrusted sources. MQTT is the primary IoT mess...

Internet-bound traffic is permitted without application or destination restriction, bypassing CASB and URL filtering con...

No default-deny network policy exists in Cloudflare Gateway. Traffic not matching any explicit rule is passed through.

A network policy permits SSH or RDP from any source without identity conditions in Cloudflare Gateway.

Rules permit traffic to/from IP ranges or ports associated with consumer IoT devices (smart TVs, streaming, home assista...

Remote access to the executive environment relies on traditional VPN without identity-aware, device-posture-based contro...

A firewall rule permits traffic with a source or destination address that is flagged as KNOWN MALICIOUS by multiple thre...

{...} account(s) have Kerberos pre-authentication disabled (DONT_REQUIRE_PREAUTH flag). These accounts are vulnerable to...

{...} non-domain-controller account(s) are configured for unconstrained Kerberos delegation. These systems can impersona...

The domain password policy does not meet security best practices. Minimum password length, complexity requirements, or p...

Local Administrator Password Solution (LAPS) is not deployed on this system or in the domain. Without LAPS, local admini...

A certificate template has an Extended Key Usage (EKU) of 'Any Purpose' (OID 2.5.29.37.0) or no EKU at all (which is equ...

A certificate template with the Certificate Request Agent EKU (OID 1.3.6.1.4.1.311.20.2.1) allows low-privileged users t...

A certificate template's access control list (ACL) grants write permissions (WriteDACL, WriteOwner, WriteProperty, or Ge...

The AD Certificate Services web enrollment endpoint is accessible over HTTP (not HTTPS) and/or does not enforce Extended...

One or more browser extensions match known malicious extensions in the threat intelligence database. These extensions ma...

NetBIOS over TCP/IP (NBT) is enabled on one or more network interfaces, exposing the legacy name resolution and session ...

Files containing plaintext or easily reversible credentials were found on disk. This includes unattend.xml/autounattend....

Cloud provider credential files were found on this system. This includes AWS credentials (~/.aws/credentials), Azure pro...

Brute-force login activity detected with multiple failed authentication attempts from the same source within the past 7 ...

PowerShell events contain suspicious patterns including encoded commands (-EncodedCommand), download cradles (Invoke-Web...

User Account Control (UAC) is completely disabled on this endpoint. The registry value EnableLUA under HKLM\SOFTWARE\Mic...

The LAN Manager authentication level allows NTLMv1 responses, a weak authentication protocol that is trivially crackable...

The system is configured to store LAN Manager (LM) hash values for passwords, a severely weak hash format.

Local Security Authority (LSA) protection is not enabled. The RunAsPPL registry value is not set to 1 at HKLM\SYSTEM\Cur...

Link-Local Multicast Name Resolution (LLMNR) is enabled, allowing unauthenticated name resolution on the local network.

Windows Defender Antivirus is completely disabled or not running on this endpoint with no alternative antimalware soluti...

Windows Defender is installed but real-time protection is turned off, leaving the system without active file scanning.

Remote Desktop Protocol is enabled without requiring Network Level Authentication (NLA), allowing unauthenticated users ...

Anonymous (null session) access to named pipes is permitted, allowing unauthenticated users to connect to specific named...

The system allows null session (anonymous) connections for SAM enumeration and share enumeration.

Accounts with empty passwords can authenticate over the network (SMB, RDP, WinRM). LimitBlankPasswordUse is disabled.

The Everyone security group includes anonymous (unauthenticated) connections. Any resource with Everyone permissions is ...

Remote Desktop is configured with weak or legacy transport encryption. Sessions can be intercepted or downgraded by an o...

Sensitive user rights (SeDebugPrivilege, SeLoadDriverPrivilege, SeBackupPrivilege, etc.) are assigned to accounts beyond...

The Windows Firewall is disabled for the Domain network profile.

Active WMI event subscriptions (EventFilter + EventConsumer + FilterToConsumerBinding) were found on this system. WMI su...

The AppInit_DLLs registry value is configured with one or more DLL paths. Windows loads any DLL listed in AppInit_DLLs i...

Image File Execution Options (IFEO) registry entries have a 'Debugger' value set for one or more executables. This cause...

Non-default authentication packages or security support providers (SSPs) are registered in the LSA registry configuratio...

The AlwaysInstallElevated policy is enabled in both HKLM and HKCU registry hives. This Windows Installer policy allows a...

One or more Windows service executables reside in directories that are writable by non-administrative users, or the serv...

The current process or service accounts hold dangerous Windows token privileges. SeImpersonatePrivilege and SeAssignPrim...

One or more processes are executing from temporary directories (%TEMP%, %TMP%, C:\Windows\Temp). Legitimate software rar...

A remote management tool (TeamViewer, AnyDesk, LogMeIn, ConnectWise, Splashtop, etc.) was detected that is not part of t...

Development tools (compilers, debuggers, IDEs, scripting language interpreters beyond what the system requires) are inst...

Installed software matches known vulnerable versions with published CVEs or documented security defects. These versions ...

High-risk services are actively running, including services that transmit credentials in cleartext (Telnet), allow remot...

Network tunneling or overlay network software is installed. These tools create encrypted channels that can bypass firewa...

SQL Server is configured with mixed authentication mode, allowing both Windows and SQL Server authentication. SQL authen...

The Windows operating system version running on this endpoint has reached end-of-life and no longer receives security up...

The built-in Guest account is enabled on this endpoint, allowing unauthenticated or minimally-authenticated access.

The local password policy does not meet security baselines: minimum length is less than 8 characters and/or password com...

The WordPress XML-RPC interface (xmlrpc.php) is enabled and accessible. This legacy interface enables brute-force attack...

The XML-RPC system.multicall method is enabled, allowing an attacker to test hundreds of username/password combinations ...

The XML-RPC pingback.ping method is accessible. An attacker can abuse this to perform Server-Side Request Forgery (SSRF)...

The WordPress XML-RPC endpoint responds to requests. The full list of available methods was retrieved, confirming the at...

The WordPress REST API /wp/v2/users endpoint returns a list of registered usernames and IDs without authentication. This...

The WordPress debug log file (wp-content/debug.log) is publicly accessible. Debug logs may contain PHP errors, stack tra...

An administrative interface was discovered at a predictable path. Admin interfaces exposed to the internet are high-valu...

A backup file (e.g., .bak, .old, .orig, ~, .zip) was discovered in the web root. Backup files often contain source code,...

A Subversion (.svn) or CVS repository directory is accessible from the web root. Repository metadata can be used to reco...

An application or server log file is publicly accessible. Log files may contain IP addresses, usernames, session tokens,...

The TLS certificate presented by the server has expired. Browser warnings will be displayed, and the certificate can no ...

The TLS certificate presented by the server has a notBefore date in the future, meaning it is not yet valid. Clients may...

The Common Name or Subject Alternative Names in the TLS certificate do not match the hostname being accessed. This break...

The server supports one or more deprecated TLS/SSL protocol versions (SSLv2, SSLv3, TLS 1.0, or TLS 1.1). These protocol...

The server supports weak cipher suites including NULL encryption, RC4, DES, 3DES, or export-grade ciphers. Weak ciphers ...

The server supports SSLv3, making it vulnerable to the POODLE (Padding Oracle On Downgraded Legacy Encryption) attack. A...

The server supports DHE key exchange with weak (export-grade) Diffie-Hellman parameters (512-bit), making it vulnerable ...

The server supports RSA_EXPORT cipher suites, making it vulnerable to the FREAK (Factoring RSA Export Keys) attack. An a...

The server is vulnerable to the ROBOT (Return Of Bleichenbacher's Oracle Threat) attack, allowing an attacker to perform...

The server is vulnerable to the OpenSSL CCS Injection vulnerability (CVE-2014-0224). An attacker with MITM position can ...

The server is vulnerable to Ticketbleed (CVE-2016-9244) in F5 BIG-IP TLS implementations, allowing an attacker to read u...

A subdomain DNS record points to an external service (e.g., GitHub Pages, S3, Heroku, Netlify) that is no longer claimed...

JSON Web Tokens (JWTs) are stored in browser localStorage. localStorage is accessible to JavaScript, making JWT tokens v...

The server accepts JWT tokens after their 'exp' (expiration) claim has passed. This allows indefinite reuse of stolen or...

Reflected Cross-Site Scripting was detected. User-supplied input is returned in the HTTP response without proper encodin...

Stored Cross-Site Scripting was detected. Malicious scripts submitted by an attacker are persisted in the application's ...

DOM-based Cross-Site Scripting was detected. Client-side JavaScript reads attacker-controlled data (e.g., from URL fragm...

LDAP injection was detected. User input is incorporated into LDAP query filters without proper escaping. An attacker can...

XPath injection was detected. User input is embedded in XPath query expressions without sanitization. An attacker can ma...

Sensitive secrets (API keys, credentials, tokens, private keys) were found hardcoded in client-side JavaScript files. Th...

Path traversal (directory traversal) was detected. An attacker can use sequences like ../../ in user-supplied file path ...

SSRF was exploited to access internal network services (RFC 1918 address ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/...

Authenticated pages or resources are accessible by directly navigating to their URLs without an active session. Authenti...

Password reset tokens are short, sequential, or based on predictable data (timestamp, username hash, MD5). An attacker c...

A vulnerability scanner (Nuclei) identified a known CVE in a component used by the application. The component version ma...

A Nuclei scan identified an exposed administrative or monitoring panel (e.g., Grafana, Kibana, Consul, Prometheus, Jenki...

The GraphQL endpoint accepts batched queries, allowing multiple queries to be sent in a single HTTP request. This can be...

The GraphQL endpoint does not enforce query depth limits. An attacker can craft deeply nested queries that cause exponen...

The login endpoint does not implement account lockout or rate limiting after repeated failed authentication attempts. An...

Insecure Direct Object Reference (IDOR) was detected. Direct references to internal objects (user IDs, record IDs, file ...

Horizontal privilege escalation was detected. An authenticated user can access or modify another user's resources by man...

Application functions (APIs, admin actions) are protected only by hiding them from the UI but lack server-side access co...

Session fixation was detected. The application does not generate a new session ID after successful authentication. An at...

Session tokens are transmitted in URL query parameters. Session tokens in URLs are exposed in browser history, referrer ...

Session tokens remain valid on the server after the user logs out. An attacker who captures a session token before logou...

Cross-Site Request Forgery (CSRF) was detected. State-changing requests lack CSRF tokens or other anti-CSRF mechanisms. ...

The application includes CSRF tokens in forms but does not validate them server-side, or accepts any non-empty value as ...

Data belonging to one user is visible to another user due to insufficient isolation in shared resources, caches, or mult...

The file upload validation relies solely on the Content-Type header or file extension, which can be manipulated by an at...

The file upload functionality uses the client-supplied filename in the server-side file path without sanitization. An at...

Mass assignment (also known as auto-binding) was detected. The application binds HTTP request parameters directly to int...

API endpoints expose object-level access without authorization validation. An authenticated user can access or modify an...

API endpoints with administrative or privileged functionality are accessible to lower-privileged or unauthenticated user...

The server reflects the request's Origin header in the Access-Control-Allow-Origin response header and includes Access-C...

The server includes 'Access-Control-Allow-Origin: null' in its response. This allows sandboxed iframes, redirects, and l...

The application accepts negative numeric values in business-critical fields (quantity, price, payment amount). This can ...

The application trusts client-submitted pricing data without server-side verification. An attacker can manipulate price ...

Multi-step workflows (checkout, verification, approval) can be bypassed by directly accessing later steps without comple...

A race condition was detected in a critical business operation (e.g., balance check-then-debit, coupon redemption, token...

File download endpoints use user-supplied filenames or IDs to retrieve files without ownership validation or path saniti...

ffuf content discovery identified an administrative interface or control panel at a predictable path. Administrative pat...

API responses or page content expose personally identifiable information (PII) such as email addresses, phone numbers, S...

A subdomain's DNS CNAME points to an AWS S3 bucket that returns a NoSuchBucket error. An attacker can create an S3 bucke...

A subdomain's DNS CNAME points to a GitHub Pages site that no longer exists or is unclaimed. An attacker can create a ma...

A subdomain's DNS CNAME points to a Heroku application that has been deleted or is unclaimed. An attacker can provision ...

Prototype pollution was detected. User-controlled JSON or query parameter keys such as __proto__, constructor, or protot...

Web cache poisoning was detected. The caching layer reflects unkeyed request headers (X-Forwarded-Host, X-Original-URL) ...

GraphQL queries can access data from unauthorized objects or users by bypassing field-level authorization. Inline fragme...

An endpoint designated as requiring authentication is accessible without any session token or authentication credentials...

An endpoint restricted to a higher-privileged role (admin, manager) is accessible by a lower-privileged authenticated us...

Authenticated user A can read data owned by user B by manipulating object identifiers in API requests. Object-level auth...

The server supports HTTP/2 and may be vulnerable to the HTTP/2 Rapid Reset attack (CVE-2023-44487). An attacker can open...

The WAF or CDN is blocking all requests from the scanner's IP address. All subsequent results from this point forward ma...

An unkeyed request header was reflected in a cached response. An attacker can inject this header with a malicious value ...

A CNAME DNS record points to an unclaimed external service endpoint. An attacker can claim this endpoint and serve malic...

The DNS server permits full zone transfer (AXFR) requests, allowing any external host to retrieve all DNS records for th...

A sensitive file was found accessible on the web server. Sensitive files may contain credentials, configuration data, pr...

An administrative panel or management interface was found publicly accessible. Exposure of admin panels increases the at...

A debug or administrative endpoint was found publicly accessible. These endpoints may expose configuration data, heap du...

A WordPress-specific vulnerability or security misconfiguration was identified. WordPress misconfigurations may allow un...

WordPress usernames were enumerated via the REST API /wp-json/wp/v2/users endpoint. Exposed usernames enable targeted br...

WordPress usernames were enumerated by probing author archive URLs (?author=N). The server redirected to user-specific a...

The WordPress debug log (wp-content/debug.log) is publicly accessible. Debug logs may contain database credentials, file...

A WordPress backup or export file was found accessible on the web server. These files may contain the full database dump...

A PHP error log file is publicly accessible. Error logs may contain database credentials, file system paths, internal fu...

The TimThumb image resizing script was detected. Outdated versions of TimThumb contain remote file inclusion vulnerabili...

A sensitive WordPress file or directory was found publicly accessible. This may expose credentials, configuration, or in...

The server's TLS certificate has passed its expiry date, causing browser trust errors and indicating a breakdown in cert...

The TLS certificate's Subject Alternative Names do not cover the target hostname. Clients will display a certificate mis...

Reflected XSS was detected. User-supplied input is immediately reflected in the server response without encoding, allowi...

DOM-based XSS was detected. JavaScript in the page reads attacker-controlled data from an insecure source (URL fragment,...

dalfox confirmed a Cross-Site Scripting (XSS) vulnerability with a working payload that executes in the browser. XSS ena...

Log injection was detected. User-supplied input containing CRLF characters is written to application logs without saniti...

Blind SSRF was detected via out-of-band interaction. The server made a DNS or HTTP request to an attacker-controlled hos...

A deserialisation error was triggered by a crafted payload and the error message was returned in the response. Error dis...

A detailed stack trace or internal error message was returned in response to a crafted request. Stack traces disclose so...

Credentials, API keys, tokens, or other secrets were identified in client-side JavaScript source files. Client-side secr...

Sensitive information (credentials, internal URLs, private keys, PII, or internal comments) was identified in the HTML s...

The authentication endpoint does not implement rate limiting or brute-force protection. Attackers can submit unlimited l...

The session token appears to have low entropy or a predictable pattern. Predictable tokens allow attackers to brute-forc...

The session token has low statistical entropy as measured across multiple sample tokens. Low-entropy tokens can be brute...

The application does not rotate the session identifier after successful authentication. An attacker can set a known sess...

The server-side session is not invalidated after the user logs out. The session token remains valid for an extended peri...

The pre-logout session token remains valid server-side after the logout request. An attacker who obtains a session token...

The CORS configuration reflects arbitrary origins with Access-Control-Allow-Credentials: true. This allows attacker-cont...

A JSONP endpoint was identified. JSONP endpoints allow any website to read the response content by including a script ta...

A state-changing request (POST, PUT, PATCH, DELETE) does not include a CSRF token or other origin verification mechanism...

A path or endpoint that should require authentication returned a successful response (HTTP 200) without providing valid ...

A debug mode or developer console is enabled and publicly accessible. Debug interfaces may expose command execution, env...

Data belonging to one user was returned when authenticated as a different user by manipulating object identifiers. This ...

Object-level authorisation is insufficient. Manipulation of object identifiers (IDs, UUIDs, slugs) allows access to reso...

Function-level authorisation is insufficient. A lower-privileged user can access administrative or elevated-privilege en...

A lower-privileged role was able to access an administrative path. This demonstrates a broken function-level access cont...

The application binds user-supplied request parameters directly to server-side objects without filtering. This allows at...

An API endpoint returns identical data regardless of the authenticated user's identity. This may indicate missing author...

A hidden form field or request parameter controlling a monetary or critical value (e.g., price, quantity, discount) can ...

A numeric field (e.g., quantity, amount) accepts negative or zero values that the business logic does not validate, pote...

Rapid concurrent submissions of the same request produce responses suggesting duplicate processing. A race condition may...

A multi-step workflow step is directly accessible without completing preceding steps. This allows skipping of security c...

A public exploit was found matching an identified software component or version. The existence of a public exploit signi...

Credentials or session tokens were found transmitted in URL query parameters. URL query parameters are stored in browser...

A lower-privileged role can access an administrative endpoint that should be restricted to higher-privilege roles, indic...

The server is vulnerable to CL.0 client-side desync, a variant of HTTP request smuggling where the server ignores a Cont...

The front-end server uses Content-Length while the back-end uses Transfer-Encoding, allowing an attacker to smuggle a se...

The server is vulnerable to Transfer-Encoding obfuscation, where variations of the TE header (e.g., extra whitespace, li...

The front-end server uses Transfer-Encoding while the back-end uses Content-Length, allowing an attacker to smuggle a se...

The application reflects or acts upon the Host header value in server-side operations, creating a potential Server-Side ...

The JWT signing secret was recovered through brute-force or dictionary attack, allowing an attacker to forge valid token...

A POST request parameter is reflected in the server's response without proper output encoding, allowing injection of mal...

A third-party software component with known vulnerabilities was identified in the application's technology stack. The sp...

The application processes JSON input containing __proto__ or constructor.prototype properties, allowing modification of ...

The application reflects user input through an ESI-capable cache layer, allowing injection of ESI include directives.

A contact or email form accepts CRLF sequences in input fields, allowing injection of additional email headers.

The login form processes Unicode lookalike characters differently than expected, potentially mapping them to valid usern...

A WebSocket endpoint accepts upgrade requests without requiring authentication credentials.

The WebSocket endpoint reflects user-supplied message content without sanitization, enabling script injection.

Appending a static file extension to authenticated URLs causes the CDN/proxy to cache and serve sensitive content public...

The OAuth authorization endpoint does not strictly validate the redirect_uri parameter, allowing redirection to attacker...

The OAuth implementation uses the implicit flow, placing access tokens in URL fragments.

The OAuth authorization server grants elevated scopes beyond what the client originally requested.

An internal endpoint that is blocked at the proxy level becomes accessible when requested via an h2c upgrade connection.

Administrative or restricted paths are accessible without authentication, indicating missing or misconfigured access con...

The web server exposes log file(s) to unauthenticated users. Log files commonly contain internal IP addresses, stack tra...

Spatie Ray debug tool is accessible at /_ray/api/health. Ray allows remote code inspection and can expose application in...

Express.js default error handler returns stack traces to clients, disclosing file paths, module versions, and applicatio...

Laravel Ignition execute-solution endpoint is accessible, potentially enabling remote code execution via CVE-2021-3129.

The TLS certificate presented by the server has passed its notAfter date and is no longer valid. Expired certificates br...

The TLS certificate presented by the server has been revoked by its issuing Certificate Authority. Certificate revocatio...

The TLS certificate fingerprint identifies this host as an Ivanti Cloud Services Appliance (CSA). Ivanti CSA has been th...

The TLS certificate fingerprint identifies this host as a Pulse Secure / Ivanti Connect Secure VPN appliance. This produ...

The TLS certificate fingerprint identifies this host as a Citrix NetScaler or ADC appliance. Citrix ADC has been the tar...

commix detected blind OS command injection via time-based techniques. The application's response time varied when time-d...

toxicache confirmed that the web cache can be poisoned. An unkeyed input (such as an HTTP header not included in the cac...

The device broadcasts a serial number, patient identifier, or other per-unit token in its advertising name or manufactur...

The device negotiated Just Works pairing (SMP MITM-protection bit = 0, or an IO capability of NoInputNoOutput on either ...

The device negotiated LE Legacy pairing (SMP Secure Connections bit = 0). Legacy derives the session key from a weak Tem...

The device authenticates LE Secure Connections pairing with a static or reused 6-digit passkey — printed on the enclosur...

A man-in-the-middle can negotiate Numeric Comparison with one device and Passkey Entry with the other in the same ceremo...

The device completed pairing after a forced downgrade offer (Secure Connections cleared, IO capability set to NoInputNoO...

The device negotiated a maximum encryption key size below 16 bytes (BLE floor is 7). Short keys reduce brute-force cost ...

The BR/EDR encryption key-entropy negotiation (LMP) is not integrity-protected, letting a MITM force both devices to a 1...

Weaknesses in BR/EDR session-key derivation (Core Spec 4.2-5.4) permit unilateral, repeatable session-key derivation, br...

BR/EDR authentication does not mandate mutual authentication; via role-switch and SC-to-legacy downgrade an attacker imp...

BLE reconnection authentication is optional and often not enforced by the client, so a central accepts spoofed data from...

One or more GATT characteristics returned data over an unpaired, unencrypted link (ATT Read Response with a value and no...

On an unpaired link the device granted a large ATT MTU and started notifications/indications after a CCCD write, streami...

The device's BLE System-on-Chip belongs to a vendor/part with known SweynTooth firmware vulnerabilities in the Link Laye...

The device's BR/EDR System-on-Chip belongs to a vendor/part with known BrakTooth LMP/Baseband vulnerabilities (V1-V16), ...

The Linux host behind the Bluetooth controller runs an unpatched BlueZ kernel (< 5.9), exposing the BleedingTooth family...

The host Bluetooth stack (Linux BlueZ, Android, Windows, or old iOS) predates the 2017 BlueBorne patches, exposing SDP/B...

The device crashed or deadlocked when sent a malformed Link-Layer / HCI PDU (the generic class covering SweynTooth/BrakT...

The 6-digit LE Secure Connections Passkey Entry passkey was recovered offline from a passively-captured pairing. In LESC...

An injected CAN frame was accepted and processed by the device. CAN has no built-in authentication; any node on the bus ...

LLMNR and/or NBT-NS broadcast name resolution is active on the network, allowing an attacker to poison responses with Re...

LLMNR and/or NBT-NS broadcast name resolution is active on the network, allowing an attacker to poison responses with Re...

A proprietary (non-LoRaWAN) LoRa frame carried an application payload that decodes to printable/structured cleartext, in...

The device is activated by ABP (Activation By Personalization), so the NwkSKey and AppSKey are provisioned as static, lo...

The device uses OTAA under LoRaWAN 1.0.x, where the end device cannot detect a repeated Join-Accept and the network serv...

The network accepted a LoRaWAN uplink whose frame counter (FCnt) was equal to or lower than a previously-seen value — ob...

A Telnet service is accessible on the network, transmitting all data including authentication credentials in cleartext, ...

The SNMP service accepts a well-known default community string (e.g., public/private), allowing unauthenticated read (an...

The FTP service accepts the anonymous username without credentials, potentially exposing hosted files or allowing unauth...

An NFS export is accessible to all hosts (wildcard * or 0.0.0.0/0 in /etc/exports). Any host on the network can mount an...

The FTP server accepts the PORT command with arbitrary destination IP addresses, enabling FTP bounce attacks. In a bounc...

The NFS server responded to showmount queries, exposing a list of exported filesystem paths and their allowed client spe...

One or more NFS exports are configured with insecure options that increase the risk of unauthorised access or privilege ...

An industrial or operational technology (OT) protocol was detected on the network, including but not limited to Modbus/T...

A fixed-code (static OOK/ASK) sub-GHz remote or command protocol was decoded, meaning the device transmits the identical...

A captured sub-GHz command was re-transmitted (operator-confirmed, benign) and the device under test acted on it, confir...

The device's sub-GHz control channel accepts commands with no authentication of the sender — the demodulated OOK/FSK fra...

Proxmark3 successfully read the UID of an RFID credential within range of the device reader. Systems relying solely on U...

The RFID card data blocks were successfully read without authentication. Sensitive data stored in card memory (employee ...

The card served sensitive file content in response to raw READ BINARY APDUs with no Cardholder Verification Method enfor...

An elementary file was read via a raw READ BINARY APDU that returned 0x9000 with data without any prior VERIFY/cardholde...

The card accepted a well-known factory default PIN via an ISO-7816 VERIFY command (SW 0x9000) during an operator-confirm...

A serial console (UART, RS-232) provided an interactive unauthenticated shell or bootloader prompt on connection.

SMB packet signing is not enforced on the server, allowing an attacker positioned between client and server to relay or ...

The SSH service is configured with one or more weaknesses including weak ciphers/MACs, SSHv1 support, permitted root log...

The server's TLS certificate has passed its expiry date, causing browser trust errors and indicating a breakdown in cert...

TLS 1.0 or TLS 1.1 is accepted. These protocol versions are deprecated by RFC 8996 and vulnerable to BEAST, POODLE, and ...

The device accepted keystroke injection from an emulated HID keyboard without any restriction or rate-limiting. A pre-pr...

A Bash Bunny HID payload was executed by the device. The injected keystrokes were processed without restriction.

The UWB ranging exchange does not carry a Scrambled Timestamp Sequence (STS mode 0 / disabled, or a legacy 802.15.4a dev...

Ranging frames are exchanged without cryptographic authentication of the timestamp, so a receiver cannot verify that a p...

Without enforced STS integrity, an over-the-air adversary can inject an early cipher-guessed STS/preamble to make the ra...

An attacker relaying UWB ranging frames between a genuine tag and anchor can make a far peer appear in proximity. STS-ba...

Previously-captured UWB ranging frames (poll/response/final or blink) were replayed and accepted by the ranging peer, sh...

Nessus Professional identified a high severity vulnerability (CVSS 7.0–8.9). Often exploitable by local or adjacent atta...

The service banner matched a known CVE in the NVD or OSV.dev database. The software version identified in the banner is ...

A service banner or version string indicates software that has passed its vendor end-of-life date. No further security p...

The operating system identified from banners or Nessus output has passed its vendor support end-of-life date. The OS wil...

Nuclei matched a CVE-tagged template against the target. The response pattern confirms the service is exhibiting behavio...

Nuclei identified an exposed administrative or management panel accessible without prior authentication (e.g., Grafana, ...

The access point provides no link-layer encryption (open authentication). All frames to and from associated devices are ...

The WPS registrar generates predictable/low-entropy E-S1/E-S2 Diffie-Hellman nonces, allowing the WPS PIN to be recovere...

The device under test associated with a rogue access point cloning the target SSID (optionally PMF-less / WPA2-only) ins...

Zigbee frames were captured from the device. Depending on the security profile, payloads may disclose network keys, sens...

Actionable Z-Wave control traffic (e.g. Binary Switch, Multilevel Switch, Door Lock, Alarm) was observed in the clear, w...

Because the network uses S0, its network key is derivable by any attacker who captures a device inclusion: the Network K...

During inclusion the controller accepted a downgrade of the negotiated security class from S2 to the legacy S0 command c...

A previously captured unencrypted (or S0) Z-Wave command frame was retransmitted and the device acted on it, confirming ...

A sensitive credential, token, API key, private key, or connection string was detected in a file's contents. The specifi...

A certificate or private key file uses a cryptographic key shorter than 2048 bits. Keys below this threshold are conside...

The server's TLS certificate has passed its expiry date, causing browser trust errors and indicating a breakdown in cert...

An email address associated with the target organisation appeared in a known data breach (HIBP or Dehashed). The account...

TREVORspray or Azure AD authentication confirmed that a discovered email address is a valid M365/Azure AD account (user ...

A subdomain has a CNAME pointing to an external service (e.g., GitHub Pages, S3, Heroku, Shopify) that is no longer clai...

The DNS server responds to unauthenticated AXFR zone transfer requests, exposing the complete DNS zone including interna...

Shodan has associated one or more CVEs with a service running on a target IP based on the service banner and version str...

cloud_enum or manual enumeration discovered a publicly accessible cloud storage bucket (AWS S3, Azure Blob, GCP Storage)...

katana or xurlfind3r discovered a publicly accessible file containing potentially sensitive data: backup archives (.zip,...

Content matching the US Social Security Number format (XXX-XX-XXXX, nine digits with specific separators) was identified...

gato identified a GitHub Actions workflow that uses unsanitized expression substitution (${{ }}) with attacker-controlle...

gato identified a workflow configuration where secrets are accessible to jobs or steps that process untrusted input. An ...

hakoriginfinder discovered the origin server IP address behind the CDN/WAF. The origin IP responds to HTTP requests dire...

The AI pipeline completed its primary task but also followed an injected instruction to prefix its output with an attack...

The AI pipeline followed an injected instruction that claimed special authority (e.g. 'AUTHORIZED EVALUATOR', 'ADMIN OVE...

The AI pipeline completed its primary task but also followed the injected instruction — the canary token appeared in the...

The injected payload was not detected in the immediate AI response but was found persisted in stored results at the veri...

The AI pipeline followed an injected instruction embedded in a PNG image's tEXt/iTXt metadata chunks (Comment, Descripti...

The AI pipeline followed an injected instruction rendered as visible text in an image. The text was extracted via OCR (o...

The AI pipeline followed an injected instruction embedded in audio file metadata (ID3 tags: Title, Artist, Album, Commen...

The AI pipeline followed an injected instruction placed in a DOCX document's comment annotations. Document comments are ...

The AI pipeline followed an injected instruction placed in text files within a ZIP archive (document.txt, data.csv, note...

SMBv1 protocol traffic observed between the device and one or more internal peers. SMBv1 is deprecated since 2014 and is...

LLMNR or NetBIOS Name Service broadcast-based name resolution is in use on the segment. These protocols are abused by Re...