Sample pentest reportAnonymized evaluation

Storefront security assessment

Generated September 4, 2026 at 11:04 PM•

Risk Level:Critical Risk

Download sample PDF

Security Baseline

100

Critical Risk

Baseline Risk Score

Welcome to Your First Security Pentest!

This baseline pentest establishes your security posture and identifies current vulnerabilities. Future pentests will track improvements, show trends, and highlight newly discovered or fixed issues.

Understanding Reports Core Concepts

Executive Summary

Comprehensive analysis of security posture and recommended actions

This assessment of http://storefront.example completed over a 248-minute scan window and returned a critical risk level with a risk score of 100 out of 100, the highest rating available. A total of 34 new vulnerabilities were identified, including 8 critical, 9 high, 4 medium, 8 low, and 5 informati...

30 of 34 findings in this report are graded on evidence from a reproduction that independently observed the reported impact. The remaining 4 have not been reproduced, and their severity is capped at medium regardless of what was claimed. 11 findings are shown below the severity originally claimed for them; the original claim is retained on each finding rather than discarded.

Severity Distribution

Breakdown of detected vulnerabilities by severity level

Total

Critical

8(24%)

High

9(26%)

Medium

4(12%)

Low

8(24%)

Info

5(15%)

Remediation Effort Distribution

Total hours required to remediate vulnerabilities by severity

~245.5 Total Hours(34 vulnerabilities with effort estimates)

Critical

8 vulns~90.0h

High

9 vulns~61.0h

Medium

4 vulns~39.0h

Low

8 vulns~41.5h

Info

5 vulns~14.0h

OWASP Category Distribution

Vulnerabilities grouped by OWASP Top 10 category

A03:2021-InjectionCritical

A01:2021-Broken Access ControlCritical

A05:2021 - Security MisconfigurationLow

A04:2021 - Insecure DesignLow

A10:2021 Server-Side Request ForgeryMedium

+10 more categories

Discovered Vulnerabilities

Severity	Vulnerability	Status	Endpoint	Effort	Assigned
Critical	API8:2023 Security Misconfiguration / A03:2021 Injection (CWE-89)	Open	GET/order_tracking.php	Medium ~3 work days	Unassigned
Critical	A03:2021-Injection	Open	POST/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh	Medium ~2 work days	Unassigned
Critical	A03:2021-Injection	Open	POST/cgi-bin/.%%32e/.%%32e/.%%32e/.%%32e/bin/sh	Medium ~2 work days	Unassigned
Critical	API8:2023 Security Misconfiguration / A03:2021 Injection	Open	GET/templates/preview	Low ~6 hours	Unassigned
Critical	A03:2021-Injection	Open	POST/invoices/create	Low ~4 hours	Unassigned
Critical	A03:2021 Injection (CWE-89)	Open	GET/product_qa.php	Low ~6 hours	Unassigned
Critical	A01:2021-Broken Access Control	Open	GET/api.php	Medium ~3 work days	Unassigned
Critical	A03:2021-Injection	Open	GET/promo.php	Low ~6 hours	Unassigned
High	A03:2021 Injection (XXE)	Open	POST/rss_parser.php	Low ~4 hours	Unassigned
High	A01:2021-Broken Access Control	Open	GET/icons/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd	Medium ~2 work days	Unassigned

0 of 34 row(s) selected.

Rows per page

Page 1 of 4

Prioritization

Recommendations based on severity, effort, and exploitability

Priority	Vulnerability	Severity	Effort	Rationale
P1	API8:2023 Security Misconfiguration / A03:2021 Injection (CWE-89)	Critical	Medium ~3 work days	Critical severity vulnerability requires immediate attention regardless of remediation effort.
P1	A03:2021-Injection	Critical	Medium ~2 work days	Critical severity vulnerability requires immediate attention regardless of remediation effort.
P1	A03:2021-Injection	Critical	Medium ~2 work days	Critical severity vulnerability requires immediate attention regardless of remediation effort.
P1	API8:2023 Security Misconfiguration / A03:2021 Injection	Critical	Low ~6 hours	Critical severity vulnerability requires immediate attention regardless of remediation effort.
P1	A03:2021-Injection	Critical	Low ~4 hours	Critical severity vulnerability requires immediate attention regardless of remediation effort.
P1	A03:2021 Injection (CWE-89)	Critical	Low ~6 hours	Critical severity vulnerability requires immediate attention regardless of remediation effort.
P1	A01:2021-Broken Access Control	Critical	Medium ~3 work days	Critical severity vulnerability requires immediate attention regardless of remediation effort.
P1	A03:2021-Injection	Critical	Low ~6 hours	Critical severity vulnerability requires immediate attention regardless of remediation effort.
P2	A10:2021 Server-Side Request Forgery	Medium	Low ~6 hours	Medium severity with low remediation effort offers quick security win.
P2	A03:2021 Injection (XXE)	High	Low ~4 hours	High severity vulnerability should be addressed promptly to reduce security risk.
P2	A01:2021-Broken Access Control	High	Medium ~2 work days	High severity vulnerability should be addressed promptly to reduce security risk.
P2	A01:2021-Broken Access Control	High	Low ~6 hours	High severity vulnerability should be addressed promptly to reduce security risk.
P2	A01:2021-Broken Access Control	High	Low ~6 hours	High severity vulnerability should be addressed promptly to reduce security risk.
P2	A03:2021-Injection	High	Medium ~2 work days	High severity vulnerability should be addressed promptly to reduce security risk.
P2	API1:2023 Broken Object Level Authorization / A01:2021 Broken Access Control	High	Low ~5 hours	High severity vulnerability should be addressed promptly to reduce security risk.
P2	A01:2021 Broken Access Control	High	Low ~4 hours	High severity vulnerability should be addressed promptly to reduce security risk.
P2	A03:2021 Injection - XXE (CWE-611)	High	Trivial ~2 hours	High severity vulnerability should be addressed promptly to reduce security risk.
P2	API8:2023 Security Misconfiguration / A03:2021 Injection	High	Low ~6 hours	High severity vulnerability should be addressed promptly to reduce security risk.
P2	A03:2021-Injection	Medium	Low ~4 hours	Medium severity with low remediation effort offers quick security win.
P2	A03:2021 Injection	Medium	Low ~5 hours	Medium severity with low remediation effort offers quick security win.
P3	A10:2021 Server-Side Request Forgery	Medium	Medium ~3 work days	Medium severity vulnerability should be addressed in normal development cycle.
P4	A04:2021 - Insecure Design	Low	Low ~1 work day	Low severity vulnerability can be addressed when resources allow.
P4	A04:2021 - Insecure Design	Low	Trivial ~2 hours	Low severity vulnerability can be addressed when resources allow.
P4	A05:2021 - Security Misconfiguration	Info	Low ~4 hours	Address when time and resources permit.
P4	A05:2021 - Security Misconfiguration	Info	Low ~3 hours	Address when time and resources permit.
P4	A05:2021 - Security Misconfiguration	Low	Low ~6 hours	Low severity vulnerability can be addressed when resources allow.
P4	A05:2021 - Security Misconfiguration	Info	Trivial ~2 hours	Address when time and resources permit.
P4	A01:2021 Broken Access Control (Unvalidated Redirects)	Low	Low ~4 hours	Low severity vulnerability can be addressed when resources allow.
P4	A05:2021-Security Misconfiguration	Low	Low ~6 hours	Low severity vulnerability can be addressed when resources allow.
P4	A01:2021-Broken Access Control	Low	Low ~6 hours	Low severity vulnerability can be addressed when resources allow.
P4	A03:2021-Injection	Low	Low ~4 hours	Low severity vulnerability can be addressed when resources allow.
P4	A03:2021-Injection	Low	Low ~6 hours	Low severity vulnerability can be addressed when resources allow.
P4	A01:2021-Broken Access Control	Info	Low ~4 hours	Address when time and resources permit.
P4	A05:2021-Security Misconfiguration	Info	Trivial ~2 hours	Address when time and resources permit.

Prioritization Methodology:

P1 (Critical): Critical severity OR High severity with available exploit
P2 (High): High severity OR Medium severity with low remediation effort
P3 (Medium): Medium severity OR Low severity with quick fixes
P4 (Low): Low and Info severity issues

No test evidence data available for this scan.

Evidence is extracted automatically when agent executions complete.

Report Information

Report Type: technical
Scope: scan
Total Vulnerabilities: 34
Critical + High: 17

The complete 34-finding evaluation. Identifying data is redacted; no post-fix verification was recorded.

Get your own report