Static analysis coverage
325 security code checks, fully documented
These are the static-analysis (SAST) checks TurboPentest runs on your source code when you connect a GitHub repository for a white-box pentest. Every check is mapped to CWE, the OWASP Top 10, and OWASP ASVS, and ships with a vulnerable and a safe code example plus remediation guidance.
Rules are IntegSec-owned and MIT-licensed, run on the Opengrep engine. Each ships with true-positive and true-negative unit tests drawn from OWASP/SANS examples.
Showing 325 of 325 checks
- JavaScript / TypeScriptHighCWE-798
Hardcoded JWT Secret
Authentication & Secrets
A JWT signing secret is hardcoded as a string literal in jwt.sign/verify.
- JavaScript / TypeScriptHighCWE-798
Hardcoded Secret
Authentication & Secrets
A credential or secret appears to be hardcoded in source.
- JavaScript / TypeScriptMediumCWE-1004
Insecure Cookie Flags
Authentication & Secrets
A cookie is set without both httpOnly and secure flags, exposing it to theft via XSS or plaintext transport.
- JavaScript / TypeScriptHighCWE-347
JWT Algorithm None
Authentication & Secrets
JWT verification allows the 'none' algorithm, which accepts unsigned tokens and defeats authentication.
- JavaScript / TypeScriptMediumCWE-347
JWT Decode Without Verify
Authentication & Secrets
jwt.decode() does not verify the token signature; using its output for authorization decisions lets attackers forge claims.
- JavaScript / TypeScriptHighCWE-295
TLS Verification Disabled
Authentication & Secrets
TLS certificate verification is disabled, exposing traffic to man-in-the-middle attacks.
- JavaScript / TypeScriptHighCWE-338
Insecure Randomness For Secrets
Cryptography
Math.random() is not cryptographically secure and is being used to build a security-sensitive value (token/secret/OTP/etc.).
- JavaScript / TypeScriptHighCWE-327
Weak Cipher Algorithm
Cryptography
A broken cipher or insecure ECB mode is used for encryption.
- JavaScript / TypeScriptMediumCWE-328
Weak Hash Algorithm
Cryptography
MD5/SHA-1 are cryptographically broken and unsuitable for security (integrity, signatures, password storage).
- JavaScript / TypeScriptHighCWE-502
Node Serialize Unserialize
Insecure Deserialization
node-serialize unserialize() executes embedded function payloads and leads to remote code execution on attacker-controlled input.
- JavaScript / TypeScriptMediumCWE-502
YAML Unsafe Load
Insecure Deserialization
Legacy js-yaml load()/loadAll() without a SAFE_SCHEMA can instantiate arbitrary types from untrusted YAML.
- JavaScript / TypeScriptHighCWE-94
Code Injection Tainted Input
Injection
Untrusted request data flows into a dynamic code-evaluation sink (eval/Function/vm), enabling arbitrary code execution.
- JavaScript / TypeScriptMediumCWE-95
Eval Dynamic Argument
Injection
Dynamic use of eval() with a non-literal argument is dangerous and hard to audit.
- JavaScript / TypeScriptHighCWE-943
NoSQL Query From Request
Injection
A raw request object is passed directly as a MongoDB query, allowing operator injection (e.g. {"$gt":""}).
- JavaScript / TypeScriptMediumCWE-943
NoSQL Where Operator
Injection
MongoDB $where accepts server-side JavaScript and is evaluated with query privileges; a dynamic value here enables NoSQL/code injection.
- JavaScript / TypeScriptHighCWE-78
OS Command Injection Tainted Input
Injection
Untrusted request data flows into an OS command execution sink, enabling command injection.
- JavaScript / TypeScriptHighCWE-89
SQL Injection String Concatenation
Injection
SQL query is built by concatenating or interpolating request data into a string, enabling SQL injection.
- JavaScript / TypeScriptHighCWE-89
SQL Injection Tainted Input
Injection
Untrusted request data flows into a raw SQL query, enabling SQL injection.
- JavaScript / TypeScriptMediumCWE-942
CORS Acao Wildcard Header
Insecure Configuration
An Access-Control-Allow-Origin:* header is set manually, allowing any origin to read responses.
- JavaScript / TypeScriptMediumCWE-942
CORS Wildcard Origin
Insecure Configuration
CORS is configured to allow any origin, which lets any site issue cross-origin requests to this API.
- JavaScript / TypeScriptHighCWE-942
CORS Wildcard With Credentials
Insecure Configuration
CORS allows any origin together with credentials, exposing authenticated responses to any website.
- JavaScript / TypeScriptMediumCWE-352
CSRF Protection Disabled
Insecure Configuration
CSRF protection is explicitly disabled in configuration, exposing state-changing requests to cross-site request forgery.
- JavaScript / TypeScriptMediumCWE-348
Express Trust Proxy All
Insecure Configuration
Express 'trust proxy' is set to true, trusting X-Forwarded-For from every hop; a client can spoof its IP to bypass rate limiting or IP allowlists.
- JavaScript / TypeScriptLowCWE-200
Express X Powered By Enabled
Insecure Configuration
The Express x-powered-by header is left enabled (or explicitly enabled), disclosing the server framework and aiding fingerprinting.
- JavaScript / TypeScriptMediumCWE-200
Graphql Introspection Enabled
Insecure Configuration
GraphQL introspection or the playground is force-enabled, exposing the full schema and interactive query UI to anyone.
- JavaScript / TypeScriptMediumCWE-614
Insecure Session Cookie Config
Insecure Configuration
An express-session cookie is configured without the Secure flag or with SameSite=None, exposing the session cookie to interception or cross-site sending.
- JavaScript / TypeScriptMediumCWE-78
Child Process Shell True
Other Security Checks
spawn/execFile is invoked with shell:true, which reintroduces shell metacharacter interpretation and command-injection risk.
- JavaScript / TypeScriptMediumCWE-601
Open Redirect Tainted Input
Other Security Checks
Untrusted request data controls a redirect target, enabling an open redirect used for phishing.
- JavaScript / TypeScriptHighCWE-798
Basic Auth Credentials In URL
Hardcoded Secrets
HTTP Basic-Auth credentials are embedded directly in a URL (https://user:password@host).
- JavaScript / TypeScriptHighCWE-798
DB Connection String With Credentials
Hardcoded Secrets
A database connection string embeds inline credentials (protocol://user:password@host).
- JavaScript / TypeScriptHighCWE-798
Hardcoded Credential String
Hardcoded Secrets
A credential, API key, or signing secret is assigned to a string literal in source.
- JavaScript / TypeScriptHighCWE-321
Hardcoded Crypto Key Or IV
Hardcoded Secrets
A hard-coded key or IV is passed to a crypto cipher.
- JavaScript / TypeScriptMediumCWE-209
Error Stack In Response
Sensitive Data Exposure
An exception stack trace is returned to the client, leaking internal paths, dependency versions, and logic.
- JavaScript / TypeScriptMediumCWE-359
PII PHI In Logs
Sensitive Data Exposure
Personally identifiable or protected health information (PII/PHI) is written to a log sink.
- JavaScript / TypeScriptMediumCWE-532
Secret In Logs
Sensitive Data Exposure
A password, token, or secret is written to a log sink, where it can persist in plaintext and be exposed.
- JavaScript / TypeScriptMediumCWE-312
Sensitive Data Client Storage
Sensitive Data Exposure
A token, secret, or PII value is written to localStorage/sessionStorage or a client-readable cookie, where any script can read it (XSS token theft).
- JavaScript / TypeScriptMediumCWE-598
Sensitive Data In URL Query
Sensitive Data Exposure
A secret or PII value is placed in a URL query string, where it leaks via server logs, browser history, and Referer headers.
- JavaScript / TypeScriptMediumCWE-22
Path Join With Request
SSRF & Path Traversal
path.join()/path.resolve() combines a base directory with request-derived input; without validation this permits path traversal.
- JavaScript / TypeScriptHighCWE-22
Path Traversal Tainted Input
SSRF & Path Traversal
Untrusted request data flows into a filesystem path, enabling path traversal (../) and arbitrary file access.
- JavaScript / TypeScriptHighCWE-918
SSRF Outbound Request Tainted Input
SSRF & Path Traversal
Untrusted request data controls the URL of an outbound HTTP request, enabling SSRF.
- JavaScript / TypeScriptMediumCWE-79
DOM XSS Innerhtml Sink
Cross-Site Scripting (XSS)
Assigning a dynamic value to innerHTML/outerHTML (or document.write) can introduce DOM-based XSS.
- JavaScript / TypeScriptHighCWE-79
Reflected XSS Response Tainted Input
Cross-Site Scripting (XSS)
Untrusted request data is written to the HTTP response body without encoding, enabling reflected XSS.
- JavaScript / TypeScriptHighCWE-79
React Dangerously Set Inner HTML
Cross-Site Scripting (XSS)
dangerouslySetInnerHTML is populated from a dynamic value, which renders unescaped HTML and can lead to XSS.
- PythonHighCWE-798
Django Hardcoded Secret Key
Authentication & Secrets
Django SECRET_KEY is hardcoded as a string literal (CWE-798).
- PythonHighCWE-798
Hardcoded Secret
Authentication & Secrets
A credential appears to be hardcoded in source (CWE-798).
- PythonHighCWE-347
JWT Verify Disabled
Authentication & Secrets
JWT signature verification is disabled, so forged or tampered tokens are accepted (CWE-347).
- PythonHighCWE-295
TLS Verification Disabled
Authentication & Secrets
TLS certificate verification is disabled, exposing traffic to man-in-the-middle attacks (CWE-295).
- PythonMediumCWE-330
Insecure Random Token
Cryptography
The random module is not cryptographically secure and must not be used to generate tokens, passwords, salts, or session identifiers (CWE-330/CWE-338).
- PythonHighCWE-327
Weak Cipher DES ECB
Cryptography
Use of a weak cipher (DES/3DES/RC4/Blowfish) or ECB mode (CWE-327/CWE-326).
- PythonMediumCWE-327
Weak Hash MD5 SHA1
Cryptography
MD5/SHA-1 are cryptographically broken and unsuitable for security use such as password storage or integrity checks (CWE-327/CWE-328).
- PythonHighCWE-502
Jsonpickle Decode
Insecure Deserialization
jsonpickle.decode() can reconstruct arbitrary Python objects and execute code on untrusted input (CWE-502).
- PythonHighCWE-502
Pickle Load
Insecure Deserialization
Deserializing data with pickle can execute arbitrary code if the data is attacker-controlled (CWE-502).
- PythonHighCWE-502
YAML Unsafe Load
Insecure Deserialization
yaml.load() without SafeLoader can instantiate arbitrary Python objects and execute code (CWE-502).
- PythonHighCWE-94
Code Injection Eval Exec
Injection
Untrusted input flows into a dynamic code-execution primitive (eval/exec/compile), enabling arbitrary code execution (CWE-94).
- PythonHighCWE-89
Django Raw SQL Injection
Injection
Django raw()/extra() is called with a dynamically built SQL string, enabling SQL injection (CWE-89).
- PythonHighCWE-78
OS Command Injection
Injection
Untrusted input flows into an OS command executed via a shell.
- PythonHighCWE-78
Shell True Concatenation
Injection
A shell command is built by concatenating or formatting a string and run with shell=True (or via os.system/os.popen), enabling OS command injection (CWE-78/CWE-77).
- PythonHighCWE-89
SQL Injection Cursor Execute
Injection
SQL query is built with string formatting/concatenation, allowing SQL injection (CWE-89).
- PythonMediumCWE-942
CORS Allow All Origins
Insecure Configuration
CORS is configured to allow all origins ('*', CWE-942).
- PythonMediumCWE-16
Django Allowed Hosts Wildcard
Insecure Configuration
Django ALLOWED_HOSTS contains the wildcard '*' (CWE-16), disabling the Host header check and enabling Host-header poisoning and cache attacks.
- PythonMediumCWE-352
Django CSRF Exempt
Insecure Configuration
A view is decorated with @csrf_exempt (CWE-352), removing Django's CSRF protection and allowing forged cross-site state-changing requests.
- PythonHighCWE-489
Django Debug True
Insecure Configuration
Django DEBUG is set to True (CWE-489/CWE-1188).
- PythonHighCWE-489
Flask Run Debug True
Insecure Configuration
Flask is started with debug=True (CWE-489), exposing the Werkzeug interactive debugger, which permits remote code execution and leaks source/config.
- PythonLowCWE-16
Flask Send File Max Age Disabled
Insecure Configuration
SEND_FILE_MAX_AGE_DEFAULT is set to 0 (CWE-16), disabling caching headers on static responses; combined with missing security headers this weakens response hardening.
- PythonMediumCWE-352
Flask Wtf CSRF Disabled
Insecure Configuration
Flask-WTF CSRF protection is disabled (WTF_CSRF_ENABLED = False, CWE-352), leaving forms open to cross-site request forgery.
- PythonMediumCWE-693
Missing Security Headers Talisman Disabled
Insecure Configuration
Flask-Talisman is initialized with security headers disabled (force_https/CSP/frame_options turned off, CWE-693), removing protections against clickjacking, mixed content, and injection.
- PythonMediumCWE-319
Secure SSL Redirect False
Insecure Configuration
Django is configured without HTTPS enforcement (SECURE_SSL_REDIRECT=False or SECURE_HSTS_SECONDS=0, CWE-16/CWE-319), allowing plaintext HTTP traffic.
- PythonMediumCWE-614
Session Cookie Secure False
Insecure Configuration
A session/CSRF cookie is configured without the Secure (or HttpOnly) flag (CWE-614/CWE-1004).
- PythonMediumCWE-79
Django Mark Safe
Other Security Checks
User input is passed to mark_safe()/format_html unescaped, disabling Django auto-escaping and allowing XSS (CWE-79).
- PythonMediumCWE-489
Flask Debug Enabled
Other Security Checks
Running Flask with debug=True exposes the Werkzeug interactive debugger, which allows remote code execution and leaks source/config (CWE-489).
- PythonHighCWE-79
Flask Render Template String
Other Security Checks
User input flows into Flask render_template_string(), causing server-side template injection and reflected XSS (CWE-79).
- PythonMediumCWE-377
Insecure Tempfile Mktemp
Other Security Checks
tempfile.mktemp() is deprecated and insecure: the returned name can be claimed by an attacker before you open it, creating a race condition (CWE-377).
- PythonMediumCWE-79
Jinja2 Autoescape Off
Other Security Checks
Jinja2 Environment is created without autoescaping, so rendered variables are not HTML-escaped and are vulnerable to XSS (CWE-79).
- PythonHighCWE-798
Basic Auth Credentials In URL
Hardcoded Secrets
HTTP Basic-Auth credentials are embedded in a URL literal (CWE-798).
- PythonHighCWE-798
DB Connection String Credentials
Hardcoded Secrets
A database/service connection string embeds credentials in a URL literal (CWE-798).
- PythonHighCWE-798
Django Databases Password Literal
Hardcoded Secrets
A database PASSWORD is hardcoded in the Django DATABASES configuration (CWE-798).
- PythonHighCWE-798
Django Secret Key Literal
Hardcoded Secrets
Django SECRET_KEY is hardcoded as a string literal (CWE-798).
- PythonHighCWE-798
Hardcoded Credential Literal
Hardcoded Secrets
A credential or API key is hardcoded as a string literal (CWE-798).
- PythonHighCWE-321
Hardcoded Crypto Key IV
Hardcoded Secrets
A cryptographic key or IV is passed as a hardcoded literal to a cipher constructor (CWE-321).
- PythonHighCWE-798
Hardcoded JWT Signing Secret
Hardcoded Secrets
A JWT is signed or verified with a hardcoded secret literal (CWE-798).
- PythonMediumCWE-209
Flask Traceback In Response
Sensitive Data Exposure
A formatted traceback is built inside a request handler and risks being sent to the client (CWE-209).
- PythonMediumCWE-359
Hardcoded PII Literal
Sensitive Data Exposure
A real-looking SSN or payment-card number is hardcoded as a string literal (CWE-359), likely test data leaking into source.
- PythonMediumCWE-359
Logging PII PHI
Sensitive Data Exposure
PII/PHI (e.g. SSN, DOB, card number, patient/medical record) is written to logs (CWE-359).
- PythonHighCWE-532
Logging Secret
Sensitive Data Exposure
A secret or credential is written to logs (CWE-532).
- PythonMediumCWE-209
Return Exception Detail To Client
Sensitive Data Exposure
Exception/stack-trace detail is returned to the client (CWE-209).
- PythonMediumCWE-312
Sensitive Data Cleartext Cookie
Sensitive Data Exposure
Sensitive data (a secret or PII/PHI) is written to a cookie in cleartext (CWE-312).
- PythonMediumCWE-312
Sensitive Data Cleartext File
Sensitive Data Exposure
Sensitive data (a secret or PII/PHI) is written to a file in cleartext (CWE-312).
- PythonMediumCWE-598
Sensitive Data In URL Query
Sensitive Data Exposure
A secret or PII value is placed into a URL/query string (CWE-598).
- PythonHighCWE-22
Path Traversal
SSRF & Path Traversal
A user-controlled value is used to build a filesystem path, enabling path traversal (CWE-22).
- PythonHighCWE-918
SSRF HTTP Request
SSRF & Path Traversal
A user-controlled value is used as the URL of an outbound HTTP request, enabling server-side request forgery (CWE-918).
- PythonHighCWE-611
Lxml XXE Resolve Entities
XML External Entities (XXE)
lxml XMLParser configured with resolve_entities=True (or no_network=False) is vulnerable to XML External Entity attacks (CWE-611), enabling file disclosure and SSRF.
- PythonMediumCWE-611
XML Etree Parse Untrusted
XML External Entities (XXE)
Python's stdlib XML parsers do not defend against entity-expansion and external-entity attacks (CWE-611).
- JavaHighCWE-798
Hardcoded Credentials
Authentication & Secrets
A credential (password, API key, secret, or token) appears to be hardcoded as a string literal (CWE-798).
- JavaHighCWE-347
JWT Signature Not Verified
Authentication & Secrets
The JWT is parsed/decoded without verifying its signature (parseClaimsJwt / JWT.decode read an unsigned or unchecked token, CWE-347).
- JavaHighCWE-798
Hardcoded Crypto Key IV
Cryptography
Cryptographic key or IV is derived from a hardcoded literal (CWE-798/CWE-321).
- JavaMediumCWE-330
Insecure Random
Cryptography
java.util.Random / Math.random are statistically predictable and must not generate security-sensitive values such as tokens, session IDs, password reset codes, nonces, or salts (CWE-330/CWE-338).
- JavaHighCWE-327
Weak Cipher DES ECB
Cryptography
Use of a broken cipher (DES/3DES/RC2/RC4/Blowfish) or ECB mode (CWE-327/CWE-326).
- JavaMediumCWE-327
Weak Hash MD5 SHA1
Cryptography
MD5/MD2/SHA-1 are cryptographically broken and unsuitable for security use such as signatures or integrity checks (CWE-327/CWE-328).
- JavaHighCWE-502
Jackson Default Typing
Insecure Deserialization
Enabling Jackson polymorphic default typing lets the JSON payload choose which classes to instantiate, exposing gadget-chain deserialization (CWE-502).
- JavaHighCWE-502
Object Input Stream Readobject
Insecure Deserialization
Java native deserialization of untrusted data can lead to remote code execution via gadget chains (CWE-502).
- JavaHighCWE-502
Xmldecoder Readobject
Insecure Deserialization
java.beans.XMLDecoder executes the XML it parses as method calls and can instantiate arbitrary objects, giving remote code execution on untrusted input (CWE-502).
- JavaHighCWE-90
LDAP Injection
Injection
An LDAP search filter is built by concatenating a runtime value into the filter string (CWE-90).
- JavaHighCWE-78
OS Command Concatenation
Injection
An OS command string is built by concatenating a runtime value (CWE-78/CWE-77).
- JavaHighCWE-78
OS Command Injection Tainted Input
Injection
Untrusted request input flows into an OS command executed via Runtime.exec or ProcessBuilder.
- JavaHighCWE-89
SQL Injection Tainted Input
Injection
Untrusted request input flows into a JDBC statement executed as a raw SQL string.
- JavaHighCWE-89
SQL String Concatenation
Injection
SQL query is assembled by concatenating a runtime value into the query string (CWE-89).
- JavaHighCWE-79
XSS Servlet Reflected
Injection
Untrusted request input is written directly into an HTTP response body without output encoding, enabling reflected cross-site scripting (CWE-79).
- JavaMediumCWE-16
Actuator Expose All Endpoints
Insecure Configuration
Spring Boot Actuator is configured to expose all web endpoints (management.endpoints.web.exposure.include=*), publishing sensitive endpoints such as /env, /heapdump, /threaddump, and /mappings (CWE-16).
- JavaMediumCWE-614
Cookie Secure Httponly Disabled
Insecure Configuration
A cookie is created with the Secure or HttpOnly flag explicitly set to false (CWE-614/CWE-1004).
- JavaMediumCWE-209
Error Include Stacktrace Always
Insecure Configuration
Spring Boot is configured to always return stack traces / exception detail in error responses (server.error.include-stacktrace=always, CWE-209).
- JavaHighCWE-16
H2 Console Enabled
Insecure Configuration
The Spring Boot H2 web console is enabled (spring.h2.console.enabled=true, CWE-16).
- JavaHighCWE-942
Permissive CORS Wildcard
Insecure Configuration
CORS is configured to allow any origin with "*" (CWE-942).
- JavaHighCWE-284
Security Permitall Sensitive Matcher
Insecure Configuration
A sensitive path (actuator, admin, management, or console) is opened to everyone with permitAll (CWE-284).
- JavaMediumCWE-614
Session Cookie Flags Config
Insecure Configuration
A session cookie flag is disabled in configuration (server.servlet.session.cookie.secure/http-only=false, CWE-614/CWE-1004).
- JavaMediumCWE-489
Spring Boot DevTools Dependency
Insecure Configuration
A Spring Boot DevTools dependency is present (CWE-489).
- JavaHighCWE-352
Spring Security CSRF Disabled
Insecure Configuration
Spring Security CSRF protection is explicitly disabled (CWE-352).
- JavaHighCWE-295
HostnameVerifier Accepts All
Other Security Checks
This HostnameVerifier unconditionally returns true, so the certificate's hostname is never checked and a valid certificate for any host is accepted (CWE-295).
- JavaMediumCWE-601
Open Redirect Tainted Input
Other Security Checks
Untrusted request input controls a redirect target (CWE-601).
- JavaHighCWE-295
Trustmanager Accepts All
Other Security Checks
This X509TrustManager has an empty checkServerTrusted/checkClientTrusted method, so it accepts every certificate and disables TLS authentication (CWE-295).
- JavaHighCWE-798
Basic Auth Credentials In URL
Hardcoded Secrets
HTTP Basic-Auth credentials are embedded directly in a URL literal (scheme://user:pass@host, CWE-798).
- JavaHighCWE-798
JDBC Connection String With Password
Hardcoded Secrets
A JDBC connection string embeds a database password as a hardcoded literal (CWE-798).
- JavaHighCWE-321
JWT Hardcoded Signing Key
Hardcoded Secrets
A JWT signing/verification key is a hardcoded literal (CWE-321).
- JavaHighCWE-321
Secret Hardcoded Crypto Key
Hardcoded Secrets
A cryptographic key or IV is built from a hardcoded literal passed to SecretKeySpec/IvParameterSpec/PBEKeySpec (CWE-321).
- JavaHighCWE-798
Secret Hardcoded Setter
Hardcoded Secrets
A credential is passed as a hardcoded string literal to a setter (setPassword/setApiKey/setToken/etc.), embedding the secret in the source and compiled artifact (CWE-798).
- JavaMediumCWE-209
Exception Detail Exposure
Sensitive Data Exposure
Exception or stack-trace detail is exposed via printStackTrace or written back to the client (CWE-209).
- JavaMediumCWE-532
Log Sensitive Data
Sensitive Data Exposure
A secret or PII/PHI value (password, token, SSN, DOB, card number, MRN, patient/diagnosis data, etc.) is written to a log or console stream (CWE-532/CWE-359).
- JavaMediumCWE-598
PII Secret In URL
Sensitive Data Exposure
A URL or query string embeds a secret or PII/PHI parameter (ssn, dob, password, token, card number, MRN, etc.) in cleartext (CWE-598/CWE-359).
- JavaMediumCWE-315
Sensitive Data In Cookie
Sensitive Data Exposure
A secret or PII/PHI value is stored in a browser cookie in cleartext (CWE-312/CWE-315).
- JavaHighCWE-22
Path Traversal Tainted Input
SSRF & Path Traversal
Untrusted request input is used to build a filesystem path, enabling path traversal / arbitrary file access (CWE-22).
- JavaHighCWE-918
SSRF Tainted Input
SSRF & Path Traversal
Untrusted request input controls the destination of an outbound HTTP request, enabling Server-Side Request Forgery (CWE-918).
- JavaHighCWE-611
XXE Documentbuilderfactory
XML External Entities (XXE)
A DocumentBuilderFactory is created without disabling DOCTYPE/external entity processing, exposing XML External Entity injection (CWE-611).
- JavaHighCWE-611
XXE Saxparserfactory
XML External Entities (XXE)
A SAXParserFactory is created without disabling DOCTYPE/external entity processing, exposing XXE injection (CWE-611).
- JavaHighCWE-611
XXE Transformerfactory
XML External Entities (XXE)
A TransformerFactory is created without restricting external DTD/stylesheet access, exposing XXE and SSRF via XSLT (CWE-611).
- JavaHighCWE-611
XXE Xmlinputfactory
XML External Entities (XXE)
A StAX XMLInputFactory is created without disabling DTDs/external entities, exposing XXE injection (CWE-611).
- GoHighCWE-798
Hardcoded Credentials
Authentication & Secrets
A credential (password, API key, secret, or private key) appears to be hardcoded as a string literal (CWE-798).
- GoHighCWE-347
JWT Missing Signing Method Check
Authentication & Secrets
JWT keyfunc returns the verification key without asserting the token's signing method, enabling algorithm-confusion attacks (CWE-347).
- GoHighCWE-295
TLS Insecure Skip Verify
Authentication & Secrets
TLS certificate verification is disabled via InsecureSkipVerify: true (CWE-295).
- GoHighCWE-329
CBC Static IV
Cryptography
A CBC cipher is initialized with a hardcoded/static initialization vector (CWE-329/CWE-327).
- GoMediumCWE-330
Insecure Random Token
Cryptography
math/rand is a deterministic, non-cryptographic PRNG and must not be used to generate tokens, keys, salts, or other secret/unpredictable values (CWE-330/CWE-338).
- GoHighCWE-327
Weak Cipher DES RC4
Cryptography
DES, 3DES, and RC4 are obsolete and insecure ciphers (CWE-327/CWE-326).
- GoMediumCWE-327
Weak Hash MD5 SHA1
Cryptography
MD5 and SHA-1 are cryptographically broken (CWE-327/CWE-328) and must not be used for passwords, signatures, or integrity of security-relevant data.
- GoHighCWE-78
Command Injection Shell Concatenation
Injection
A shell command is built with string concatenation or fmt.Sprintf and passed to `sh -c` (CWE-78/CWE-77).
- GoHighCWE-78
OS Command Injection
Injection
Untrusted input flows into an OS command executed via os/exec, enabling OS command injection (CWE-78/CWE-77).
- GoHighCWE-89
SQL Injection String Build
Injection
SQL statement is assembled with fmt.Sprintf or string concatenation and passed to database/sql, enabling SQL injection (CWE-89).
- GoMediumCWE-693
Disabled Security Header
Insecure Configuration
A security response header is set to a value that disables its protection (CWE-693/CWE-1021).
- GoMediumCWE-489
Gin Debug Mode
Insecure Configuration
Gin is running in debug mode (or gin.Default(), which does not force release mode) (CWE-489/CWE-1188).
- GoMediumCWE-400
HTTP Server No Timeouts
Insecure Configuration
An http.Server is constructed without ReadTimeout / ReadHeaderTimeout (CWE-400/CWE-1188).
- GoMediumCWE-614
Insecure Cookie Flags
Insecure Configuration
A cookie is created without the Secure and/or HttpOnly flags (CWE-614/CWE-1004).
- GoMediumCWE-942
Permissive CORS Wildcard
Insecure Configuration
Cross-Origin Resource Sharing is configured with a wildcard origin ("*") (CWE-942).
- GoMediumCWE-489
pprof Handler Exposed
Insecure Configuration
The net/http/pprof profiling handlers are registered, exposing /debug/pprof/ (CWE-489).
- GoMediumCWE-732
Permissive File Permissions
Other Security Checks
A file or directory is created/changed with world-writable or world-readable permissions (0777/0666), letting any local user read or tamper with it (CWE-732/CWE-276).
- GoHighCWE-798
DB Connection String With Password
Hardcoded Secrets
A database DSN / connection string embeds credentials as a literal (user:password@host or password=...), hardcoding a secret in source (CWE-798/CWE-259).
- GoHighCWE-798
Hardcoded API Key Token
Hardcoded Secrets
An API key, access/refresh token, or signing secret appears to be hardcoded as a string literal (CWE-798/CWE-522).
- GoHighCWE-321
Hardcoded Crypto Key
Hardcoded Secrets
A symmetric cipher or HMAC is keyed with a hardcoded literal key (CWE-798/CWE-321).
- GoHighCWE-321
Hardcoded JWT Signing Key
Hardcoded Secrets
A JWT is signed or verified with a hardcoded HMAC key literal (CWE-798/CWE-321).
- GoMediumCWE-209
Error Detail To Client
Sensitive Data Exposure
A raw error / exception message is returned to the HTTP client (CWE-209/CWE-200).
- GoMediumCWE-532
Log Sensitive Data
Sensitive Data Exposure
A secret or PII/PHI value appears to be written to logs (CWE-532/CWE-359).
- GoMediumCWE-315
Sensitive Data In Cookie
Sensitive Data Exposure
A secret or PII/PHI value is stored in a cookie in cleartext (CWE-312/CWE-315).
- GoMediumCWE-598
Sensitive Data In URL
Sensitive Data Exposure
A secret or PII/PHI field is placed into URL query parameters (CWE-598/CWE-359).
- GoHighCWE-22
Path Traversal
SSRF & Path Traversal
A user-controlled value is used to build a filesystem path, enabling path traversal (CWE-22).
- GoHighCWE-22
Path Traversal File Path Join
SSRF & Path Traversal
A user-controlled value is passed to filepath.Join to build a path that is then opened or served (CWE-22). filepath.Join calls Clean but does NOT confine the result to a base directory, so a leading '..' or absolute segment still escapes it.
- GoHighCWE-918
SSRF HTTP Request
SSRF & Path Traversal
A user-controlled value is used as the URL of an outbound HTTP request, enabling server-side request forgery (CWE-918).
- GoMediumCWE-79
Text Template For HTML
Cross-Site Scripting (XSS)
text/template performs NO HTML escaping; using it to generate HTTP/HTML responses exposes the application to cross-site scripting (CWE-79).
- GoHighCWE-79
XSS Response Write
Cross-Site Scripting (XSS)
Untrusted input is written directly into an HTTP response, enabling reflected cross-site scripting (CWE-79) when the response is rendered as HTML. fmt.Fprintf/Fprint and ResponseWriter.Write perform no output encoding.
- GoMediumCWE-79
XSS Template HTML Bypass
Cross-Site Scripting (XSS)
Converting a dynamic value to template.HTML (or template.JS/template.CSS/ template.URL) marks it as trusted and bypasses html/template's contextual auto-escaping, enabling XSS (CWE-79) if the value contains attacker input.
- PHPHighCWE-295
Disabled TLS Verification
Authentication & Secrets
TLS certificate verification is disabled (CWE-295).
- PHPHighCWE-798
Hardcoded Credentials
Authentication & Secrets
A credential or secret appears to be hardcoded as a string literal (CWE-798).
- PHPHighCWE-798
Hardcoded DB Credentials
Authentication & Secrets
A database connection uses a hardcoded password string (CWE-798).
- PHPMediumCWE-330
Insecure Random Token
Cryptography
rand()/mt_rand()/uniqid()/lcg_value() are not cryptographically secure and must not be used to generate tokens, passwords, salts, or session identifiers (CWE-330/CWE-338).
- PHPHighCWE-327
Weak Cipher DES ECB
Cryptography
Use of a weak cipher (DES/3DES/RC4) or ECB mode (CWE-327/CWE-326).
- PHPMediumCWE-327
Weak Hash General
Cryptography
MD5/SHA-1 are cryptographically broken hash functions (CWE-327/CWE-328).
- PHPHighCWE-327
Weak Hash Password
Cryptography
MD5/SHA-1 are being used in a password/authentication context.
- PHPHighCWE-502
Insecure Deserialization
Insecure Deserialization
Untrusted request input is passed to unserialize(), enabling PHP object injection and potentially remote code execution via POP gadget chains (CWE-502).
- PHPMediumCWE-502
Unserialize Allowed Classes True
Insecure Deserialization
unserialize() is called with 'allowed_classes' => true, which permits instantiation of any class and reintroduces PHP object injection risk (CWE-502).
- PHPHighCWE-98
File Inclusion Interpolated
File Inclusion
A request parameter is interpolated or concatenated into an include/require path (CWE-98).
- PHPHighCWE-98
File Inclusion Lfi Rfi
File Inclusion
Untrusted request input flows into include/require, allowing local or remote file inclusion (CWE-98).
- PHPHighCWE-22
Path Traversal File Read
File Inclusion
Untrusted request input flows into a filesystem read/write function, allowing path traversal (CWE-22).
- PHPHighCWE-94
Code Injection Eval
Injection
Untrusted input flows into a dynamic code-evaluation primitive (eval/assert/create_function), enabling arbitrary PHP code execution (CWE-94).
- PHPHighCWE-78
Command Injection Backticks
Injection
A request parameter is interpolated directly into a shell command string (including PHP backtick execution), enabling OS command injection (CWE-78).
- PHPHighCWE-89
Laravel Raw SQL Injection
Injection
Laravel raw query builder method receives interpolated/concatenated request input, enabling SQL injection (CWE-89).
- PHPHighCWE-78
OS Command Injection
Injection
Untrusted request input flows into an OS command executed by the shell, enabling OS command injection (CWE-78/CWE-77).
- PHPHighCWE-94
Preg Replace Eval Modifier
Injection
preg_replace() is called with the deprecated /e (PREG_REPLACE_EVAL) modifier, which evaluates the replacement as PHP code and is a code injection vector (CWE-94).
- PHPHighCWE-89
SQL Injection Mysqli
Injection
Untrusted request input flows into a SQL query executed via mysqli/PDO, enabling SQL injection (CWE-89).
- PHPHighCWE-89
SQL Injection String Interpolation
Injection
A request parameter is interpolated or concatenated directly into a SQL query string (CWE-89).
- PHPHighCWE-829
Allow URL Include Fopen Enabled
Insecure Configuration
allow_url_include / allow_url_fopen is being enabled at runtime (CWE-829/CWE-98).
- PHPHighCWE-942
CORS Reflected Origin With Credentials
Insecure Configuration
The request Origin header is reflected directly into Access-Control-Allow-Origin (CWE-942).
- PHPHighCWE-942
CORS Wildcard Origin
Insecure Configuration
A wildcard CORS Access-Control-Allow-Origin header is sent (CWE-942).
- PHPHighCWE-489
Display Errors On
Insecure Configuration
display_errors is enabled at runtime (CWE-489/CWE-209).
- PHPMediumCWE-489
Error Reporting All
Insecure Configuration
error_reporting is set to report everything (CWE-489).
- PHPHighCWE-489
Laravel App Debug True
Insecure Configuration
Laravel debug mode is hardcoded on ('debug' => true) (CWE-489).
- PHPMediumCWE-352
Laravel CSRF Disabled
Insecure Configuration
The VerifyCsrfToken middleware excludes all routes ('*'), disabling CSRF protection application-wide (CWE-352).
- PHPMediumCWE-614
Session Cookie Insecure Params
Insecure Configuration
The session cookie is configured without Secure/HttpOnly (or with SameSite=None) (CWE-614/CWE-1004).
- PHPMediumCWE-614
Setcookie Not Secure Httponly
Insecure Configuration
A session/auth cookie is set without the Secure and/or HttpOnly flags (CWE-614/CWE-1004).
- PHPHighCWE-79
Reflected XSS Echo
Other Security Checks
A request parameter is echoed into the HTTP response without output encoding, causing reflected cross-site scripting (CWE-79).
- PHPHighCWE-79
XSS Echo Superglobal Inline
Other Security Checks
A request superglobal is echoed directly into the page (CWE-79), producing reflected XSS.
- PHPHighCWE-611
XXE Disable Entity Loader False
Other Security Checks
libxml_disable_entity_loader(false) re-enables external entity loading, exposing the parser to XML External Entity (XXE) attacks (CWE-611) that can read local files or trigger SSRF.
- PHPHighCWE-611
XXE Noent Parsing
Other Security Checks
XML is parsed with the LIBXML_NOENT flag, which substitutes external entities and enables XXE (CWE-611), allowing file disclosure and SSRF when the XML is attacker-controlled.
- PHPHighCWE-798
Basic Auth Credentials In URL
Hardcoded Secrets
HTTP Basic-Auth credentials are embedded in a URL literal (scheme://user:pass@host) (CWE-798/CWE-522).
- PHPHighCWE-798
DB Credentials Literal
Hardcoded Secrets
A database connection embeds a literal password (CWE-798).
- PHPHighCWE-798
Define Secret Literal
Hardcoded Secrets
A secret or credential is hardcoded via define() (e.g. a WordPress wp-config.php key/salt or DB password) as a string literal (CWE-798).
- PHPHighCWE-321
Hardcoded Crypto Key IV
Hardcoded Secrets
A hardcoded encryption key and/or IV is passed to openssl_encrypt/decrypt (CWE-321).
- PHPHighCWE-798
JWT Hardcoded Signing Secret
Hardcoded Secrets
A JWT signing/verification secret is hardcoded (CWE-798/CWE-321).
- PHPHighCWE-321
Laravel App Key Literal
Hardcoded Secrets
The Laravel application encryption key (APP_KEY) is hardcoded as a literal instead of read from the environment (CWE-798/CWE-321).
- PHPHighCWE-798
Pdo Dsn Literal Password
Hardcoded Secrets
A PDO DSN string contains an embedded literal password (CWE-798), for example "mysql:host=...;password=Secret1".
- PHPHighCWE-798
Secret Assigned String Literal
Hardcoded Secrets
An API key, token, or signing secret is hardcoded as a string literal (CWE-798).
- PHPHighCWE-209
Exception Detail To Client
Sensitive Data Exposure
An exception message or stack trace is sent to the client (CWE-209).
- PHPMediumCWE-540
Hardcoded PII Literal
Sensitive Data Exposure
A literal that matches a real-looking SSN or credit-card number is embedded in source (CWE-540).
- PHPMediumCWE-359
Log Or Echo PII PHI
Sensitive Data Exposure
A variable named for PII/PHI (SSN, DOB, card number, patient/medical record, diagnosis, etc.) is logged or echoed (CWE-359).
- PHPMediumCWE-532
Log Secret Variable
Sensitive Data Exposure
A secret or credential variable is written to a log/dump sink (CWE-532).
- PHPMediumCWE-598
PII In URL Query
Sensitive Data Exposure
Sensitive data (a secret or PII/PHI field) is placed into a URL query string (CWE-598).
- PHPHighCWE-312
Sensitive Data In Cookie Cleartext
Sensitive Data Exposure
A secret or PII/PHI value is written to a cookie in cleartext (CWE-312).
- PHPHighCWE-601
Open Redirect
Server-Side Request Forgery (SSRF)
A user-controlled value is placed in a Location redirect header, enabling an open redirect (CWE-601) usable for phishing and OAuth token theft.
- PHPHighCWE-918
SSRF Curl
Server-Side Request Forgery (SSRF)
A user-controlled URL flows into a cURL request, enabling server-side request forgery (CWE-918).
- PHPHighCWE-918
SSRF File Get Contents URL
Server-Side Request Forgery (SSRF)
A user-controlled URL flows into file_get_contents()/fopen(), which transparently fetch remote URLs and can be abused for SSRF (CWE-918) or to read internal resources via file://, php://, and http:// wrappers.
- RubyHighCWE-798
Hardcoded Credential Assignment
Authentication & Secrets
A credential/secret is assigned a hard-coded string literal (CWE-798).
- RubyHighCWE-798
Hardcoded Secret Key Base
Authentication & Secrets
The Rails secret_key_base is hard-coded in source.
- RubyHighCWE-321
JWT Hardcoded Secret
Authentication & Secrets
A hard-coded string is used as the JWT signing/verification secret (CWE-798/CWE-321).
- RubyHighCWE-347
JWT Verification Disabled
Authentication & Secrets
JWT signature verification is disabled (verify=false or alg "none"), allowing attackers to forge tokens (CWE-347).
- RubyMediumCWE-338
Insecure Random For Security
Cryptography
A security-sensitive value is generated with the non-cryptographic Kernel#rand/Random#rand PRNG, which is predictable (CWE-338).
- RubyHighCWE-295
TLS Verify None
Cryptography
TLS certificate verification is disabled (VERIFY_NONE / verify:false), exposing connections to man-in-the-middle attacks (CWE-295).
- RubyHighCWE-327
Weak Cipher DES ECB
Cryptography
A weak or ECB-mode cipher (DES/RC4/Blowfish or any *-ecb) is used.
- RubyMediumCWE-327
Weak Hash MD5 SHA1
Cryptography
A cryptographically weak hash (MD5 or SHA-1) is used.
- RubyHighCWE-502
Marshal Load Untrusted
Insecure Deserialization
Untrusted input is passed to Marshal.load/Marshal.restore.
- RubyHighCWE-502
Oj Unsafe Load
Insecure Deserialization
Oj is used in :object mode, which deserializes arbitrary Ruby object types and enables RCE on untrusted input (CWE-502).
- RubyHighCWE-502
YAML Unsafe Load
Insecure Deserialization
YAML is loaded with an unsafe loader (YAML.load / unsafe_load / Psych.load), which can instantiate arbitrary Ruby objects and lead to RCE (CWE-502).
- RubyHighCWE-89
Activerecord Sqli Interpolation
Injection
A raw string is interpolated/concatenated into an ActiveRecord query clause, enabling SQL injection (CWE-89).
- RubyHighCWE-89
Activerecord Sqli Tainted Input
Injection
Untrusted input flows into a raw ActiveRecord SQL API (find_by_sql, exec_query, connection.execute, order/where with a raw string), enabling SQL injection (CWE-89).
- RubyHighCWE-94
Code Injection Eval Tainted Input
Injection
Untrusted input flows into a dynamic code-evaluation or reflection sink (eval/instance_eval/class_eval/send/constantize), enabling code injection and arbitrary method dispatch (CWE-94/CWE-95).
- RubyHighCWE-78
OS Command Injection Interpolation
Injection
A shell command is built by interpolating/concatenating a string and run via system/exec/backticks/%x/Open3, enabling OS command injection (CWE-78).
- RubyHighCWE-78
OS Command Injection Tainted Input
Injection
Untrusted input flows into an OS command executed via a shell (system/exec/Open3/backticks), enabling OS command injection (CWE-78).
- RubyHighCWE-1188
Consider All Requests Local
Insecure Configuration
consider_all_requests_local = true makes Rails render full exception pages with backtraces to every client (CWE-1188/CWE-209).
- RubyHighCWE-942
CORS Credentials Any Origin
Insecure Configuration
A rack-cors resource sets credentials:true together with a wildcard origin, which browsers forbid and which leaks authenticated data if the reflected-origin variant is used (CWE-942).
- RubyHighCWE-942
CORS Wildcard With Credentials
Insecure Configuration
rack-cors allows any origin ('*') on a resource; combined with credentials this exposes authenticated responses cross-origin (CWE-942).
- RubyHighCWE-352
Default Forgery Protection Disabled
Insecure Configuration
default_protect_from_forgery is disabled application-wide, removing CSRF protection from controllers by default (CWE-352).
- RubyMediumCWE-319
Force SSL Disabled
Insecure Configuration
force_ssl is disabled, so the app serves traffic and cookies over cleartext HTTP (CWE-319).
- RubyMediumCWE-614
Session Cookie Insecure
Insecure Configuration
The session cookie is configured without Secure/HttpOnly (secure:false or httponly:false), exposing it to interception and theft via JavaScript (CWE-614/CWE-1004).
- RubyHighCWE-352
CSRF Protection Disabled
Other Security Checks
Rails CSRF protection is skipped/weakened (skip_before_action :verify_authenticity_token, skip_forgery_protection, or protect_from_forgery except:), exposing state-changing actions to CSRF (CWE-352).
- RubyMediumCWE-915
Mass Assignment Attr Accessible
Other Security Checks
Legacy attr_accessible/attr_protected mass-assignment controls are used; these are removed in modern Rails and are error-prone (CWE-915).
- RubyHighCWE-915
Mass Assignment Permit Bang
Other Security Checks
permit! whitelists every request parameter for mass assignment, letting attackers set unintended attributes such as admin/role (CWE-915).
- RubyMediumCWE-601
Open Redirect Tainted Input
Other Security Checks
A request-controlled value is passed to redirect_to, allowing an open redirect to an attacker-chosen site (CWE-601).
- RubyHighCWE-522
Basic Auth In URL
Hardcoded Secrets
HTTP Basic-Auth credentials are embedded in a URL (https://user:pass@host), exposing them in source, logs, and proxies (CWE-522).
- RubyHighCWE-798
DB Connection String Credentials
Hardcoded Secrets
A database/service connection URL embeds a hard-coded username and password (user:pass@host), leaking credentials in source (CWE-798).
- RubyHighCWE-321
Hardcoded Crypto Key
Hardcoded Secrets
A cryptographic key or IV is a hard-coded string literal (CWE-321).
- RubyHighCWE-798
Hardcoded Secret Literal
Hardcoded Secrets
A secret/credential identifier is assigned a hard-coded string literal (CWE-798).
- RubyMediumCWE-209
Exception Detail To Client
Sensitive Data Exposure
An exception message/backtrace is returned to the client (CWE-209).
- RubyMediumCWE-312
Hardcoded PII Literal
Sensitive Data Exposure
A hard-coded value matching an SSN or credit-card number is present in source (CWE-312).
- RubyMediumCWE-532
Log Secret
Sensitive Data Exposure
A secret/credential field is written to logs or stdout (CWE-532).
- RubyMediumCWE-359
PII PHI Exposure
Sensitive Data Exposure
PII/PHI (e.g. SSN, credit card, medical record, diagnosis) is logged or stored in a cookie (CWE-359).
- RubyHighCWE-22
Path Traversal Tainted Input
SSRF & Path Traversal
Untrusted input flows into a filesystem read/serve call (File.read/open, IO.read, send_file, send_data), enabling path traversal and arbitrary file disclosure (CWE-22).
- RubyHighCWE-918
SSRF Tainted Input
SSRF & Path Traversal
A request-controlled value is used as the URL/host of an outbound HTTP request (Net::HTTP, open-uri, HTTParty, Faraday, RestClient), enabling server-side request forgery (CWE-918).
- RubyMediumCWE-79
XSS HTML Safe Interpolation
Cross-Site Scripting (XSS)
An interpolated/concatenated string is emitted as raw HTML via raw()/html_safe, a common stored/reflected XSS sink (CWE-79).
- RubyHighCWE-79
XSS Raw Htmlsafe Tainted Input
Cross-Site Scripting (XSS)
Request-controlled data is marked HTML-safe via raw()/html_safe/ content_tag, bypassing Rails auto-escaping and enabling cross-site scripting (CWE-79).
- RubyMediumCWE-79
XSS Sanitize Bypass
Cross-Site Scripting (XSS)
The Rails sanitize helper is configured with a dangerous tag/attribute allow-list (e.g. script/onclick), defeating its XSS protection (CWE-79).
- C#HighCWE-798
Connection String With Password
Authentication & Secrets
A database connection string with an embedded password appears hard-coded in source (CWE-798).
- C#HighCWE-798
Hardcoded Credentials
Authentication & Secrets
A credential (password, API key, secret, or private key) is assigned to a string literal (CWE-798).
- C#HighCWE-321
Hardcoded JWT Signing Key
Authentication & Secrets
A JWT/HMAC signing key is built from a hard-coded literal secret (CWE-321).
- C#HighCWE-347
JWT Signature Not Validated
Authentication & Secrets
JWT validation is configured to skip signature verification (ValidateIssuerSigningKey / RequireSignedTokens = false, or a SignatureValidator that returns the token unchecked), so forged or 'alg:none' tokens are accepted (CWE-347).
- C#HighCWE-327
ECB Mode
Cryptography
A block cipher is used in ECB mode (or with a null IV), which encrypts identical plaintext blocks to identical ciphertext and leaks structure (CWE-327).
- C#HighCWE-321
Hardcoded Key IV
Cryptography
A cryptographic key or IV is assigned from a hard-coded literal (byte array, encoded string, or base64) (CWE-321).
- C#MediumCWE-338
Insecure Random
Cryptography
System.Random is a non-cryptographic PRNG; using it to generate security values (tokens, OTPs, nonces, salts, keys, session identifiers) yields predictable output (CWE-338).
- C#HighCWE-327
Weak Cipher
Cryptography
A weak/legacy block cipher (DES, Triple-DES, or RC2) is used.
- C#HighCWE-327
Weak Hash
Cryptography
A broken hash function (MD5 or SHA-1) is used.
- C#HighCWE-502
Binaryformatter
Insecure Deserialization
BinaryFormatter is used to deserialize data.
- C#HighCWE-502
Dangerous Formatters
Insecure Deserialization
A type-permissive .NET formatter (NetDataContractSerializer, SoapFormatter, LosFormatter, or ObjectStateFormatter) is used.
- C#HighCWE-502
Javascriptserializer Resolver
Insecure Deserialization
JavaScriptSerializer is constructed with a JavaScriptTypeResolver (e.g. SimpleTypeResolver), which resolves and instantiates CLR types named in the JSON payload and enables deserialization RCE on untrusted input (CWE-502).
- C#HighCWE-502
Jsonnet Typenamehandling
Insecure Deserialization
Json.NET is configured with TypeNameHandling other than None, so type names embedded in the JSON ($type) are used to construct arbitrary CLR types, enabling deserialization RCE on untrusted input (CWE-502).
- C#MediumCWE-502
Xmlserializer Dynamic Type
Insecure Deserialization
An XmlSerializer is built for a Type resolved at runtime via Type.GetType, so an attacker who influences the type name can drive instantiation of unexpected types during deserialization (CWE-502).
- C#HighCWE-90
LDAP Filter Concatenation
Injection
An LDAP search filter is built by concatenating/interpolating a runtime value into the filter string (CWE-90).
- C#HighCWE-78
OS Command Concatenation
Injection
An OS command or its arguments are built by concatenating/interpolating a runtime value (CWE-78/CWE-77).
- C#HighCWE-78
OS Command Injection Tainted Input
Injection
Untrusted request input flows into an OS process invocation via Process.Start / ProcessStartInfo, enabling OS command injection (CWE-78/CWE-77).
- C#HighCWE-89
SQL Injection Tainted Input
Injection
Untrusted request input flows into an ADO.NET command or an EF Core raw-SQL call executed as a dynamic query string, enabling SQL injection (CWE-89).
- C#HighCWE-89
SQL String Concatenation
Injection
A SQL query string is assembled with concatenation, string interpolation, or string.Format on a runtime value (CWE-89).
- C#HighCWE-352
Antiforgery Ignored
Insecure Configuration
A controller/action is annotated with [IgnoreAntiforgeryToken], disabling CSRF protection for state-changing requests (CWE-352).
- C#MediumCWE-489
Compilation Debug True
Insecure Configuration
ASP.NET is configured with <compilation debug="true">, which disables optimizations, leaks detailed diagnostics, and can expose source in error output (CWE-11/CWE-489).
- C#HighCWE-942
CORS Any Origin With Credentials
Insecure Configuration
A CORS policy combines AllowAnyOrigin() with AllowCredentials(), which the browser forbids and which, if forced, would expose credentialed responses to any site (CWE-942).
- C#MediumCWE-942
CORS Reflect Any Origin
Insecure Configuration
A CORS policy reflects any request origin via SetIsOriginAllowed(_ => true), effectively allowing all sites and defeating the same-origin protections CORS is meant to enforce (CWE-942).
- C#MediumCWE-209
Customerrors Off
Insecure Configuration
ASP.NET custom errors are disabled (<customErrors mode="Off">), so detailed framework error pages and stack traces are shown to clients (CWE-12/CWE-209).
- C#MediumCWE-532
Ef Sensitive Data Logging
Insecure Configuration
Entity Framework Core sensitive-data logging is enabled (EnableSensitiveDataLogging), which writes parameter values - including PII and secrets - into application logs (CWE-532).
- C#MediumCWE-614
Insecure Cookie Flags
Insecure Configuration
A cookie is configured without protective flags (Secure/HttpOnly off, or SameSite=None), exposing it to interception over HTTP, theft via XSS, and cross-site sending (CWE-614/CWE-1004/CWE-1275).
- C#HighCWE-319
Require HTTPS Metadata False
Insecure Configuration
JWT/OIDC middleware is configured with RequireHttpsMetadata = false, so token/metadata endpoints may be contacted over cleartext HTTP and are exposed to man-in-the-middle tampering of signing keys (CWE-319).
- C#HighCWE-295
Disabled Certificate Validation
Other Security Checks
TLS certificate validation is disabled by a callback that always returns true (or DangerousAcceptAnyServerCertificateValidator), so any certificate is accepted and the connection is exposed to man-in-the-middle interception (CWE-295).
- C#MediumCWE-915
Mass Assignment Updatemodel
Other Security Checks
TryUpdateModel/UpdateModel binds every posted form field onto the model without an explicit property allow-list, enabling mass assignment / over- posting of sensitive properties (e.g. IsAdmin, roles, prices) (CWE-915).
- C#HighCWE-601
Open Redirect Tainted Input
Other Security Checks
Untrusted request input flows into a redirect target, allowing an open redirect that sends users to an attacker-controlled site (CWE-601).
- C#HighCWE-798
Basic Auth Header Literal
Hardcoded Secrets
HTTP Basic-Auth credentials are constructed from hard-coded literals (CWE-798).
- C#HighCWE-798
Connection String Embedded Creds
Hardcoded Secrets
A URI with embedded 'user:password@host' credentials appears hard-coded (CWE-798).
- C#HighCWE-321
Hardcoded Key To Crypto Call
Hardcoded Secrets
A cryptographic key or salt passed to an HMAC/KDF/cipher call is a hard-coded literal (CWE-321).
- C#HighCWE-798
Hardcoded Secret Assignment
Hardcoded Secrets
A secret (password, API key, token, or private key) is assigned to a string literal in code (CWE-798).
- C#MediumCWE-209
Exception Detail To Client
Sensitive Data Exposure
Exception detail or a stack trace is returned to the client (CWE-209).
- C#MediumCWE-312
Hardcoded Credit Card Literal
Sensitive Data Exposure
A value that matches a real credit-card number (Visa/MC/Amex/Discover) is hard-coded in source (CWE-312).
- C#MediumCWE-312
Hardcoded SSN Literal
Sensitive Data Exposure
A value that looks like a real US Social Security Number is hard-coded in source (CWE-312/CWE-359).
- C#HighCWE-532
Log Secret Value
Sensitive Data Exposure
A secret or credential value is written to a log/console sink (CWE-532).
- C#HighCWE-359
PII PHI Exposure
Sensitive Data Exposure
Personal or protected health information (PII/PHI) is written to a log, console, or cookie (CWE-359).
- C#HighCWE-22
Request To File Access
SSRF & Path Traversal
Untrusted request input flows into a filesystem path, enabling path traversal (CWE-22) that can read or overwrite files outside the intended directory via '../' sequences.
- C#HighCWE-918
Request To Outbound Fetch
SSRF & Path Traversal
Untrusted request input flows into an outbound HTTP/URL fetch (HttpClient / WebRequest / WebClient), enabling Server-Side Request Forgery (CWE-918).
- C#MediumCWE-79
HTML Raw Nonliteral
Cross-Site Scripting (XSS)
Html.Raw emits its argument as unescaped HTML; when the value is not a compile-time literal it can carry attacker-controlled markup and produce stored/reflected XSS (CWE-79).
- C#HighCWE-79
Request To Response Tainted Input
Cross-Site Scripting (XSS)
Untrusted request input is written into the HTTP response (or marked as raw HTML) without output encoding, enabling reflected cross-site scripting (CWE-79).
- C#HighCWE-79
Response Write Concatenation
Cross-Site Scripting (XSS)
A response body is assembled by concatenating/interpolating a runtime value and written without HTML encoding (CWE-79).
- C#HighCWE-611
Dtdprocessing Parse
XML External Entities (XXE)
An XML reader is configured with DtdProcessing.Parse (or ProhibitDtd = false), which enables DTD/entity processing and exposes XML External Entity (XXE) injection and entity-expansion DoS (CWE-611).
- C#HighCWE-611
Xmlresolver Nonnull
XML External Entities (XXE)
An XmlDocument/XmlReaderSettings is given a live XmlUrlResolver, so external DTDs and entities are fetched and resolved, exposing XXE injection and SSRF (CWE-611).
- C#MediumCWE-611
Xmltextreader Unhardened
XML External Entities (XXE)
An XmlTextReader is created without hardening DTD handling.
- Multi-languageMediumCWE-359
Credit Card Number
PII / PHI Exposure
A value matching a Visa/Mastercard/Amex/Discover card number appears in source.
- Multi-languageLowCWE-359
IBAN
PII / PHI Exposure
A value matching an International Bank Account Number (IBAN) appears in source.
- Multi-languageLowCWE-359
ICD10 Code
PII / PHI Exposure
An ICD-10 diagnosis-code assignment appears in source.
- Multi-languageLowCWE-359
Medical Record Number
PII / PHI Exposure
A medical-record-number (MRN) assignment appears in source.
- Multi-languageLowCWE-359
Phone Number
PII / PHI Exposure
A value matching a US/E.164 phone number appears in source.
- Multi-languageLowCWE-359
US NPI
PII / PHI Exposure
A National Provider Identifier (NPI) assignment appears in source.
- Multi-languageLowCWE-359
US Passport
PII / PHI Exposure
A US passport-number assignment appears in source.
- Multi-languageMediumCWE-359
US SSN
PII / PHI Exposure
A value matching a US Social Security Number (NNN-NN-NNNN) appears in source.
- Multi-languageHighCWE-798
Anthropic Key
Hardcoded Secrets
An Anthropic API key (sk-ant-) appears to be hard-coded.
- Multi-languageHighCWE-798
AWS Access Key ID
Hardcoded Secrets
An AWS Access Key ID appears to be hard-coded.
- Multi-languageHighCWE-798
AWS Secret Access Key
Hardcoded Secrets
A value assigned to an AWS secret-key variable looks like a live 40-char secret access key.
- Multi-languageHighCWE-798
GCP API Key
Hardcoded Secrets
A Google/GCP API key appears to be hard-coded.
- Multi-languageHighCWE-798
GITHUB Token
Hardcoded Secrets
A GitHub personal access / OAuth / app token appears to be hard-coded.
- Multi-languageHighCWE-798
GITLAB PAT
Hardcoded Secrets
A GitLab personal access token (glpat-) appears to be hard-coded.
- Multi-languageHighCWE-798
Google OAuth Token
Hardcoded Secrets
A Google OAuth 2.0 access token (ya29.) appears to be hard-coded.
- Multi-languageMediumCWE-798
Hardcoded JWT
Hardcoded Secrets
A hard-coded JSON Web Token (eyJ...) appears in source.
- Multi-languageHighCWE-798
Mailgun Key
Hardcoded Secrets
A Mailgun API key (key-) appears to be hard-coded.
- Multi-languageHighCWE-798
NPM Token
Hardcoded Secrets
An npm access token (npm_) appears to be hard-coded.
- Multi-languageHighCWE-798
Openai Key
Hardcoded Secrets
An OpenAI API key (sk-) appears to be hard-coded.
- Multi-languageHighCWE-798
Private Key Block
Hardcoded Secrets
A PEM private-key block appears to be committed to source.
- Multi-languageHighCWE-798
Sendgrid Key
Hardcoded Secrets
A SendGrid API key (SG.) appears to be hard-coded.
- Multi-languageMediumCWE-798
Slack Discord Webhook
Hardcoded Secrets
A Slack or Discord incoming-webhook URL appears to be hard-coded.
- Multi-languageHighCWE-798
Slack Token
Hardcoded Secrets
A Slack API token (xox...) appears to be hard-coded.
- Multi-languageHighCWE-798
Stripe Secret Key
Hardcoded Secrets
A live Stripe secret or restricted key appears to be hard-coded.
- Multi-languageHighCWE-798
Twilio Key
Hardcoded Secrets
A Twilio API key SID (SK...) or Account SID (AC...) appears to be hard-coded.
Run these checks on your code
Connect a GitHub repository and TurboPentest runs every one of these checks automatically as part of a white-box pentest - validated by AI and reported with proof, from $99 per target.