exploit-summary-table

#VulnerabilitySeverityCVSS (Est.)ImpactExploit TypeNotes
1Web Shell via PHP Object InjectionCritical9.8Full Remote Code ExecutionInsecure DeserializationArbitrary file write & shell upload using serialized object
2SQL Injection (UNION-based)Critical9.0Full database dump (users, PII, credentials)SQLiAdvanced exploitation with data exfiltration via crafted payloads
3Exposed OTP in Password Reset FlowCritical9.0Complete account takeover without user interactionLogic FlawOTP shown directly to client in API response
4OTP Brute-Force in Fund TransferCritical9.0Unauthorized fund transferBrute ForceNo attempt limit, brute-force possible within seconds
5Login Password Brute-ForceHigh7.5Easy credential stuffing or account compromiseBrute ForceNo rate limiting, no lockout
6JWT Weak Signature (Key Cracking)High8.0JWT forgery → account impersonationAuth BypassSigned with guessable weak key (rockyou-crackable)
7IDOR – Account Detail AccessHigh8.0Access to all users’ PII and financial infoIDORWorks at scale with enumeration scripts
8XXE (Read /etc/passwd)High7.5Arbitrary file read on serverXML External EntityExploits contact form XML parser
9XSS via Profile Location FieldHigh7.4Token theft via DOM injectionStored XSSToken exfiltration shown using fetch(localStorage.userData)
10Password Change without Verifying Old PasswordHigh7.5Account lockout or takeoverLogic FlawFrontend asks for old pass, backend doesn’t check it
11PII Stored in JWT TokensHigh7.0Privacy violation & passive token leakDesign FlawFull PII inside base64-encoded JWT stored client-side
12User Enumeration via Forgot PasswordMedium-High6.5Automated discovery of valid user IDsEnumerationUnique response reveals valid/invalid user existence
13Exposed Debug/Dev Endpoints (phpinfo)Medium6.5Information Disclosure → Stack, paths, configsMisconfigurationphpinfo and Dockerfile publicly accessible