Web Application Vulnerabilities Index

This page lists vulnerabilities categorized as Medium severity that can be detected by Invicti.

Select Category
Critical
High
Medium
Low
Best Practice
Information
Select Vulnerability
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Select Vulnerability
Vulnerability Name
Classification
Severity
Active Mixed Content over HTTPS
Active Mixed Content over HTTPS
CWE-319
, 
ISO27001-A.14.1.3
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
, 
Medium
Anonymous Ciphers Supported
Anonymous Ciphers Supported
PCI v3.2-6.5.4
, 
CAPEC-117
, 
CWE-311
, 
ISO27001-A.14.1.3
, 
WASC-4
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
, 
Medium
Apache Server-Info Detected
Apache Server-Info Detected
CAPEC-347
, 
CWE-16
, 
ISO27001-A.18.1.3
, 
WASC-14
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:H/RL:O/RC:C
, 
Medium
Apache Server-Status Detected
Apache Server-Status Detected
CAPEC-347
, 
CWE-16
, 
ISO27001-A.18.1.3
, 
WASC-14
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:H/RL:O/RC:C
, 
Medium
ASP.NET Cookieless Authentication Is Enabled
ASP.NET Cookieless Authentication Is Enabled
CWE-16
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
Medium
ASP.NET Cookieless Session State Is Enabled
ASP.NET Cookieless Session State Is Enabled
CWE-16
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
Medium
ASP.NET CustomErrors Is Disabled
ASP.NET CustomErrors Is Disabled
CWE-16
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
Medium
ASP.NET: Failure To Require SSL For Authentication Cookies
ASP.NET: Failure To Require SSL For Authentication Cookies
CWE-16
, 
OWASP 2017-A6
, 
Medium
ASP.NET Login Credentials Stored In Plain Text
ASP.NET Login Credentials Stored In Plain Text
CWE-312
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
Medium
ASP.NET ValidateRequest Is Globally Disabled
ASP.NET ValidateRequest Is Globally Disabled
CWE-16
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
Medium
Axis Development Mode Enabled in WEB-INF/server-config.wsdd
Axis Development Mode Enabled in WEB-INF/server-config.wsdd
CWE-16
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
, 
Medium
Axis system configuration listing enabled in WEB-INF/server-config.wsdd
Axis system configuration listing enabled in WEB-INF/server-config.wsdd
CWE-16
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
, 
Medium
Base Tag Hijacking
Base Tag Hijacking
PCI v3.2-6.5.7
, 
CAPEC-19
, 
CWE-20
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
WASC-8
, 
OWASP 2013-A3
, 
OWASP 2017-A7
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
, 
Medium
B.R.E.A.C.H. Attack Detected
B.R.E.A.C.H. Attack Detected
CWE-310
, 
OWASP 2013-A9
, 
OWASP 2017-A9
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
, 
Medium
Citrix NetScaler ADC/Gateway XSS (CVE-2025-12101)
Citrix NetScaler ADC/Gateway XSS (CVE-2025-12101)
CWE-CWE-79
, 
Medium
Critical Form Send to HTTP
Critical Form Send to HTTP
CAPEC-65
, 
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
, 
CWE-319
, 
ISO27001-A.14.1.3
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
PCI v3.2-6.5.4
, 
WASC-4
, 
Medium
Critical Form Served over HTTP
Critical Form Served over HTTP
CAPEC-65
, 
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
, 
CWE-319
, 
ISO27001-A.14.1.3
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
PCI v3.2-6.5.4
, 
WASC-4
, 
Medium
Custom Error Pages Are Not Configured in WEB-INF/web.xml
Custom Error Pages Are Not Configured in WEB-INF/web.xml
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
, 
CWE-16
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
Medium
CVS Detected
CVS Detected
CAPEC-118
, 
CWE-527
, 
ISO27001-A.9.4.5
, 
WASC-13
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
, 
Medium
Expired SSL Certificate
Expired SSL Certificate
CWE-295
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
, 
Medium
Express Development Mode Is Enabled
Express Development Mode Is Enabled
CWE-200
, 
ISO27001-A.9.4.1
, 
WASC-14
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
, 
Medium
Express express-session Weak Secret Key Detected
Express express-session Weak Secret Key Detected
CWE-200
, 
WASC-14
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
, 
Medium
Frame Injection
Frame Injection
PCI v3.2-6.5.1
, 
CWE-601
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
WASC-38
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
, 
Medium
GIT Detected
GIT Detected
CAPEC-118
, 
CWE-527
, 
ISO27001-A.9.4.5
, 
WASC-13
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
, 
Medium
GraphiQL Explorer/Playground Enabled
GraphiQL Explorer/Playground Enabled
CWE-CWE-200
, 
AV:N/AC:L/Au:N/C:P/I:N/A:N
, 
Medium
GraphQL Alias Overloading Allowed: Potential Denial of Service Vulnerability
GraphQL Alias Overloading Allowed: Potential Denial of Service Vulnerability
CWE-CWE-400
, 
AV:N/AC:L/Au:N/C:N/I:N/A:P
, 
Medium
GraphQL Array-based Query Batching Allowed: Potential Batching Attack Vulnerability
GraphQL Array-based Query Batching Allowed: Potential Batching Attack Vulnerability
CWE-CWE-770
, 
AV:N/AC:L/Au:N/C:P/I:P/A:P
, 
Medium
GraphQL Circular-Query via Introspection Allowed: Potential DoS Vulnerability
GraphQL Circular-Query via Introspection Allowed: Potential DoS Vulnerability
CWE-CWE-400
, 
AV:N/AC:L/Au:N/C:N/I:N/A:P
, 
Medium
GraphQL Field Suggestions Enabled
GraphQL Field Suggestions Enabled
CWE-CWE-200
, 
AV:N/AC:L/Au:N/C:P/I:N/A:N
, 
Medium
GraphQL Introspection Query Enabled
GraphQL Introspection Query Enabled
CWE-CWE-200
, 
AV:N/AC:L/Au:N/C:P/I:N/A:N
, 
Medium
GraphQL Non-JSON Mutations over GET: Potential CSRF Vulnerability
GraphQL Non-JSON Mutations over GET: Potential CSRF Vulnerability
CWE-CWE-352
, 
AV:N/AC:M/Au:N/C:P/I:P/A:N
, 
Medium
GraphQL Non-JSON Queries over GET: Potential CSRF Vulnerability
GraphQL Non-JSON Queries over GET: Potential CSRF Vulnerability
CWE-CWE-352
, 
AV:N/AC:M/Au:N/C:P/I:P/A:N
, 
Medium
GraphQL Non-JSON Queries over POST: Potential CSRF Vulnerability
GraphQL Non-JSON Queries over POST: Potential CSRF Vulnerability
CWE-CWE-352
, 
AV:N/AC:M/Au:N/C:P/I:P/A:N
, 
Medium
GraphQL Unauthenticated Mutation Detected
GraphQL Unauthenticated Mutation Detected
CWE-CWE-306
, 
AV:N/AC:L/Au:N/C:P/I:N/A:N
, 
Medium
GraphQL Unhandled Error Leakage
GraphQL Unhandled Error Leakage
CWE-CWE-209
, 
AV:N/AC:L/Au:N/C:P/I:N/A:N
, 
Medium
HTTP Header Injection
HTTP Header Injection
PCI v3.2-6.5.1
, 
CAPEC-105
, 
CWE-93
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.14.2.5
, 
WASC-24
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
, 
Medium
HTTP Header Injection (IAST)
HTTP Header Injection (IAST)
PCI v3.2-6.5.1
, 
CAPEC-105
, 
CWE-93
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.14.2.5
, 
WASC-24
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
, 
Medium
HTTP Parameter Pollution
HTTP Parameter Pollution
CWE-88
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
, 
Medium
HTTP Strict Transport Security (HSTS) Errors and Warnings
HTTP Strict Transport Security (HSTS) Errors and Warnings
CWE-16
, 
ISO27001-A.14.1.2
, 
WASC-15
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
Medium
HTTP Strict Transport Security (HSTS) Policy Not Enabled
HTTP Strict Transport Security (HSTS) Policy Not Enabled
CAPEC-217
, 
CWE-523
, 
ISO27001-A.14.1.2
, 
WASC-4
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
, 
Medium
Insecure HTTP Usage
Insecure HTTP Usage
ISO27001-A.14.1.3
, 
WASC-4
, 
OWASP 2013-A5
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
, 
Medium
Invalid SSL Certificate
Invalid SSL Certificate
PCI v3.2-6.5.4
, 
CAPEC-459
, 
CWE-295
, 
ISO27001-A.14.1.3
, 
WASC-4
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
, 
Medium
JavaMelody Interface Detected
JavaMelody Interface Detected
CAPEC-347
, 
CWE-16
, 
ISO27001-A.18.1.3
, 
WASC-14
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
Medium
Java Verb Tampering Via Misconfigured Security Constraint
Java Verb Tampering Via Misconfigured Security Constraint
CWE-16
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
, 
Medium
JetBrains .idea Project Directory Detected
JetBrains .idea Project Directory Detected
CAPEC-118
, 
CWE-285
, 
ISO27001-A9.4.5
, 
WASC-13
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
, 
Medium
Microsoft Access Database File Detected
Microsoft Access Database File Detected
PCI v3.2-6.5.8
, 
CWE-285
, 
ISO27001-A.18.1.3
, 
WASC-2
, 
OWASP 2013-A7
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
, 
Medium
Node.js Web Application does not handle uncaughtException
Node.js Web Application does not handle uncaughtException
CWE-248
, 
WASC-14
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
, 
Medium
Node.js Web Application does not handle unhandledRejection
Node.js Web Application does not handle unhandledRejection
CWE-248
, 
WASC-14
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
, 
Medium
Open Policy Crossdomain.xml Detected
Open Policy Crossdomain.xml Detected
CWE-16
, 
ISO27001-A.14.2.5
, 
WASC-15
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C
, 
Medium
Open Redirection
Open Redirection
CWE-601
, 
ISO27001-A.14.2.5
, 
WASC-38
, 
OWASP 2013-A10
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
, 
Medium
Open Redirection (DOM based)
Open Redirection (DOM based)
CWE-601
, 
ISO27001-A.14.2.5
, 
WASC-38
, 
OWASP 2013-A10
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
, 
Medium
Open Silverlight Client Access Policy
Open Silverlight Client Access Policy
CWE-16
, 
ISO27001-A.14.2.5
, 
WASC-15
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C
, 
Medium
Overly Long Session Timeout
Overly Long Session Timeout
CWE-16
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
, 
Medium
PAN-OS GlobalProtect XSS (CVE-2025-0133)
PAN-OS GlobalProtect XSS (CVE-2025-0133)
CWE-CWE-79
, 
Medium
Password Transmitted over Query String
Password Transmitted over Query String
PCI v3.2-6.5.4
, 
CWE-598
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
, 
Medium
PHP enable_dl Is Enabled
PHP enable_dl Is Enabled
CWE-16
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
, 
Medium
PHP magic_quotes_gpc Is Disabled
PHP magic_quotes_gpc Is Disabled
CWE-16
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
, 
Medium
PHP register_globals Is Enabled
PHP register_globals Is Enabled
CWE-473
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
, 
Medium
PHP session.use_only_cookies Is Disabled
PHP session.use_only_cookies Is Disabled
CWE-598
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
, 
Medium
PHP session.use_trans_sid Is Enabled
PHP session.use_trans_sid Is Enabled
CWE-598
, 
OWASP 2013-A5
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
, 
Medium
Revoked SSL Certificate
Revoked SSL Certificate
CWE-295
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
, 
Medium
RSA Private Key Detected
RSA Private Key Detected
CAPEC-118
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-13
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
, 
Medium
SAML Consumer Service KeyInfo RetrievalMethod SSRF
SAML Consumer Service KeyInfo RetrievalMethod SSRF
CWE-918
, 
ISO27001-A.14.2.5
, 
WASC-20
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
, 
Medium
SAML Consumer Service XSS Vulnerability
SAML Consumer Service XSS Vulnerability
PCI v3.2-6.5.7
, 
CAPEC-19
, 
CWE-79
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
WASC-8
, 
OWASP 2013-A3
, 
OWASP 2017-A7
, 
Medium
Sensitive Data Exposure
Sensitive Data Exposure
PCI v3.2-6.5.6
, 
CAPEC-37
, 
CWE-200
, 
ISO27001-A.8.2.1
, 
WASC-WASC-13
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
, 
Medium
Sensitive Data Exposure - Amazon AWS Access Key Id
Sensitive Data Exposure - Amazon AWS Access Key Id
PCI v3.2-6.5.6
, 
CAPEC-37
, 
CWE-200
, 
ISO27001-A.8.2.1
, 
WASC-WASC-13
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
, 
Medium
Sensitive Data Exposure - Amazon AWS Secret Key
Sensitive Data Exposure - Amazon AWS Secret Key
PCI v3.2-6.5.6
, 
CAPEC-37
, 
CWE-200
, 
ISO27001-A.8.2.1
, 
WASC-WASC-13
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
, 
Medium
Sensitive Data Exposure - Amazon MWS Auth Token
Sensitive Data Exposure - Amazon MWS Auth Token
PCI v3.2-6.5.6
, 
CAPEC-37
, 
CWE-200
, 
ISO27001-A.8.2.1
, 
WASC-WASC-13
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
, 
Medium
Sensitive Data Exposure - Amazon SES SMTP Password
Sensitive Data Exposure - Amazon SES SMTP Password
PCI v3.2-6.5.6
, 
CAPEC-37
, 
CWE-200
, 
ISO27001-A.8.2.1
, 
WASC-WASC-13
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
, 
Medium
Sensitive Data Exposure - Consul Token
Sensitive Data Exposure - Consul Token
PCI v3.2-6.5.6
, 
CAPEC-37
, 
CWE-200
, 
ISO27001-A.8.2.1
, 
WASC-WASC-13
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
, 
Medium
Sensitive Data Exposure - Database Connection String - MongoDB - MySQL
Sensitive Data Exposure - Database Connection String - MongoDB - MySQL
PCI v3.2-6.5.6
, 
CAPEC-37
, 
CWE-200
, 
ISO27001-A.8.2.1
, 
WASC-WASC-13
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
, 
Medium
Sensitive Data Exposure - Database Connection String - PostgreSQL
Sensitive Data Exposure - Database Connection String - PostgreSQL
PCI v3.2-6.5.6
, 
CAPEC-37
, 
CWE-200
, 
ISO27001-A.8.2.1
, 
WASC-WASC-13
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
, 
Medium
Sensitive Data Exposure - Devise Secret Key
Sensitive Data Exposure - Devise Secret Key
PCI v3.2-6.5.6
, 
CAPEC-37
, 
CWE-200
, 
ISO27001-A.8.2.1
, 
WASC-WASC-13
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
, 
Medium
Sensitive Data Exposure - Facebook Access Token
Sensitive Data Exposure - Facebook Access Token
PCI v3.2-6.5.6
, 
CAPEC-37
, 
CWE-200
, 
ISO27001-A.8.2.1
, 
WASC-WASC-13
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
, 
Medium