Web Application Vulnerabilities Index

This page lists 144 vulnerabilities categorized as medium severity that can be detected by Invicti.

Select Category
Critical
High
Medium
Low
Best Practice
Information
Select Vulnerability
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Select Vulnerability
Vulnerability Name
Classification
Severity
Blind Cross-site Scripting
Blind Cross-site Scripting
PCI v3.2-6.5.7
, 
CAPEC-19
, 
CWE-79
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
WASC-8
, 
OWASP 2013-A3
, 
OWASP 2017-A7
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
High
Blind MongoDB Injection
Blind MongoDB Injection
PCI v3.2-6.5.1
, 
CWE-943
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
High
Blind SQL Injection
Blind SQL Injection
PCI v3.2-6.5.1
, 
CAPEC-66
, 
CWE-89
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.14.2.5
, 
WASC-19
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
Critical
Bluebird Identified
Bluebird Identified
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
Bomgar Remote Support Software Detected
Bomgar Remote Support Software Detected
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
Boolean Based MongoDB Injection
Boolean Based MongoDB Injection
PCI v3.2-6.5.1
, 
CWE-943
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
, 
High
Boolean Based SQL Injection
Boolean Based SQL Injection
PCI v3.2-6.5.1
, 
CAPEC-66
, 
CWE-89
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.14.2.5
, 
WASC-19
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
, 
Critical
Bootbox Identified
Bootbox Identified
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
Bootstrap3DateTimePicker Identified
Bootstrap3DateTimePicker Identified
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
Bootstrapjs Identified
Bootstrapjs Identified
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
BootstrapSelect Identified
BootstrapSelect Identified
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
BootstrapTable Identified
BootstrapTable Identified
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
BootstrapToggle Identified
BootstrapToggle Identified
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
BootstrapTypeahead Identified
BootstrapTypeahead Identified
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
B.R.E.A.C.H. Attack Detected
B.R.E.A.C.H. Attack Detected
CWE-310
, 
OWASP 2013-A9
, 
OWASP 2017-A9
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
, 
Medium
Caddy Web Server Identified
Caddy Web Server Identified
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
CakePHP Framework Identified
CakePHP Framework Identified
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
CanvasJS Identified
CanvasJS Identified
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
CDN Detected (Airee)
CDN Detected (Airee)
CAPEC-224
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-45
, 
Information
CDN Detected (Akamai)
CDN Detected (Akamai)
CAPEC-224
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-45
, 
Information
CDN Detected (Arvan Cloud)
CDN Detected (Arvan Cloud)
CAPEC-224
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-45
, 
Information
CDN Detected (Azure CDN)
CDN Detected (Azure CDN)
CAPEC-224
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-45
, 
Information
CDN Detected (CDN77)
CDN Detected (CDN77)
CAPEC-224
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-45
, 
Information
CDN Detected (Fastly)
CDN Detected (Fastly)
CAPEC-224
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-45
, 
Information
CDN Detected (Fireblade)
CDN Detected (Fireblade)
CAPEC-224
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-45
, 
Information
CDN Detected (Google Cloud CDN)
CDN Detected (Google Cloud CDN)
CAPEC-224
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-45
, 
Information
CDN Detected (Incapsula)
CDN Detected (Incapsula)
CAPEC-224
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-45
, 
Information
CDN Detected (Instart)
CDN Detected (Instart)
CAPEC-224
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-45
, 
Information
CDN Detected (JsDelivr)
CDN Detected (JsDelivr)
CAPEC-224
, 
CWE-200
, 
WASC-45
, 
Information
CDN Detected (KeyCDN)
CDN Detected (KeyCDN)
CAPEC-224
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-45
, 
Information
CDN Detected (MaxCDN)
CDN Detected (MaxCDN)
CAPEC-224
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-45
, 
Information
CDN Detected (Netlify)
CDN Detected (Netlify)
CAPEC-224
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-45
, 
Information
CDN Detected (PowerCDN)
CDN Detected (PowerCDN)
CAPEC-224
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-45
, 
Information
CDN Detected (Qrator)
CDN Detected (Qrator)
CAPEC-224
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-45
, 
Information
CDN Detected (StackPath)
CDN Detected (StackPath)
CAPEC-224
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-45
, 
Information
CDN Detected (Sucuri)
CDN Detected (Sucuri)
CAPEC-224
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-45
, 
Information
CDN Detected (West263)
CDN Detected (West263)
CAPEC-224
, 
CWE-200
, 
ISO27001-A.18.1.3
, 
WASC-45
, 
Information
Cdnjs Identified
Cdnjs Identified
CWE-205
, 
ISO27001-A14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
Certificate is Signed Using a Weak Signature Algorithm
Certificate is Signed Using a Weak Signature Algorithm
PCI v3.2-6.5.4
, 
CAPEC-459
, 
ISO27001-A.10
, 
WASC-4
, 
OWASP 2013-A6
, 
OWASP 2017-A3
, 
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
, 
High
Chamilo Detected
Chamilo Detected
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
Chartjs Identified
Chartjs Identified
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
Cherokee Identified
Cherokee Identified
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:H/RL:O/RC:C
, 
Information
CherryPy Identified
CherryPy Identified
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:H/RL:O/RC:C
, 
Information
Citrix NetScaler ADC/Gateway XSS (CVE-2025-12101)
Citrix NetScaler ADC/Gateway XSS (CVE-2025-12101)
CWE-CWE-79
, 
Medium
Citrix NetScaler Memory Disclosure 'Citrix Bleed 2' (CVE-2025-5777)
Citrix NetScaler Memory Disclosure 'Citrix Bleed 2' (CVE-2025-5777)
CWE-CWE-457
, 
Critical
Ckeditor Identified
Ckeditor Identified
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
Claroline Detected
Claroline Detected
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
ClipBucket Detected
ClipBucket Detected
CWE-205
, 
ISO27001-A.14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
Cloudflare Bot Management
Cloudflare Bot Management
CWE-205
, 
ISO27001-A14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
Cloudflare Browser Insights
Cloudflare Browser Insights
CWE-205
, 
ISO27001-A14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
Cloudflare Identified
Cloudflare Identified
CWE-205
, 
ISO27001-A14.2.5
, 
WASC-13
, 
OWASP 2017-A6
, 
Information
Code Evaluation (Apache Struts)
Code Evaluation (Apache Struts)
PCI v3.2-6.5.1
, 
CAPEC-23
, 
CWE-94
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/RL:O
, 
Critical
Code Evaluation (Apache Struts S02-53)
Code Evaluation (Apache Struts S02-53)
PCI v3.2-6.5.1
, 
CAPEC-23
, 
CWE-94
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
, 
Critical
Code Evaluation (Apache Struts) S2-016
Code Evaluation (Apache Struts) S2-016
PCI v3.2-6.5.1
, 
CAPEC-23
, 
CWE-94
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/RL:O
, 
Critical
Code Evaluation (Apache Struts) S2-045
Code Evaluation (Apache Struts) S2-045
PCI v3.2-6.5.1
, 
CAPEC-23
, 
CWE-94
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/RL:O
, 
Critical
Code Evaluation (Apache Struts) S2-046
Code Evaluation (Apache Struts) S2-046
PCI v3.2-6.5.1
, 
CAPEC-23
, 
CWE-94
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/RL:O
, 
Critical
Code Evaluation (ASP)
Code Evaluation (ASP)
PCI v3.2-6.5.1
, 
CAPEC-23
, 
CWE-94
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
Critical
Code Evaluation (Node.js)
Code Evaluation (Node.js)
PCI v3.2-6.5.1
, 
CAPEC-23
, 
CWE-94
, 
HIPAA-164.306(a)
, 
164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
Critical
Code Evaluation (Perl)
Code Evaluation (Perl)
CAPEC-23
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
CWE-94
, 
HIPAA-164.306(a)
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
PCI v3.2-6.5.1
, 
Critical
Code Evaluation (PHP)
Code Evaluation (PHP)
CAPEC-23
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
CWE-94
, 
HIPAA-164.306(a)
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
PCI v3.2-6.5.1
, 
Critical
Code Evaluation (PHP) - IAST
Code Evaluation (PHP) - IAST
CAPEC-23
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
CWE-94
, 
HIPAA-164.306(a)
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
PCI v3.2-6.5.1
, 
Critical
Code Evaluation (Python)
Code Evaluation (Python)
CAPEC-23
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
CWE-94
, 
HIPAA-164.306(a)
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
PCI v3.2-6.5.1
, 
Critical
Code Evaluation (RoR)
Code Evaluation (RoR)
CAPEC-356
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
CWE-94
, 
HIPAA-164.306(a)
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
PCI v3.2-6.5.1
, 
WASC-23
, 
Critical
Code Evaluation (RoR - JSON)
Code Evaluation (RoR - JSON)
CAPEC-356
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
CWE-94
, 
HIPAA-164.306(a)
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
PCI v3.2-6.5.1
, 
WASC-23
, 
Critical
Code Evaluation (Ruby)
Code Evaluation (Ruby)
CAPEC-23
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
, 
CWE-94
, 
HIPAA-164.306(a)
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
PCI v3.2-6.5.1
, 
Critical
Code Evaluation via Local File Inclusion (PHP)
Code Evaluation via Local File Inclusion (PHP)
CAPEC-251
, 
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
, 
CWE-94
, 
HIPAA-164.306(a)
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
PCI v3.2-6.5.1
, 
WASC-33
, 
Critical
Code Execution via File Upload
Code Execution via File Upload
CAPEC-210
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
, 
CWE-94
, 
HIPAA-164.306(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
PCI v3.2-6.5.1
, 
WASC-42
, 
Critical
Code Execution via Local File Inclusion
Code Execution via Local File Inclusion
CAPEC-170
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
, 
CWE-94
, 
HIPAA-164.306(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
PCI v3.2-6.5.1
, 
WASC-33
, 
Critical
Code Execution via SSTI
Code Execution via SSTI
CAPEC-23
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
, 
CWE-94
, 
HIPAA-164.306(a)
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
PCI v3.2-6.5.1
, 
Critical
Code Execution via SSTI (ASP.NET Razor)
Code Execution via SSTI (ASP.NET Razor)
CAPEC-23
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
, 
CWE-94
, 
HIPAA-164.306(a)
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
PCI v3.2-6.5.1
, 
Critical
Code Execution via SSTI (Java FreeMarker)
Code Execution via SSTI (Java FreeMarker)
CAPEC-23
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
, 
CWE-94
, 
HIPAA-164.306(a)
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
PCI v3.2-6.5.1
, 
Critical
Code Execution via SSTI (Java Pebble)
Code Execution via SSTI (Java Pebble)
CAPEC-23
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
, 
CWE-94
, 
HIPAA-164.306(a)
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
PCI v3.2-6.5.1
, 
Critical
Code Execution via SSTI (Java Velocity)
Code Execution via SSTI (Java Velocity)
CAPEC-23
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
, 
CWE-94
, 
HIPAA-164.306(a)
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
PCI v3.2-6.5.1
, 
Critical
Code Execution via SSTI (JinJava)
Code Execution via SSTI (JinJava)
CAPEC-23
, 
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
, 
CWE-94
, 
HIPAA-164.306(a)
, 
HIPAA-164.308(a)
, 
ISO27001-A.14.2.5
, 
OWASP 2013-A1
, 
OWASP 2017-A1
, 
PCI v3.2-6.5.1
, 
Critical