[
  {
    "title": "SQL injection in login bypasses authentication",
    "category": "sqli",
    "severity": "critical",
    "owasp": "A03:2021",
    "cwe": "CWE-89",
    "cvss": 9.8,
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "tool": "sqlmap/nuclei",
      "method": "POST /rest/user/login with quote payload",
      "expected_signal": "200 + JWT for ' OR 1=1--"
    },
    "verification": "Login returns a valid token without a real password",
    "remediation": "Parameterise the query.",
    "tags": [
      "web",
      "auth"
    ],
    "status": "confirmed",
    "target": "https://juice.revieworg.site/",
    "target_name": "Juice Shop",
    "asset_type": "web_app",
    "id": "juice-shop-sql-injection-in-login-bypasses-authentication"
  },
  {
    "title": "SQL injection in product search",
    "category": "sqli",
    "severity": "high",
    "owasp": "A03:2021",
    "cwe": "CWE-89",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "tool": "sqlmap",
      "method": "GET /rest/products/search?q=",
      "expected_signal": "DB error / UNION data"
    },
    "verification": "Union select returns product rows not matching the query",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://juice.revieworg.site/",
    "target_name": "Juice Shop",
    "asset_type": "web_app",
    "id": "juice-shop-sql-injection-in-product-search"
  },
  {
    "title": "Stored cross-site scripting in product review",
    "category": "xss",
    "severity": "high",
    "owasp": "A03:2021",
    "cwe": "CWE-79",
    "difficulty": "medium",
    "arm": "any",
    "detection": {
      "tool": "browser/zap",
      "method": "PUT /api/Products/*/reviews",
      "expected_signal": "Payload persisted and executed"
    },
    "verification": "Review renders <script> unescaped",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://juice.revieworg.site/",
    "target_name": "Juice Shop",
    "asset_type": "web_app",
    "id": "juice-shop-stored-cross-site-scripting-in-product-review"
  },
  {
    "title": "Insecure direct object reference on shopping basket",
    "category": "idor",
    "severity": "high",
    "owasp": "A01:2021",
    "cwe": "CWE-639",
    "difficulty": "medium",
    "arm": "any",
    "detection": {
      "tool": "manual",
      "method": "GET /rest/basket/{id} across users",
      "expected_signal": "Other user's basket"
    },
    "verification": "Cross-user basket id returns items",
    "tags": [
      "web",
      "api"
    ],
    "status": "confirmed",
    "target": "https://juice.revieworg.site/",
    "target_name": "Juice Shop",
    "asset_type": "web_app",
    "id": "juice-shop-insecure-direct-object-reference-on-shopping-basket"
  },
  {
    "title": "Broken authentication via weak password reset",
    "category": "auth",
    "severity": "high",
    "owasp": "A07:2021",
    "cwe": "CWE-640",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "Security-question reset flow",
      "expected_signal": "Reset without identity proof"
    },
    "verification": "Password changed using guessable security answer",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://juice.revieworg.site/",
    "target_name": "Juice Shop",
    "asset_type": "web_app",
    "id": "juice-shop-broken-authentication-via-weak-password-reset"
  },
  {
    "title": "Admin registration without authorisation",
    "category": "auth",
    "severity": "critical",
    "owasp": "A01:2021",
    "cwe": "CWE-269",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "POST /api/Users role=admin",
      "expected_signal": "Admin account created"
    },
    "verification": "Created user has admin role",
    "tags": [
      "api"
    ],
    "status": "confirmed",
    "target": "https://juice.revieworg.site/",
    "target_name": "Juice Shop",
    "asset_type": "web_app",
    "id": "juice-shop-admin-registration-without-authorisation"
  },
  {
    "title": "JWT signed with weak secret",
    "category": "auth",
    "severity": "high",
    "owasp": "A02:2021",
    "cwe": "CWE-798",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "Crack HS256 token secret",
      "expected_signal": "Forged token accepted"
    },
    "verification": "Mint token with cracked secret and call protected route",
    "tags": [
      "web",
      "jwt"
    ],
    "status": "confirmed",
    "target": "https://juice.revieworg.site/",
    "target_name": "Juice Shop",
    "asset_type": "web_app",
    "id": "juice-shop-jwt-signed-with-weak-secret"
  },
  {
    "title": "JWT algorithm confusion / none accepted",
    "category": "auth",
    "severity": "high",
    "owasp": "A02:2021",
    "cwe": "CWE-327",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "alg=none token",
      "expected_signal": "Token accepted without signature"
    },
    "verification": "Reproduce and capture evidence for 'JWT algorithm confusion / none accepted' on https://juice.revieworg.site/.",
    "tags": [
      "web",
      "jwt"
    ],
    "status": "confirmed",
    "target": "https://juice.revieworg.site/",
    "target_name": "Juice Shop",
    "asset_type": "web_app",
    "id": "juice-shop-jwt-algorithm-confusion-none-accepted"
  },
  {
    "title": "Server-side request forgery via profile image URL",
    "category": "ssrf",
    "severity": "high",
    "owasp": "A10:2021",
    "cwe": "CWE-918",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "POST /profile imageUrl=internal",
      "expected_signal": "Fetched internal resource"
    },
    "verification": "Internal-only URL returns content",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://juice.revieworg.site/",
    "target_name": "Juice Shop",
    "asset_type": "web_app",
    "id": "juice-shop-server-side-request-forgery-via-profile-image-url"
  },
  {
    "title": "Open redirect via redirect parameter",
    "category": "open_redirect",
    "severity": "medium",
    "owasp": "A01:2021",
    "cwe": "CWE-601",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "GET /redirect?to=",
      "expected_signal": "302 to attacker host"
    },
    "verification": "Reproduce and capture evidence for 'Open redirect via redirect parameter' on https://juice.revieworg.site/.",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://juice.revieworg.site/",
    "target_name": "Juice Shop",
    "asset_type": "web_app",
    "id": "juice-shop-open-redirect-via-redirect-parameter"
  },
  {
    "title": "Race condition on coupon redemption",
    "category": "race_condition",
    "severity": "high",
    "owasp": "A04:2021",
    "cwe": "CWE-362",
    "difficulty": "hard",
    "arm": "agi",
    "detection": {
      "method": "Parallel coupon redeems",
      "expected_signal": "Balance exceeds coupon value"
    },
    "verification": "Reproduce and capture evidence for 'Race condition on coupon redemption' on https://juice.revieworg.site/.",
    "tags": [
      "web",
      "business_logic"
    ],
    "status": "confirmed",
    "target": "https://juice.revieworg.site/",
    "target_name": "Juice Shop",
    "asset_type": "web_app",
    "id": "juice-shop-race-condition-on-coupon-redemption"
  },
  {
    "title": "Prometheus metrics endpoint exposed",
    "category": "public_sensitive_exposure",
    "severity": "medium",
    "owasp": "A05:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "GET /metrics",
      "expected_signal": "metrics text"
    },
    "verification": "Reproduce and capture evidence for 'Prometheus metrics endpoint exposed' on https://juice.revieworg.site/.",
    "tags": [
      "web",
      "exposure"
    ],
    "status": "confirmed",
    "target": "https://juice.revieworg.site/",
    "target_name": "Juice Shop",
    "asset_type": "web_app",
    "id": "juice-shop-prometheus-metrics-endpoint-exposed"
  },
  {
    "title": "SQL injection in login",
    "category": "sqli",
    "severity": "high",
    "owasp": "A03:2021",
    "cwe": "CWE-89",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "tool": "sqlmap",
      "method": "POST /login.php",
      "expected_signal": "Auth bypass / DB error"
    },
    "verification": "Reproduce and capture evidence for 'SQL injection in login' on https://dvwa.revieworg.site/.",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://dvwa.revieworg.site/",
    "target_name": "DVWA",
    "asset_type": "web_app",
    "id": "dvwa-sql-injection-in-login"
  },
  {
    "title": "Reflected cross-site scripting",
    "category": "xss",
    "severity": "medium",
    "owasp": "A03:2021",
    "cwe": "CWE-79",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "GET /vulnerabilities/xss_r/",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Reflected cross-site scripting' on https://dvwa.revieworg.site/.",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://dvwa.revieworg.site/",
    "target_name": "DVWA",
    "asset_type": "web_app",
    "id": "dvwa-reflected-cross-site-scripting"
  },
  {
    "title": "Stored cross-site scripting in guestbook",
    "category": "xss",
    "severity": "high",
    "owasp": "A03:2021",
    "cwe": "CWE-79",
    "difficulty": "medium",
    "arm": "any",
    "detection": {
      "method": "POST /vulnerabilities/xss_s/",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Stored cross-site scripting in guestbook' on https://dvwa.revieworg.site/.",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://dvwa.revieworg.site/",
    "target_name": "DVWA",
    "asset_type": "web_app",
    "id": "dvwa-stored-cross-site-scripting-in-guestbook"
  },
  {
    "title": "DOM-based cross-site scripting",
    "category": "xss",
    "severity": "medium",
    "owasp": "A03:2021",
    "cwe": "CWE-79",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "Client-side sink in default param",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'DOM-based cross-site scripting' on https://dvwa.revieworg.site/.",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://dvwa.revieworg.site/",
    "target_name": "DVWA",
    "asset_type": "web_app",
    "id": "dvwa-dom-based-cross-site-scripting"
  },
  {
    "title": "Command injection in ping utility",
    "category": "injection",
    "severity": "critical",
    "owasp": "A03:2021",
    "cwe": "CWE-78",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "POST /vulnerabilities/exec/ ip=127.0.0.1;id",
      "expected_signal": "Command output"
    },
    "verification": "Reproduce and capture evidence for 'Command injection in ping utility' on https://dvwa.revieworg.site/.",
    "tags": [
      "web",
      "rce"
    ],
    "status": "confirmed",
    "target": "https://dvwa.revieworg.site/",
    "target_name": "DVWA",
    "asset_type": "web_app",
    "id": "dvwa-command-injection-in-ping-utility"
  },
  {
    "title": "Local file inclusion",
    "category": "file_inclusion",
    "severity": "high",
    "owasp": "A03:2021",
    "cwe": "CWE-98",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "GET /vulnerabilities/fi/?page=",
      "expected_signal": "/etc/passwd"
    },
    "verification": "Reproduce and capture evidence for 'Local file inclusion' on https://dvwa.revieworg.site/.",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://dvwa.revieworg.site/",
    "target_name": "DVWA",
    "asset_type": "web_app",
    "id": "dvwa-local-file-inclusion"
  },
  {
    "title": "Unrestricted file upload",
    "category": "file_upload",
    "severity": "critical",
    "owasp": "A04:2021",
    "cwe": "CWE-434",
    "difficulty": "medium",
    "arm": "any",
    "detection": {
      "method": "POST /vulnerabilities/upload/",
      "expected_signal": "PHP webshell reachable"
    },
    "verification": "Reproduce and capture evidence for 'Unrestricted file upload' on https://dvwa.revieworg.site/.",
    "tags": [
      "web",
      "rce"
    ],
    "status": "confirmed",
    "target": "https://dvwa.revieworg.site/",
    "target_name": "DVWA",
    "asset_type": "web_app",
    "id": "dvwa-unrestricted-file-upload"
  },
  {
    "title": "Cross-site request forgery on password change",
    "category": "csrf",
    "severity": "medium",
    "owasp": "A01:2021",
    "cwe": "CWE-352",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "No anti-CSRF token on password form",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Cross-site request forgery on password change' on https://dvwa.revieworg.site/.",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://dvwa.revieworg.site/",
    "target_name": "DVWA",
    "asset_type": "web_app",
    "id": "dvwa-cross-site-request-forgery-on-password-change"
  },
  {
    "title": "Weak session identifiers",
    "category": "auth",
    "severity": "high",
    "owasp": "A07:2021",
    "cwe": "CWE-330",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "Predictable dvwaSession cookie",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Weak session identifiers' on https://dvwa.revieworg.site/.",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://dvwa.revieworg.site/",
    "target_name": "DVWA",
    "asset_type": "web_app",
    "id": "dvwa-weak-session-identifiers"
  },
  {
    "title": "Login brute force without rate limiting",
    "category": "auth",
    "severity": "high",
    "owasp": "A07:2021",
    "cwe": "CWE-307",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "Repeated failed logins",
      "expected_signal": "No lockout"
    },
    "verification": "Reproduce and capture evidence for 'Login brute force without rate limiting' on https://dvwa.revieworg.site/.",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://dvwa.revieworg.site/",
    "target_name": "DVWA",
    "asset_type": "web_app",
    "id": "dvwa-login-brute-force-without-rate-limiting"
  },
  {
    "title": "DVWA config file discloses database password",
    "category": "public_sensitive_exposure",
    "severity": "high",
    "owasp": "A05:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "GET /config/config.inc.php",
      "expected_signal": "DB credentials in body"
    },
    "verification": "Reproduce and capture evidence for 'DVWA config file discloses database password' on https://dvwa.revieworg.site/.",
    "tags": [
      "web",
      "exposure"
    ],
    "status": "confirmed",
    "target": "https://dvwa.revieworg.site/",
    "target_name": "DVWA",
    "asset_type": "web_app",
    "id": "dvwa-dvwa-config-file-discloses-database-password"
  },
  {
    "title": "Content Security Policy disabled",
    "category": "misconfiguration",
    "severity": "low",
    "owasp": "A05:2021",
    "cwe": "CWE-693",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "Check CSP header",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Content Security Policy disabled' on https://dvwa.revieworg.site/.",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://dvwa.revieworg.site/",
    "target_name": "DVWA",
    "asset_type": "web_app",
    "id": "dvwa-content-security-policy-disabled"
  },
  {
    "title": "GraphQL introspection enabled",
    "category": "graphql",
    "severity": "medium",
    "owasp": "A05:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "tool": "graphql",
      "method": "{__schema{types{name}}}",
      "expected_signal": "Full schema returned"
    },
    "verification": "Reproduce and capture evidence for 'GraphQL introspection enabled' on https://dvga.revieworg.site/.",
    "tags": [
      "api",
      "graphql"
    ],
    "status": "confirmed",
    "target": "https://dvga.revieworg.site/",
    "target_name": "DVGA",
    "asset_type": "api",
    "id": "dvga-graphql-introspection-enabled"
  },
  {
    "title": "GraphQL broken object level authorization",
    "category": "idor",
    "severity": "high",
    "owasp": "A01:2021",
    "cwe": "CWE-639",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "Query other user's object by id",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'GraphQL broken object level authorization' on https://dvga.revieworg.site/.",
    "tags": [
      "api",
      "graphql"
    ],
    "status": "confirmed",
    "target": "https://dvga.revieworg.site/",
    "target_name": "DVGA",
    "asset_type": "api",
    "id": "dvga-graphql-broken-object-level-authorization"
  },
  {
    "title": "GraphQL batch query abuse",
    "category": "business_logic",
    "severity": "medium",
    "owasp": "A04:2021",
    "cwe": "CWE-770",
    "difficulty": "medium",
    "arm": "agi",
    "detection": {
      "method": "Aliased batch of N queries",
      "expected_signal": "Single request amplifies"
    },
    "verification": "Reproduce and capture evidence for 'GraphQL batch query abuse' on https://dvga.revieworg.site/.",
    "tags": [
      "api",
      "graphql"
    ],
    "status": "confirmed",
    "target": "https://dvga.revieworg.site/",
    "target_name": "DVGA",
    "asset_type": "api",
    "id": "dvga-graphql-batch-query-abuse"
  },
  {
    "title": "GraphQL injection via query arguments",
    "category": "injection",
    "severity": "high",
    "owasp": "A03:2021",
    "cwe": "CWE-89",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "Malicious argument payload",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'GraphQL injection via query arguments' on https://dvga.revieworg.site/.",
    "tags": [
      "api",
      "graphql"
    ],
    "status": "confirmed",
    "target": "https://dvga.revieworg.site/",
    "target_name": "DVGA",
    "asset_type": "api",
    "id": "dvga-graphql-injection-via-query-arguments"
  },
  {
    "title": "GraphQL field-level authorisation bypass",
    "category": "auth",
    "severity": "high",
    "owasp": "A01:2021",
    "cwe": "CWE-285",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "Access admin-only field",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'GraphQL field-level authorisation bypass' on https://dvga.revieworg.site/.",
    "tags": [
      "api",
      "graphql"
    ],
    "status": "confirmed",
    "target": "https://dvga.revieworg.site/",
    "target_name": "DVGA",
    "asset_type": "api",
    "id": "dvga-graphql-field-level-authorisation-bypass"
  },
  {
    "title": "GraphQL query depth / DoS",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A05:2021",
    "cwe": "CWE-400",
    "difficulty": "medium",
    "arm": "agi",
    "detection": {
      "method": "Deeply nested query",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'GraphQL query depth / DoS' on https://dvga.revieworg.site/.",
    "tags": [
      "api",
      "graphql"
    ],
    "status": "confirmed",
    "target": "https://dvga.revieworg.site/",
    "target_name": "DVGA",
    "asset_type": "api",
    "id": "dvga-graphql-query-depth-dos"
  },
  {
    "title": "SQL injection in login",
    "category": "sqli",
    "severity": "high",
    "owasp": "A03:2021",
    "cwe": "CWE-89",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "tool": "sqlmap",
      "method": "POST /users/v1/login",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'SQL injection in login' on https://vampi.revieworg.site/.",
    "tags": [
      "api"
    ],
    "status": "confirmed",
    "target": "https://vampi.revieworg.site/",
    "target_name": "VAmPI",
    "asset_type": "api",
    "id": "vampi-sql-injection-in-login"
  },
  {
    "title": "Broken object level authorization on user endpoint",
    "category": "idor",
    "severity": "critical",
    "owasp": "A01:2021",
    "cwe": "CWE-639",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "GET /users/v1/{username}",
      "expected_signal": "Other user's data"
    },
    "verification": "Reproduce and capture evidence for 'Broken object level authorization on user endpoint' on https://vampi.revieworg.site/.",
    "tags": [
      "api"
    ],
    "status": "confirmed",
    "target": "https://vampi.revieworg.site/",
    "target_name": "VAmPI",
    "asset_type": "api",
    "id": "vampi-broken-object-level-authorization-on-user-endpoint"
  },
  {
    "title": "Broken object level authorization on books endpoint",
    "category": "idor",
    "severity": "high",
    "owasp": "A01:2021",
    "cwe": "CWE-639",
    "difficulty": "medium",
    "arm": "any",
    "detection": {
      "method": "GET /books/v1/{book}",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Broken object level authorization on books endpoint' on https://vampi.revieworg.site/.",
    "tags": [
      "api"
    ],
    "status": "confirmed",
    "target": "https://vampi.revieworg.site/",
    "target_name": "VAmPI",
    "asset_type": "api",
    "id": "vampi-broken-object-level-authorization-on-books-endpoint"
  },
  {
    "title": "Excessive data exposure in API responses",
    "category": "public_sensitive_exposure",
    "severity": "medium",
    "owasp": "A01:2021",
    "cwe": "CWE-213",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "Response includes password/secret",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Excessive data exposure in API responses' on https://vampi.revieworg.site/.",
    "tags": [
      "api"
    ],
    "status": "confirmed",
    "target": "https://vampi.revieworg.site/",
    "target_name": "VAmPI",
    "asset_type": "api",
    "id": "vampi-excessive-data-exposure-in-api-responses"
  },
  {
    "title": "JWT signed with weak secret",
    "category": "auth",
    "severity": "high",
    "owasp": "A02:2021",
    "cwe": "CWE-798",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "Crack token secret",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'JWT signed with weak secret' on https://vampi.revieworg.site/.",
    "tags": [
      "api",
      "jwt"
    ],
    "status": "confirmed",
    "target": "https://vampi.revieworg.site/",
    "target_name": "VAmPI",
    "asset_type": "api",
    "id": "vampi-jwt-signed-with-weak-secret"
  },
  {
    "title": "Mass assignment on user creation",
    "category": "auth",
    "severity": "high",
    "owasp": "A01:2021",
    "cwe": "CWE-915",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "POST extra admin field",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Mass assignment on user creation' on https://vampi.revieworg.site/.",
    "tags": [
      "api"
    ],
    "status": "confirmed",
    "target": "https://vampi.revieworg.site/",
    "target_name": "VAmPI",
    "asset_type": "api",
    "id": "vampi-mass-assignment-on-user-creation"
  },
  {
    "title": "No rate limiting on credential endpoints",
    "category": "auth",
    "severity": "medium",
    "owasp": "A07:2021",
    "cwe": "CWE-307",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "Burst login attempts",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'No rate limiting on credential endpoints' on https://vampi.revieworg.site/.",
    "tags": [
      "api"
    ],
    "status": "confirmed",
    "target": "https://vampi.revieworg.site/",
    "target_name": "VAmPI",
    "asset_type": "api",
    "id": "vampi-no-rate-limiting-on-credential-endpoints"
  },
  {
    "title": "Unrestricted HTTP method enables data mutation",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A05:2021",
    "cwe": "CWE-650",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "PUT/DELETE on collection",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Unrestricted HTTP method enables data mutation' on https://vampi.revieworg.site/.",
    "tags": [
      "api"
    ],
    "status": "confirmed",
    "target": "https://vampi.revieworg.site/",
    "target_name": "VAmPI",
    "asset_type": "api",
    "id": "vampi-unrestricted-http-method-enables-data-mutation"
  },
  {
    "title": "SQL injection lesson",
    "category": "sqli",
    "severity": "high",
    "owasp": "A03:2021",
    "cwe": "CWE-89",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "Lesson endpoints",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'SQL injection lesson' on https://webgoat.revieworg.site/WebGoat/.",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://webgoat.revieworg.site/WebGoat/",
    "target_name": "WebGoat",
    "asset_type": "web_app",
    "id": "webgoat-sql-injection-lesson"
  },
  {
    "title": "JWT authentication bypass lesson",
    "category": "auth",
    "severity": "high",
    "owasp": "A02:2021",
    "cwe": "CWE-347",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "JWT kid/alg abuse",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'JWT authentication bypass lesson' on https://webgoat.revieworg.site/WebGoat/.",
    "tags": [
      "web",
      "jwt"
    ],
    "status": "confirmed",
    "target": "https://webgoat.revieworg.site/WebGoat/",
    "target_name": "WebGoat",
    "asset_type": "web_app",
    "id": "webgoat-jwt-authentication-bypass-lesson"
  },
  {
    "title": "XXE in lesson endpoint",
    "category": "injection",
    "severity": "high",
    "owasp": "A05:2021",
    "cwe": "CWE-611",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "XML external entity",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'XXE in lesson endpoint' on https://webgoat.revieworg.site/WebGoat/.",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://webgoat.revieworg.site/WebGoat/",
    "target_name": "WebGoat",
    "asset_type": "web_app",
    "id": "webgoat-xxe-in-lesson-endpoint"
  },
  {
    "title": "Insecure deserialisation",
    "category": "injection",
    "severity": "critical",
    "owasp": "A08:2021",
    "cwe": "CWE-502",
    "difficulty": "medium",
    "arm": "agi",
    "detection": {
      "method": "Serialized payload",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Insecure deserialisation' on https://webgoat.revieworg.site/WebGoat/.",
    "tags": [
      "web",
      "rce"
    ],
    "status": "confirmed",
    "target": "https://webgoat.revieworg.site/WebGoat/",
    "target_name": "WebGoat",
    "asset_type": "web_app",
    "id": "webgoat-insecure-deserialisation"
  },
  {
    "title": "Path traversal in lesson file access",
    "category": "file_inclusion",
    "severity": "high",
    "owasp": "A01:2021",
    "cwe": "CWE-22",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "../ path in parameter",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Path traversal in lesson file access' on https://webgoat.revieworg.site/WebGoat/.",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://webgoat.revieworg.site/WebGoat/",
    "target_name": "WebGoat",
    "asset_type": "web_app",
    "id": "webgoat-path-traversal-in-lesson-file-access"
  },
  {
    "title": "Broken access control lesson",
    "category": "auth",
    "severity": "high",
    "owasp": "A01:2021",
    "cwe": "CWE-285",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "Missing function-level check",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Broken access control lesson' on https://webgoat.revieworg.site/WebGoat/.",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://webgoat.revieworg.site/WebGoat/",
    "target_name": "WebGoat",
    "asset_type": "web_app",
    "id": "webgoat-broken-access-control-lesson"
  },
  {
    "title": "Cross-site scripting lesson",
    "category": "xss",
    "severity": "medium",
    "owasp": "A03:2021",
    "cwe": "CWE-79",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Cross-site scripting lesson' on https://webgoat.revieworg.site/WebGoat/.",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://webgoat.revieworg.site/WebGoat/",
    "target_name": "WebGoat",
    "asset_type": "web_app",
    "id": "webgoat-cross-site-scripting-lesson"
  },
  {
    "title": "WebWolf file/mail catcher exposed",
    "category": "misconfiguration",
    "severity": "low",
    "owasp": "A05:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "Open WebWolf UI",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'WebWolf file/mail catcher exposed' on https://webgoat.revieworg.site/WebGoat/.",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://webgoat.revieworg.site/WebGoat/",
    "target_name": "WebGoat",
    "asset_type": "web_app",
    "id": "webgoat-webwolf-file-mail-catcher-exposed"
  },
  {
    "title": "SQL injection in login",
    "category": "sqli",
    "severity": "high",
    "owasp": "A03:2021",
    "cwe": "CWE-89",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'SQL injection in login' on https://bwapp.revieworg.site/.",
    "status": "confirmed",
    "target": "https://bwapp.revieworg.site/",
    "target_name": "bWAPP",
    "asset_type": "web_app",
    "id": "bwapp-sql-injection-in-login"
  },
  {
    "title": "SQL injection via GET parameter",
    "category": "sqli",
    "severity": "high",
    "owasp": "A03:2021",
    "cwe": "CWE-89",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'SQL injection via GET parameter' on https://bwapp.revieworg.site/.",
    "status": "confirmed",
    "target": "https://bwapp.revieworg.site/",
    "target_name": "bWAPP",
    "asset_type": "web_app",
    "id": "bwapp-sql-injection-via-get-parameter"
  },
  {
    "title": "Reflected cross-site scripting",
    "category": "xss",
    "severity": "medium",
    "owasp": "A03:2021",
    "cwe": "CWE-79",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Reflected cross-site scripting' on https://bwapp.revieworg.site/.",
    "status": "confirmed",
    "target": "https://bwapp.revieworg.site/",
    "target_name": "bWAPP",
    "asset_type": "web_app",
    "id": "bwapp-reflected-cross-site-scripting"
  },
  {
    "title": "Stored cross-site scripting in blog",
    "category": "xss",
    "severity": "high",
    "owasp": "A03:2021",
    "cwe": "CWE-79",
    "difficulty": "medium",
    "arm": "any",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Stored cross-site scripting in blog' on https://bwapp.revieworg.site/.",
    "status": "confirmed",
    "target": "https://bwapp.revieworg.site/",
    "target_name": "bWAPP",
    "asset_type": "web_app",
    "id": "bwapp-stored-cross-site-scripting-in-blog"
  },
  {
    "title": "OS command injection",
    "category": "injection",
    "severity": "critical",
    "owasp": "A03:2021",
    "cwe": "CWE-78",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'OS command injection' on https://bwapp.revieworg.site/.",
    "status": "confirmed",
    "target": "https://bwapp.revieworg.site/",
    "target_name": "bWAPP",
    "asset_type": "web_app",
    "id": "bwapp-os-command-injection"
  },
  {
    "title": "Local/remote file inclusion",
    "category": "file_inclusion",
    "severity": "critical",
    "owasp": "A03:2021",
    "cwe": "CWE-98",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "page parameter",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Local/remote file inclusion' on https://bwapp.revieworg.site/.",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://bwapp.revieworg.site/",
    "target_name": "bWAPP",
    "asset_type": "web_app",
    "id": "bwapp-local-remote-file-inclusion"
  },
  {
    "title": "Unrestricted file upload",
    "category": "file_upload",
    "severity": "critical",
    "owasp": "A04:2021",
    "cwe": "CWE-434",
    "difficulty": "medium",
    "arm": "any",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Unrestricted file upload' on https://bwapp.revieworg.site/.",
    "status": "confirmed",
    "target": "https://bwapp.revieworg.site/",
    "target_name": "bWAPP",
    "asset_type": "web_app",
    "id": "bwapp-unrestricted-file-upload"
  },
  {
    "title": "SSRF via URL parameter",
    "category": "ssrf",
    "severity": "high",
    "owasp": "A10:2021",
    "cwe": "CWE-918",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'SSRF via URL parameter' on https://bwapp.revieworg.site/.",
    "status": "confirmed",
    "target": "https://bwapp.revieworg.site/",
    "target_name": "bWAPP",
    "asset_type": "web_app",
    "id": "bwapp-ssrf-via-url-parameter"
  },
  {
    "title": "XML external entity injection",
    "category": "injection",
    "severity": "high",
    "owasp": "A05:2021",
    "cwe": "CWE-611",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'XML external entity injection' on https://bwapp.revieworg.site/.",
    "status": "confirmed",
    "target": "https://bwapp.revieworg.site/",
    "target_name": "bWAPP",
    "asset_type": "web_app",
    "id": "bwapp-xml-external-entity-injection"
  },
  {
    "title": "LDAP injection in search",
    "category": "injection",
    "severity": "high",
    "owasp": "A03:2021",
    "cwe": "CWE-90",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'LDAP injection in search' on https://bwapp.revieworg.site/.",
    "status": "confirmed",
    "target": "https://bwapp.revieworg.site/",
    "target_name": "bWAPP",
    "asset_type": "web_app",
    "id": "bwapp-ldap-injection-in-search"
  },
  {
    "title": "SQL injection in login",
    "category": "sqli",
    "severity": "high",
    "owasp": "A03:2021",
    "cwe": "CWE-89",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'SQL injection in login' on https://mutillidae.revieworg.site/.",
    "status": "confirmed",
    "target": "https://mutillidae.revieworg.site/",
    "target_name": "Mutillidae",
    "asset_type": "web_app",
    "id": "mutillidae-sql-injection-in-login"
  },
  {
    "title": "SQL injection in user info lookup",
    "category": "sqli",
    "severity": "high",
    "owasp": "A03:2021",
    "cwe": "CWE-89",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'SQL injection in user info lookup' on https://mutillidae.revieworg.site/.",
    "status": "confirmed",
    "target": "https://mutillidae.revieworg.site/",
    "target_name": "Mutillidae",
    "asset_type": "web_app",
    "id": "mutillidae-sql-injection-in-user-info-lookup"
  },
  {
    "title": "Reflected cross-site scripting",
    "category": "xss",
    "severity": "medium",
    "owasp": "A03:2021",
    "cwe": "CWE-79",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Reflected cross-site scripting' on https://mutillidae.revieworg.site/.",
    "status": "confirmed",
    "target": "https://mutillidae.revieworg.site/",
    "target_name": "Mutillidae",
    "asset_type": "web_app",
    "id": "mutillidae-reflected-cross-site-scripting"
  },
  {
    "title": "Stored cross-site scripting in blog comments",
    "category": "xss",
    "severity": "high",
    "owasp": "A03:2021",
    "cwe": "CWE-79",
    "difficulty": "medium",
    "arm": "any",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Stored cross-site scripting in blog comments' on https://mutillidae.revieworg.site/.",
    "status": "confirmed",
    "target": "https://mutillidae.revieworg.site/",
    "target_name": "Mutillidae",
    "asset_type": "web_app",
    "id": "mutillidae-stored-cross-site-scripting-in-blog-comments"
  },
  {
    "title": "Local file inclusion via page parameter",
    "category": "file_inclusion",
    "severity": "high",
    "owasp": "A03:2021",
    "cwe": "CWE-98",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Local file inclusion via page parameter' on https://mutillidae.revieworg.site/.",
    "status": "confirmed",
    "target": "https://mutillidae.revieworg.site/",
    "target_name": "Mutillidae",
    "asset_type": "web_app",
    "id": "mutillidae-local-file-inclusion-via-page-parameter"
  },
  {
    "title": "Arbitrary file upload",
    "category": "file_upload",
    "severity": "critical",
    "owasp": "A04:2021",
    "cwe": "CWE-434",
    "difficulty": "medium",
    "arm": "any",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Arbitrary file upload' on https://mutillidae.revieworg.site/.",
    "status": "confirmed",
    "target": "https://mutillidae.revieworg.site/",
    "target_name": "Mutillidae",
    "asset_type": "web_app",
    "id": "mutillidae-arbitrary-file-upload"
  },
  {
    "title": "Cross-site request forgery",
    "category": "csrf",
    "severity": "medium",
    "owasp": "A01:2021",
    "cwe": "CWE-352",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Cross-site request forgery' on https://mutillidae.revieworg.site/.",
    "status": "confirmed",
    "target": "https://mutillidae.revieworg.site/",
    "target_name": "Mutillidae",
    "asset_type": "web_app",
    "id": "mutillidae-cross-site-request-forgery"
  },
  {
    "title": "HTML5 web storage exposes session data",
    "category": "public_sensitive_exposure",
    "severity": "low",
    "owasp": "A02:2021",
    "cwe": "CWE-922",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'HTML5 web storage exposes session data' on https://mutillidae.revieworg.site/.",
    "tags": [
      "web"
    ],
    "status": "confirmed",
    "target": "https://mutillidae.revieworg.site/",
    "target_name": "Mutillidae",
    "asset_type": "web_app",
    "id": "mutillidae-html5-web-storage-exposes-session-data"
  },
  {
    "title": "Outdated WordPress core version",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A06:2021",
    "cwe": "CWE-1104",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "tool": "wpscan",
      "method": "Read generator meta",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Outdated WordPress core version' on https://wordpress.revieworg.site/.",
    "tags": [
      "cms"
    ],
    "status": "confirmed",
    "target": "https://wordpress.revieworg.site/",
    "target_name": "WordPress",
    "asset_type": "web_app",
    "id": "wordpress-outdated-wordpress-core-version"
  },
  {
    "title": "WordPress user enumeration via REST API",
    "category": "public_sensitive_exposure",
    "severity": "medium",
    "owasp": "A01:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "GET /wp-json/wp/v2/users",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'WordPress user enumeration via REST API' on https://wordpress.revieworg.site/.",
    "tags": [
      "cms"
    ],
    "status": "confirmed",
    "target": "https://wordpress.revieworg.site/",
    "target_name": "WordPress",
    "asset_type": "web_app",
    "id": "wordpress-wordpress-user-enumeration-via-rest-api"
  },
  {
    "title": "WordPress XML-RPC enabled",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A05:2021",
    "cwe": "CWE-16",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "POST /xmlrpc.php",
      "expected_signal": "system.listMethods"
    },
    "verification": "Reproduce and capture evidence for 'WordPress XML-RPC enabled' on https://wordpress.revieworg.site/.",
    "tags": [
      "cms"
    ],
    "status": "confirmed",
    "target": "https://wordpress.revieworg.site/",
    "target_name": "WordPress",
    "asset_type": "web_app",
    "id": "wordpress-wordpress-xml-rpc-enabled"
  },
  {
    "title": "Weak WordPress database credentials in config",
    "category": "public_sensitive_exposure",
    "severity": "high",
    "owasp": "A05:2021",
    "cwe": "CWE-798",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Weak WordPress database credentials in config' on https://wordpress.revieworg.site/.",
    "tags": [
      "cms"
    ],
    "status": "confirmed",
    "target": "https://wordpress.revieworg.site/",
    "target_name": "WordPress",
    "asset_type": "web_app",
    "id": "wordpress-weak-wordpress-database-credentials-in-config"
  },
  {
    "title": "WordPress admin brute force (no rate limit)",
    "category": "auth",
    "severity": "high",
    "owasp": "A07:2021",
    "cwe": "CWE-307",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "POST /wp-login.php",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'WordPress admin brute force (no rate limit)' on https://wordpress.revieworg.site/.",
    "tags": [
      "cms"
    ],
    "status": "confirmed",
    "target": "https://wordpress.revieworg.site/",
    "target_name": "WordPress",
    "asset_type": "web_app",
    "id": "wordpress-wordpress-admin-brute-force-no-rate-limit"
  },
  {
    "title": "XML-RPC pingback SSRF",
    "category": "ssrf",
    "severity": "medium",
    "owasp": "A10:2021",
    "cwe": "CWE-918",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'XML-RPC pingback SSRF' on https://wordpress.revieworg.site/.",
    "tags": [
      "cms"
    ],
    "status": "confirmed",
    "target": "https://wordpress.revieworg.site/",
    "target_name": "WordPress",
    "asset_type": "web_app",
    "id": "wordpress-xml-rpc-pingback-ssrf"
  },
  {
    "title": "Directory listing allows plugin enumeration",
    "category": "misconfiguration",
    "severity": "low",
    "owasp": "A05:2021",
    "cwe": "CWE-548",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Directory listing allows plugin enumeration' on https://wordpress.revieworg.site/.",
    "tags": [
      "cms"
    ],
    "status": "confirmed",
    "target": "https://wordpress.revieworg.site/",
    "target_name": "WordPress",
    "asset_type": "web_app",
    "id": "wordpress-directory-listing-allows-plugin-enumeration"
  },
  {
    "title": "Secret leaked in page source",
    "category": "public_sensitive_exposure",
    "severity": "medium",
    "owasp": "A02:2021",
    "cwe": "CWE-540",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "View source / JS",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Secret leaked in page source' on https://wrongsecrets.revieworg.site/.",
    "tags": [
      "ctf"
    ],
    "status": "confirmed",
    "target": "https://wrongsecrets.revieworg.site/",
    "target_name": "WrongSecrets",
    "asset_type": "web_app",
    "id": "wrongsecrets-secret-leaked-in-page-source"
  },
  {
    "title": "Secret exposed via client-side API",
    "category": "public_sensitive_exposure",
    "severity": "medium",
    "owasp": "A02:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "Call /api endpoints",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Secret exposed via client-side API' on https://wrongsecrets.revieworg.site/.",
    "tags": [
      "ctf"
    ],
    "status": "confirmed",
    "target": "https://wrongsecrets.revieworg.site/",
    "target_name": "WrongSecrets",
    "asset_type": "web_app",
    "id": "wrongsecrets-secret-exposed-via-client-side-api"
  },
  {
    "title": "Secret recoverable from container environment",
    "category": "public_sensitive_exposure",
    "severity": "high",
    "owasp": "A05:2021",
    "cwe": "CWE-526",
    "difficulty": "medium",
    "arm": "agi",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Secret recoverable from container environment' on https://wrongsecrets.revieworg.site/.",
    "tags": [
      "ctf"
    ],
    "status": "confirmed",
    "target": "https://wrongsecrets.revieworg.site/",
    "target_name": "WrongSecrets",
    "asset_type": "web_app",
    "id": "wrongsecrets-secret-recoverable-from-container-environment"
  },
  {
    "title": "Secret in git history / config map",
    "category": "public_sensitive_exposure",
    "severity": "high",
    "owasp": "A02:2021",
    "cwe": "CWE-798",
    "difficulty": "medium",
    "arm": "agi",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Secret in git history / config map' on https://wrongsecrets.revieworg.site/.",
    "tags": [
      "ctf"
    ],
    "status": "confirmed",
    "target": "https://wrongsecrets.revieworg.site/",
    "target_name": "WrongSecrets",
    "asset_type": "web_app",
    "id": "wrongsecrets-secret-in-git-history-config-map"
  },
  {
    "title": "CTF flags enumerable by challenge",
    "category": "misconfiguration",
    "severity": "low",
    "owasp": "A05:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "any",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'CTF flags enumerable by challenge' on https://wrongsecrets.revieworg.site/.",
    "tags": [
      "ctf"
    ],
    "status": "confirmed",
    "target": "https://wrongsecrets.revieworg.site/",
    "target_name": "WrongSecrets",
    "asset_type": "web_app",
    "id": "wrongsecrets-ctf-flags-enumerable-by-challenge"
  },
  {
    "title": "Default database credentials accepted",
    "category": "default_credentials",
    "severity": "critical",
    "owasp": "A07:2021",
    "cwe": "CWE-1392",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "root/root login",
      "expected_signal": "Full DB access"
    },
    "verification": "Reproduce and capture evidence for 'Default database credentials accepted' on https://phpmyadmin.revieworg.site/.",
    "tags": [
      "tool",
      "db"
    ],
    "status": "confirmed",
    "target": "https://phpmyadmin.revieworg.site/",
    "target_name": "phpMyAdmin",
    "asset_type": "web_app",
    "id": "phpmyadmin-default-database-credentials-accepted"
  },
  {
    "title": "Database administration interface publicly exposed",
    "category": "misconfiguration",
    "severity": "high",
    "owasp": "A05:2021",
    "cwe": "CWE-668",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Database administration interface publicly exposed' on https://phpmyadmin.revieworg.site/.",
    "tags": [
      "tool",
      "exposure"
    ],
    "status": "confirmed",
    "target": "https://phpmyadmin.revieworg.site/",
    "target_name": "phpMyAdmin",
    "asset_type": "web_app",
    "id": "phpmyadmin-database-administration-interface-publicly-exposed"
  },
  {
    "title": "PHPMyAdmin version with known CVEs",
    "category": "misconfiguration",
    "severity": "high",
    "owasp": "A06:2021",
    "cwe": "CWE-1104",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "tool": "nuclei",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'PHPMyAdmin version with known CVEs' on https://phpmyadmin.revieworg.site/.",
    "tags": [
      "tool"
    ],
    "status": "confirmed",
    "target": "https://phpmyadmin.revieworg.site/",
    "target_name": "phpMyAdmin",
    "asset_type": "web_app",
    "id": "phpmyadmin-phpmyadmin-version-with-known-cves"
  },
  {
    "title": "Arbitrary SQL execution as root",
    "category": "default_credentials",
    "severity": "critical",
    "owasp": "A03:2021",
    "cwe": "CWE-89",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Arbitrary SQL execution as root' on https://phpmyadmin.revieworg.site/.",
    "tags": [
      "tool",
      "db"
    ],
    "status": "confirmed",
    "target": "https://phpmyadmin.revieworg.site/",
    "target_name": "phpMyAdmin",
    "asset_type": "web_app",
    "id": "phpmyadmin-arbitrary-sql-execution-as-root"
  },
  {
    "title": "Database administration interface publicly exposed",
    "category": "misconfiguration",
    "severity": "high",
    "owasp": "A05:2021",
    "cwe": "CWE-668",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Database administration interface publicly exposed' on https://adminer.revieworg.site/.",
    "tags": [
      "tool",
      "exposure"
    ],
    "status": "confirmed",
    "target": "https://adminer.revieworg.site/",
    "target_name": "Adminer",
    "asset_type": "web_app",
    "id": "adminer-database-administration-interface-publicly-exposed"
  },
  {
    "title": "Default database credentials accepted",
    "category": "default_credentials",
    "severity": "critical",
    "owasp": "A07:2021",
    "cwe": "CWE-1392",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Default database credentials accepted' on https://adminer.revieworg.site/.",
    "tags": [
      "tool",
      "db"
    ],
    "status": "confirmed",
    "target": "https://adminer.revieworg.site/",
    "target_name": "Adminer",
    "asset_type": "web_app",
    "id": "adminer-default-database-credentials-accepted"
  },
  {
    "title": "Server-side request forgery via connection host",
    "category": "ssrf",
    "severity": "high",
    "owasp": "A10:2021",
    "cwe": "CWE-918",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Server-side request forgery via connection host' on https://adminer.revieworg.site/.",
    "tags": [
      "tool"
    ],
    "status": "confirmed",
    "target": "https://adminer.revieworg.site/",
    "target_name": "Adminer",
    "asset_type": "web_app",
    "id": "adminer-server-side-request-forgery-via-connection-host"
  },
  {
    "title": "APK artifacts publicly downloadable",
    "category": "public_sensitive_exposure",
    "severity": "low",
    "owasp": "A05:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'APK artifacts publicly downloadable' on https://apk.revieworg.site/.",
    "tags": [
      "mobile"
    ],
    "status": "confirmed",
    "target": "https://apk.revieworg.site/",
    "target_name": "APK Host",
    "asset_type": "web_app",
    "id": "apk-host-apk-artifacts-publicly-downloadable"
  },
  {
    "title": "Directory indexing exposes files",
    "category": "misconfiguration",
    "severity": "low",
    "owasp": "A05:2021",
    "cwe": "CWE-548",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Directory indexing exposes files' on https://apk.revieworg.site/.",
    "tags": [
      "mobile"
    ],
    "status": "confirmed",
    "target": "https://apk.revieworg.site/",
    "target_name": "APK Host",
    "asset_type": "web_app",
    "id": "apk-host-directory-indexing-exposes-files"
  },
  {
    "title": "PostgreSQL superuser with weak password",
    "category": "default_credentials",
    "severity": "critical",
    "owasp": "A07:2021",
    "cwe": "CWE-1392",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "psql postgres/postgres",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'PostgreSQL superuser with weak password' on 169.58.67.158:5432.",
    "tags": [
      "db",
      "creds"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:5432",
    "target_name": "Postgres",
    "asset_type": "database_connection",
    "id": "postgres-postgresql-superuser-with-weak-password"
  },
  {
    "title": "PostgreSQL SSL disabled",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A02:2021",
    "cwe": "CWE-319",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "SHOW ssl",
      "expected_signal": "off"
    },
    "verification": "Reproduce and capture evidence for 'PostgreSQL SSL disabled' on 169.58.67.158:5432.",
    "tags": [
      "db"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:5432",
    "target_name": "Postgres",
    "asset_type": "database_connection",
    "id": "postgres-postgresql-ssl-disabled"
  },
  {
    "title": "PostgreSQL MD5 password hashing",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A02:2021",
    "cwe": "CWE-916",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "SHOW password_encryption",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'PostgreSQL MD5 password hashing' on 169.58.67.158:5432.",
    "tags": [
      "db"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:5432",
    "target_name": "Postgres",
    "asset_type": "database_connection",
    "id": "postgres-postgresql-md5-password-hashing"
  },
  {
    "title": "PostgreSQL listens on all interfaces",
    "category": "misconfiguration",
    "severity": "high",
    "owasp": "A05:2021",
    "cwe": "CWE-668",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "SHOW listen_addresses",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'PostgreSQL listens on all interfaces' on 169.58.67.158:5432.",
    "tags": [
      "db"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:5432",
    "target_name": "Postgres",
    "asset_type": "database_connection",
    "id": "postgres-postgresql-listens-on-all-interfaces"
  },
  {
    "title": "Application DB role has superuser privileges",
    "category": "misconfiguration",
    "severity": "high",
    "owasp": "A01:2021",
    "cwe": "CWE-250",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "\\du phantix",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Application DB role has superuser privileges' on 169.58.67.158:5432.",
    "tags": [
      "db"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:5432",
    "target_name": "Postgres",
    "asset_type": "database_connection",
    "id": "postgres-application-db-role-has-superuser-privileges"
  },
  {
    "title": "Audit PostgreSQL weak credentials",
    "category": "default_credentials",
    "severity": "high",
    "owasp": "A07:2021",
    "cwe": "CWE-1392",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "audit/audit",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Audit PostgreSQL weak credentials' on 169.58.67.158:5433.",
    "tags": [
      "db",
      "creds"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:5433",
    "target_name": "Postgres Audit",
    "asset_type": "database_connection",
    "id": "postgres-audit-audit-postgresql-weak-credentials"
  },
  {
    "title": "Audit DB SSL disabled",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A02:2021",
    "cwe": "CWE-319",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Audit DB SSL disabled' on 169.58.67.158:5433.",
    "tags": [
      "db"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:5433",
    "target_name": "Postgres Audit",
    "asset_type": "database_connection",
    "id": "postgres-audit-audit-db-ssl-disabled"
  },
  {
    "title": "Audit DB remote access enabled",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A05:2021",
    "cwe": "CWE-668",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Audit DB remote access enabled' on 169.58.67.158:5433.",
    "tags": [
      "db"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:5433",
    "target_name": "Postgres Audit",
    "asset_type": "database_connection",
    "id": "postgres-audit-audit-db-remote-access-enabled"
  },
  {
    "title": "MySQL remote root with weak password",
    "category": "default_credentials",
    "severity": "critical",
    "owasp": "A07:2021",
    "cwe": "CWE-1392",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "root/root from any host",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'MySQL remote root with weak password' on 169.58.67.158:3306.",
    "tags": [
      "db",
      "creds"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:3306",
    "target_name": "MySQL",
    "asset_type": "database_connection",
    "id": "mysql-mysql-remote-root-with-weak-password"
  },
  {
    "title": "MySQL local infile enabled",
    "category": "misconfiguration",
    "severity": "high",
    "owasp": "A05:2021",
    "cwe": "CWE-16",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "SHOW VARIABLES LIKE 'local_infile'",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'MySQL local infile enabled' on 169.58.67.158:3306.",
    "tags": [
      "db"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:3306",
    "target_name": "MySQL",
    "asset_type": "database_connection",
    "id": "mysql-mysql-local-infile-enabled"
  },
  {
    "title": "MySQL legacy native authentication plugin",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A02:2021",
    "cwe": "CWE-916",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'MySQL legacy native authentication plugin' on 169.58.67.158:3306.",
    "tags": [
      "db"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:3306",
    "target_name": "MySQL",
    "asset_type": "database_connection",
    "id": "mysql-mysql-legacy-native-authentication-plugin"
  },
  {
    "title": "MySQL sample user with weak password",
    "category": "default_credentials",
    "severity": "high",
    "owasp": "A07:2021",
    "cwe": "CWE-1392",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "lab/lab",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'MySQL sample user with weak password' on 169.58.67.158:3306.",
    "tags": [
      "db",
      "creds"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:3306",
    "target_name": "MySQL",
    "asset_type": "database_connection",
    "id": "mysql-mysql-sample-user-with-weak-password"
  },
  {
    "title": "MySQL exposes version and hostname in errors",
    "category": "public_sensitive_exposure",
    "severity": "low",
    "owasp": "A05:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'MySQL exposes version and hostname in errors' on 169.58.67.158:3306.",
    "tags": [
      "db"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:3306",
    "target_name": "MySQL",
    "asset_type": "database_connection",
    "id": "mysql-mysql-exposes-version-and-hostname-in-errors"
  },
  {
    "title": "MariaDB remote root with weak password",
    "category": "default_credentials",
    "severity": "critical",
    "owasp": "A07:2021",
    "cwe": "CWE-1392",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "root/mariadb",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'MariaDB remote root with weak password' on 169.58.67.158:3307.",
    "tags": [
      "db",
      "creds"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:3307",
    "target_name": "MariaDB",
    "asset_type": "database_connection",
    "id": "mariadb-mariadb-remote-root-with-weak-password"
  },
  {
    "title": "MariaDB sample user with weak password",
    "category": "default_credentials",
    "severity": "high",
    "owasp": "A07:2021",
    "cwe": "CWE-1392",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'MariaDB sample user with weak password' on 169.58.67.158:3307.",
    "tags": [
      "db",
      "creds"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:3307",
    "target_name": "MariaDB",
    "asset_type": "database_connection",
    "id": "mariadb-mariadb-sample-user-with-weak-password"
  },
  {
    "title": "MariaDB binds to all interfaces",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A05:2021",
    "cwe": "CWE-668",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'MariaDB binds to all interfaces' on 169.58.67.158:3307.",
    "tags": [
      "db"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:3307",
    "target_name": "MariaDB",
    "asset_type": "database_connection",
    "id": "mariadb-mariadb-binds-to-all-interfaces"
  },
  {
    "title": "MSSQL weak SA password",
    "category": "default_credentials",
    "severity": "critical",
    "owasp": "A07:2021",
    "cwe": "CWE-1392",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "sa/LabWeak_SA_123",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'MSSQL weak SA password' on 169.58.67.158:1433.",
    "tags": [
      "db",
      "creds"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:1433",
    "target_name": "MSSQL",
    "asset_type": "database_connection",
    "id": "mssql-mssql-weak-sa-password"
  },
  {
    "title": "MSSQL xp_cmdshell potentially available",
    "category": "misconfiguration",
    "severity": "critical",
    "owasp": "A03:2021",
    "cwe": "CWE-78",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "sp_configure xp_cmdshell",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'MSSQL xp_cmdshell potentially available' on 169.58.67.158:1433.",
    "tags": [
      "db",
      "rce"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:1433",
    "target_name": "MSSQL",
    "asset_type": "database_connection",
    "id": "mssql-mssql-xp-cmdshell-potentially-available"
  },
  {
    "title": "MSSQL default port exposed to internet",
    "category": "misconfiguration",
    "severity": "high",
    "owasp": "A05:2021",
    "cwe": "CWE-668",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'MSSQL default port exposed to internet' on 169.58.67.158:1433.",
    "tags": [
      "db"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:1433",
    "target_name": "MSSQL",
    "asset_type": "database_connection",
    "id": "mssql-mssql-default-port-exposed-to-internet"
  },
  {
    "title": "MongoDB exposed without authentication",
    "category": "anonymous_access",
    "severity": "critical",
    "owasp": "A07:2021",
    "cwe": "CWE-306",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "mongosh listDatabases",
      "expected_signal": "No auth prompt"
    },
    "verification": "Reproduce and capture evidence for 'MongoDB exposed without authentication' on 169.58.67.158:27017.",
    "tags": [
      "db",
      "noauth"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:27017",
    "target_name": "MongoDB",
    "asset_type": "database_connection",
    "id": "mongodb-mongodb-exposed-without-authentication"
  },
  {
    "title": "MongoDB databases and collections enumerable",
    "category": "public_sensitive_exposure",
    "severity": "high",
    "owasp": "A01:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'MongoDB databases and collections enumerable' on 169.58.67.158:27017.",
    "tags": [
      "db"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:27017",
    "target_name": "MongoDB",
    "asset_type": "database_connection",
    "id": "mongodb-mongodb-databases-and-collections-enumerable"
  },
  {
    "title": "MongoDB bind_ip_all exposure",
    "category": "misconfiguration",
    "severity": "high",
    "owasp": "A05:2021",
    "cwe": "CWE-668",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'MongoDB bind_ip_all exposure' on 169.58.67.158:27017.",
    "tags": [
      "db"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:27017",
    "target_name": "MongoDB",
    "asset_type": "database_connection",
    "id": "mongodb-mongodb-bind-ip-all-exposure"
  },
  {
    "title": "Redis exposed without authentication",
    "category": "anonymous_access",
    "severity": "critical",
    "owasp": "A07:2021",
    "cwe": "CWE-306",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "redis-cli PING",
      "expected_signal": "PONG unauth"
    },
    "verification": "Reproduce and capture evidence for 'Redis exposed without authentication' on 169.58.67.158:6379.",
    "tags": [
      "db",
      "noauth"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:6379",
    "target_name": "Redis",
    "asset_type": "database_connection",
    "id": "redis-redis-exposed-without-authentication"
  },
  {
    "title": "Redis protected-mode disabled",
    "category": "misconfiguration",
    "severity": "high",
    "owasp": "A05:2021",
    "cwe": "CWE-16",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "CONFIG GET protected-mode",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Redis protected-mode disabled' on 169.58.67.158:6379.",
    "tags": [
      "db"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:6379",
    "target_name": "Redis",
    "asset_type": "database_connection",
    "id": "redis-redis-protected-mode-disabled"
  },
  {
    "title": "Redis keys readable by unauthenticated client",
    "category": "public_sensitive_exposure",
    "severity": "high",
    "owasp": "A01:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "KEYS *",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Redis keys readable by unauthenticated client' on 169.58.67.158:6379.",
    "tags": [
      "db"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:6379",
    "target_name": "Redis",
    "asset_type": "database_connection",
    "id": "redis-redis-keys-readable-by-unauthenticated-client"
  },
  {
    "title": "Redis CONFIG SET enables file write / RCE path",
    "category": "misconfiguration",
    "severity": "critical",
    "owasp": "A03:2021",
    "cwe": "CWE-94",
    "difficulty": "medium",
    "arm": "agi",
    "detection": {
      "method": "CONFIG SET dir/dbfilename",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Redis CONFIG SET enables file write / RCE path' on 169.58.67.158:6379.",
    "tags": [
      "db",
      "rce"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:6379",
    "target_name": "Redis",
    "asset_type": "database_connection",
    "id": "redis-redis-config-set-enables-file-write-rce-path"
  },
  {
    "title": "Anonymous LDAP simple bind allowed",
    "category": "ldap",
    "severity": "high",
    "owasp": "A07:2021",
    "cwe": "CWE-287",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "ldapsearch -x anonymous",
      "expected_signal": "Base DN enumerable"
    },
    "verification": "Reproduce and capture evidence for 'Anonymous LDAP simple bind allowed' on 169.58.67.158:389.",
    "tags": [
      "ad",
      "ldap"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:389",
    "target_name": "Active Directory",
    "asset_type": "domain_controller",
    "id": "active-directory-anonymous-ldap-simple-bind-allowed"
  },
  {
    "title": "LDAP supports plaintext simple bind (no LDAPS enforcement)",
    "category": "ldap",
    "severity": "high",
    "owasp": "A02:2021",
    "cwe": "CWE-319",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "ldapsearch on 389",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'LDAP supports plaintext simple bind (no LDAPS enforcement)' on 169.58.67.158:389.",
    "tags": [
      "ad",
      "ldap"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:389",
    "target_name": "Active Directory",
    "asset_type": "domain_controller",
    "id": "active-directory-ldap-supports-plaintext-simple-bind-no-ldaps-enforcement"
  },
  {
    "title": "Active Directory password complexity disabled",
    "category": "misconfiguration",
    "severity": "high",
    "owasp": "A07:2021",
    "cwe": "CWE-521",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "samba-tool domain passwordsettings show",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Active Directory password complexity disabled' on 169.58.67.158:389.",
    "tags": [
      "ad"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:389",
    "target_name": "Active Directory",
    "asset_type": "domain_controller",
    "id": "active-directory-active-directory-password-complexity-disabled"
  },
  {
    "title": "Domain admin account with weak password",
    "category": "auth",
    "severity": "critical",
    "owasp": "A07:2021",
    "cwe": "CWE-1392",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "Bind as Administrator",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Domain admin account with weak password' on 169.58.67.158:389.",
    "tags": [
      "ad",
      "creds"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:389",
    "target_name": "Active Directory",
    "asset_type": "domain_controller",
    "id": "active-directory-domain-admin-account-with-weak-password"
  },
  {
    "title": "Kerberoastable service account (SPN, no expiry)",
    "category": "kerberos",
    "severity": "high",
    "owasp": "A02:2021",
    "cwe": "CWE-522",
    "difficulty": "medium",
    "arm": "any",
    "detection": {
      "method": "GetUserSPNs svc-backup",
      "expected_signal": "TGS-REP crackable"
    },
    "verification": "Reproduce and capture evidence for 'Kerberoastable service account (SPN, no expiry)' on 169.58.67.158:389.",
    "tags": [
      "ad",
      "kerberos"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:389",
    "target_name": "Active Directory",
    "asset_type": "domain_controller",
    "id": "active-directory-kerberoastable-service-account-spn-no-expiry"
  },
  {
    "title": "Anonymous SMB share enumeration",
    "category": "smb",
    "severity": "medium",
    "owasp": "A01:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "smbclient -L",
      "expected_signal": "Share list without creds"
    },
    "verification": "Reproduce and capture evidence for 'Anonymous SMB share enumeration' on 169.58.67.158:389.",
    "tags": [
      "ad",
      "smb"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:389",
    "target_name": "Active Directory",
    "asset_type": "domain_controller",
    "id": "active-directory-anonymous-smb-share-enumeration"
  },
  {
    "title": "Guest-writable SMB share",
    "category": "smb",
    "severity": "high",
    "owasp": "A01:2021",
    "cwe": "CWE-732",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "smbclient //public",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Guest-writable SMB share' on 169.58.67.158:389.",
    "tags": [
      "ad",
      "smb"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:389",
    "target_name": "Active Directory",
    "asset_type": "domain_controller",
    "id": "active-directory-guest-writable-smb-share"
  },
  {
    "title": "SMB signing not required",
    "category": "smb",
    "severity": "medium",
    "owasp": "A02:2021",
    "cwe": "CWE-345",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "smbclient -m",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'SMB signing not required' on 169.58.67.158:389.",
    "tags": [
      "ad",
      "smb"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:389",
    "target_name": "Active Directory",
    "asset_type": "domain_controller",
    "id": "active-directory-smb-signing-not-required"
  },
  {
    "title": "AD DNS allows zone enumeration",
    "category": "dns_server",
    "severity": "medium",
    "owasp": "A01:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "dig axfr phantix.local",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'AD DNS allows zone enumeration' on 169.58.67.158:389.",
    "tags": [
      "ad",
      "dns"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:389",
    "target_name": "Active Directory",
    "asset_type": "domain_controller",
    "id": "active-directory-ad-dns-allows-zone-enumeration"
  },
  {
    "title": "Service account has no password expiry",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A07:2021",
    "cwe": "CWE-262",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Service account has no password expiry' on 169.58.67.158:389.",
    "tags": [
      "ad"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:389",
    "target_name": "Active Directory",
    "asset_type": "domain_controller",
    "id": "active-directory-service-account-has-no-password-expiry"
  },
  {
    "title": "Excessive number of Domain Admin members",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A01:2021",
    "cwe": "CWE-250",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "net group 'Domain Admins'",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Excessive number of Domain Admin members' on 169.58.67.158:389.",
    "tags": [
      "ad"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:389",
    "target_name": "Active Directory",
    "asset_type": "domain_controller",
    "id": "active-directory-excessive-number-of-domain-admin-members"
  },
  {
    "title": "LDAP root DSE discloses naming contexts",
    "category": "public_sensitive_exposure",
    "severity": "low",
    "owasp": "A05:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "ldapsearch -s base",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'LDAP root DSE discloses naming contexts' on 169.58.67.158:389.",
    "tags": [
      "ad",
      "ldap"
    ],
    "status": "confirmed",
    "target": "169.58.67.158:389",
    "target_name": "Active Directory",
    "asset_type": "domain_controller",
    "id": "active-directory-ldap-root-dse-discloses-naming-contexts"
  },
  {
    "title": "Gitea open user registration enabled",
    "category": "auth",
    "severity": "medium",
    "owasp": "A01:2021",
    "cwe": "CWE-16",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "GET /user/sign_up",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Gitea open user registration enabled' on https://git.revieworg.site/.",
    "tags": [
      "scm"
    ],
    "status": "confirmed",
    "target": "https://git.revieworg.site/",
    "target_name": "Gitea",
    "asset_type": "web_app",
    "id": "gitea-gitea-open-user-registration-enabled"
  },
  {
    "title": "Public repositories expose source code",
    "category": "public_sensitive_exposure",
    "severity": "medium",
    "owasp": "A01:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "GET /explore/repos",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Public repositories expose source code' on https://git.revieworg.site/.",
    "tags": [
      "scm"
    ],
    "status": "confirmed",
    "target": "https://git.revieworg.site/",
    "target_name": "Gitea",
    "asset_type": "web_app",
    "id": "gitea-public-repositories-expose-source-code"
  },
  {
    "title": "Secrets committed in repository history",
    "category": "public_sensitive_exposure",
    "severity": "high",
    "owasp": "A02:2021",
    "cwe": "CWE-798",
    "difficulty": "medium",
    "arm": "agi",
    "detection": {
      "tool": "gitleaks",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Secrets committed in repository history' on https://git.revieworg.site/.",
    "tags": [
      "scm",
      "secrets"
    ],
    "status": "confirmed",
    "target": "https://git.revieworg.site/",
    "target_name": "Gitea",
    "asset_type": "web_app",
    "id": "gitea-secrets-committed-in-repository-history"
  },
  {
    "title": "Gitea API unauthenticated repo enumeration",
    "category": "public_sensitive_exposure",
    "severity": "low",
    "owasp": "A01:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "GET /api/v1/repos/search",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Gitea API unauthenticated repo enumeration' on https://git.revieworg.site/.",
    "tags": [
      "scm"
    ],
    "status": "confirmed",
    "target": "https://git.revieworg.site/",
    "target_name": "Gitea",
    "asset_type": "web_app",
    "id": "gitea-gitea-api-unauthenticated-repo-enumeration"
  },
  {
    "title": "Gitea version with known CVEs",
    "category": "misconfiguration",
    "severity": "high",
    "owasp": "A06:2021",
    "cwe": "CWE-1104",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Gitea version with known CVEs' on https://git.revieworg.site/.",
    "tags": [
      "scm"
    ],
    "status": "confirmed",
    "target": "https://git.revieworg.site/",
    "target_name": "Gitea",
    "asset_type": "web_app",
    "id": "gitea-gitea-version-with-known-cves"
  },
  {
    "title": "Git SSH exposed on non-standard port without rate limiting",
    "category": "misconfiguration",
    "severity": "low",
    "owasp": "A07:2021",
    "cwe": "CWE-307",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "ssh -p 2222 git@169.58.67.158",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Git SSH exposed on non-standard port without rate limiting' on https://git.revieworg.site/.",
    "tags": [
      "scm"
    ],
    "status": "confirmed",
    "target": "https://git.revieworg.site/",
    "target_name": "Gitea",
    "asset_type": "web_app",
    "id": "gitea-git-ssh-exposed-on-non-standard-port-without-rate-limiting"
  },
  {
    "title": "Grafana default admin credentials",
    "category": "default_credentials",
    "severity": "critical",
    "owasp": "A07:2021",
    "cwe": "CWE-1392",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "admin/admin login",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Grafana default admin credentials' on https://grafana.revieworg.site/.",
    "tags": [
      "monitoring"
    ],
    "status": "confirmed",
    "target": "https://grafana.revieworg.site/",
    "target_name": "Grafana",
    "asset_type": "web_app",
    "id": "grafana-grafana-default-admin-credentials"
  },
  {
    "title": "Grafana anonymous access enabled",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A01:2021",
    "cwe": "CWE-306",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "GET /api/dashboards/home unauthenticated",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Grafana anonymous access enabled' on https://grafana.revieworg.site/.",
    "tags": [
      "monitoring"
    ],
    "status": "confirmed",
    "target": "https://grafana.revieworg.site/",
    "target_name": "Grafana",
    "asset_type": "web_app",
    "id": "grafana-grafana-anonymous-access-enabled"
  },
  {
    "title": "Grafana self-registration enabled",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A01:2021",
    "cwe": "CWE-16",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "GET /signup",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Grafana self-registration enabled' on https://grafana.revieworg.site/.",
    "tags": [
      "monitoring"
    ],
    "status": "confirmed",
    "target": "https://grafana.revieworg.site/",
    "target_name": "Grafana",
    "asset_type": "web_app",
    "id": "grafana-grafana-self-registration-enabled"
  },
  {
    "title": "Grafana data sources readable (potential credential leak)",
    "category": "public_sensitive_exposure",
    "severity": "high",
    "owasp": "A01:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "/api/datasources",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Grafana data sources readable (potential credential leak)' on https://grafana.revieworg.site/.",
    "tags": [
      "monitoring"
    ],
    "status": "confirmed",
    "target": "https://grafana.revieworg.site/",
    "target_name": "Grafana",
    "asset_type": "web_app",
    "id": "grafana-grafana-data-sources-readable-potential-credential-leak"
  },
  {
    "title": "Grafana SSRF via data source proxy",
    "category": "ssrf",
    "severity": "high",
    "owasp": "A10:2021",
    "cwe": "CWE-918",
    "difficulty": "medium",
    "arm": "agi",
    "detection": {
      "method": "/api/datasources/proxy",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Grafana SSRF via data source proxy' on https://grafana.revieworg.site/.",
    "tags": [
      "monitoring"
    ],
    "status": "confirmed",
    "target": "https://grafana.revieworg.site/",
    "target_name": "Grafana",
    "asset_type": "web_app",
    "id": "grafana-grafana-ssrf-via-data-source-proxy"
  },
  {
    "title": "Grafana version with known CVEs",
    "category": "misconfiguration",
    "severity": "high",
    "owasp": "A06:2021",
    "cwe": "CWE-1104",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "tool": "nuclei",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Grafana version with known CVEs' on https://grafana.revieworg.site/.",
    "tags": [
      "monitoring"
    ],
    "status": "confirmed",
    "target": "https://grafana.revieworg.site/",
    "target_name": "Grafana",
    "asset_type": "web_app",
    "id": "grafana-grafana-version-with-known-cves"
  },
  {
    "title": "Jenkins accessible without authentication",
    "category": "auth",
    "severity": "critical",
    "owasp": "A01:2021",
    "cwe": "CWE-306",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "GET / unauthenticated",
      "expected_signal": "Dashboard"
    },
    "verification": "Reproduce and capture evidence for 'Jenkins accessible without authentication' on https://jenkins.revieworg.site/.",
    "tags": [
      "ci"
    ],
    "status": "confirmed",
    "target": "https://jenkins.revieworg.site/",
    "target_name": "Jenkins",
    "asset_type": "web_app",
    "id": "jenkins-jenkins-accessible-without-authentication"
  },
  {
    "title": "Jenkins script console enables RCE",
    "category": "rce",
    "severity": "critical",
    "owasp": "A03:2021",
    "cwe": "CWE-94",
    "difficulty": "medium",
    "arm": "agi",
    "detection": {
      "method": "/script Groovy",
      "expected_signal": "Command execution"
    },
    "verification": "Reproduce and capture evidence for 'Jenkins script console enables RCE' on https://jenkins.revieworg.site/.",
    "tags": [
      "ci",
      "rce"
    ],
    "status": "confirmed",
    "target": "https://jenkins.revieworg.site/",
    "target_name": "Jenkins",
    "asset_type": "web_app",
    "id": "jenkins-jenkins-script-console-enables-rce"
  },
  {
    "title": "Jenkins credentials store readable",
    "category": "public_sensitive_exposure",
    "severity": "high",
    "owasp": "A02:2021",
    "cwe": "CWE-522",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "/credentials",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Jenkins credentials store readable' on https://jenkins.revieworg.site/.",
    "tags": [
      "ci"
    ],
    "status": "confirmed",
    "target": "https://jenkins.revieworg.site/",
    "target_name": "Jenkins",
    "asset_type": "web_app",
    "id": "jenkins-jenkins-credentials-store-readable"
  },
  {
    "title": "Jenkins exposes build logs with secrets",
    "category": "public_sensitive_exposure",
    "severity": "medium",
    "owasp": "A02:2021",
    "cwe": "CWE-532",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Jenkins exposes build logs with secrets' on https://jenkins.revieworg.site/.",
    "tags": [
      "ci"
    ],
    "status": "confirmed",
    "target": "https://jenkins.revieworg.site/",
    "target_name": "Jenkins",
    "asset_type": "web_app",
    "id": "jenkins-jenkins-exposes-build-logs-with-secrets"
  },
  {
    "title": "Jenkins agent port exposed",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A05:2021",
    "cwe": "CWE-668",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "tcp 169.58.67.158:50000",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Jenkins agent port exposed' on https://jenkins.revieworg.site/.",
    "tags": [
      "ci"
    ],
    "status": "confirmed",
    "target": "https://jenkins.revieworg.site/",
    "target_name": "Jenkins",
    "asset_type": "web_app",
    "id": "jenkins-jenkins-agent-port-exposed"
  },
  {
    "title": "Jenkins version with known CVEs",
    "category": "misconfiguration",
    "severity": "high",
    "owasp": "A06:2021",
    "cwe": "CWE-1104",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "tool": "nuclei",
      "method": "X-Jenkins header",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Jenkins version with known CVEs' on https://jenkins.revieworg.site/.",
    "tags": [
      "ci"
    ],
    "status": "confirmed",
    "target": "https://jenkins.revieworg.site/",
    "target_name": "Jenkins",
    "asset_type": "web_app",
    "id": "jenkins-jenkins-version-with-known-cves"
  },
  {
    "title": "phpLDAPadmin publicly exposed",
    "category": "misconfiguration",
    "severity": "high",
    "owasp": "A05:2021",
    "cwe": "CWE-668",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'phpLDAPadmin publicly exposed' on https://directory.revieworg.site/.",
    "tags": [
      "ldap"
    ],
    "status": "confirmed",
    "target": "https://directory.revieworg.site/",
    "target_name": "phpLDAPadmin",
    "asset_type": "web_app",
    "id": "phpldapadmin-phpldapadmin-publicly-exposed"
  },
  {
    "title": "phpLDAPadmin accepts plaintext LDAP bind",
    "category": "ldap",
    "severity": "high",
    "owasp": "A02:2021",
    "cwe": "CWE-319",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'phpLDAPadmin accepts plaintext LDAP bind' on https://directory.revieworg.site/.",
    "tags": [
      "ldap"
    ],
    "status": "confirmed",
    "target": "https://directory.revieworg.site/",
    "target_name": "phpLDAPadmin",
    "asset_type": "web_app",
    "id": "phpldapadmin-phpldapadmin-accepts-plaintext-ldap-bind"
  },
  {
    "title": "Directory tree enumerable at login",
    "category": "public_sensitive_exposure",
    "severity": "medium",
    "owasp": "A01:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Directory tree enumerable at login' on https://directory.revieworg.site/.",
    "tags": [
      "ldap"
    ],
    "status": "confirmed",
    "target": "https://directory.revieworg.site/",
    "target_name": "phpLDAPadmin",
    "asset_type": "web_app",
    "id": "phpldapadmin-directory-tree-enumerable-at-login"
  },
  {
    "title": "phpLDAPadmin version with known CVEs",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A06:2021",
    "cwe": "CWE-1104",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'phpLDAPadmin version with known CVEs' on https://directory.revieworg.site/.",
    "tags": [
      "ldap"
    ],
    "status": "confirmed",
    "target": "https://directory.revieworg.site/",
    "target_name": "phpLDAPadmin",
    "asset_type": "web_app",
    "id": "phpldapadmin-phpldapadmin-version-with-known-cves"
  },
  {
    "title": "Weak organisation mailbox passwords",
    "category": "auth",
    "severity": "high",
    "owasp": "A07:2021",
    "cwe": "CWE-521",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "IMAP login with documented weak creds",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Weak organisation mailbox passwords' on https://webmail.revieworg.site/.",
    "tags": [
      "mail"
    ],
    "status": "confirmed",
    "target": "https://webmail.revieworg.site/",
    "target_name": "Mail",
    "asset_type": "web_app",
    "id": "mail-weak-organisation-mailbox-passwords"
  },
  {
    "title": "Mail services use self-signed TLS certificate",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A02:2021",
    "cwe": "CWE-295",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "openssl s_client :993",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Mail services use self-signed TLS certificate' on https://webmail.revieworg.site/.",
    "tags": [
      "mail"
    ],
    "status": "confirmed",
    "target": "https://webmail.revieworg.site/",
    "target_name": "Mail",
    "asset_type": "web_app",
    "id": "mail-mail-services-use-self-signed-tls-certificate"
  },
  {
    "title": "IMAP plaintext/STARTTLS allowed on 143",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A02:2021",
    "cwe": "CWE-319",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'IMAP plaintext/STARTTLS allowed on 143' on https://webmail.revieworg.site/.",
    "tags": [
      "mail"
    ],
    "status": "confirmed",
    "target": "https://webmail.revieworg.site/",
    "target_name": "Mail",
    "asset_type": "web_app",
    "id": "mail-imap-plaintext-starttls-allowed-on-143"
  },
  {
    "title": "Roundcube version with known CVEs",
    "category": "misconfiguration",
    "severity": "high",
    "owasp": "A06:2021",
    "cwe": "CWE-1104",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "tool": "nuclei",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Roundcube version with known CVEs' on https://webmail.revieworg.site/.",
    "tags": [
      "mail"
    ],
    "status": "confirmed",
    "target": "https://webmail.revieworg.site/",
    "target_name": "Mail",
    "asset_type": "web_app",
    "id": "mail-roundcube-version-with-known-cves"
  },
  {
    "title": "Mail domain missing DMARC enforcement",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A05:2021",
    "cwe": "CWE-16",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "dig TXT _dmarc",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Mail domain missing DMARC enforcement' on https://webmail.revieworg.site/.",
    "tags": [
      "mail",
      "dns"
    ],
    "status": "confirmed",
    "target": "https://webmail.revieworg.site/",
    "target_name": "Mail",
    "asset_type": "web_app",
    "id": "mail-mail-domain-missing-dmarc-enforcement"
  },
  {
    "title": "SMTP user enumeration possible",
    "category": "auth",
    "severity": "medium",
    "owasp": "A07:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "VRFY/RCPT probing",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'SMTP user enumeration possible' on https://webmail.revieworg.site/.",
    "tags": [
      "mail"
    ],
    "status": "confirmed",
    "target": "https://webmail.revieworg.site/",
    "target_name": "Mail",
    "asset_type": "web_app",
    "id": "mail-smtp-user-enumeration-possible"
  },
  {
    "title": "Webmail self-registration / open access",
    "category": "misconfiguration",
    "severity": "low",
    "owasp": "A01:2021",
    "cwe": "CWE-16",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Webmail self-registration / open access' on https://webmail.revieworg.site/.",
    "tags": [
      "mail"
    ],
    "status": "confirmed",
    "target": "https://webmail.revieworg.site/",
    "target_name": "Mail",
    "asset_type": "web_app",
    "id": "mail-webmail-self-registration-open-access"
  },
  {
    "title": "Large number of lab service ports exposed",
    "category": "misconfiguration",
    "severity": "high",
    "owasp": "A05:2021",
    "cwe": "CWE-668",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "tool": "nmap",
      "method": "top ports",
      "expected_signal": "27 open services"
    },
    "verification": "Reproduce and capture evidence for 'Large number of lab service ports exposed' on 169.58.67.158.",
    "tags": [
      "host",
      "network"
    ],
    "status": "confirmed",
    "target": "169.58.67.158",
    "target_name": "Host",
    "asset_type": "linux_server",
    "id": "host-large-number-of-lab-service-ports-exposed"
  },
  {
    "title": "SSH service exposed to internet",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A05:2021",
    "cwe": "CWE-668",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "nmap 22",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'SSH service exposed to internet' on 169.58.67.158.",
    "tags": [
      "host"
    ],
    "status": "confirmed",
    "target": "169.58.67.158",
    "target_name": "Host",
    "asset_type": "linux_server",
    "id": "host-ssh-service-exposed-to-internet"
  },
  {
    "title": "Weak sysctl hardening (source routing, syncookies)",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A05:2021",
    "cwe": "CWE-16",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Weak sysctl hardening (source routing, syncookies)' on 169.58.67.158.",
    "tags": [
      "host"
    ],
    "status": "expected",
    "target": "169.58.67.158",
    "target_name": "Host",
    "asset_type": "linux_server",
    "id": "host-weak-sysctl-hardening-source-routing-syncookies"
  },
  {
    "title": "No automatic security updates configured",
    "category": "misconfiguration",
    "severity": "low",
    "owasp": "A06:2021",
    "cwe": "CWE-1104",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'No automatic security updates configured' on 169.58.67.158.",
    "tags": [
      "host"
    ],
    "status": "expected",
    "target": "169.58.67.158",
    "target_name": "Host",
    "asset_type": "linux_server",
    "id": "host-no-automatic-security-updates-configured"
  },
  {
    "title": "Unauthenticated services present on host",
    "category": "misconfiguration",
    "severity": "high",
    "owasp": "A07:2021",
    "cwe": "CWE-306",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Unauthenticated services present on host' on 169.58.67.158.",
    "tags": [
      "host"
    ],
    "status": "confirmed",
    "target": "169.58.67.158",
    "target_name": "Host",
    "asset_type": "linux_server",
    "id": "host-unauthenticated-services-present-on-host"
  },
  {
    "title": "Exposed .env with database credentials",
    "category": "public_sensitive_exposure",
    "severity": "critical",
    "owasp": "A05:2021",
    "cwe": "CWE-538",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "tool": "nuclei",
      "method": "GET /.env",
      "expected_signal": "DB creds in body"
    },
    "verification": "Reproduce and capture evidence for 'Exposed .env with database credentials' on https://crapi.revieworg.site/.",
    "tags": [
      "api",
      "exposure"
    ],
    "status": "confirmed",
    "target": "https://crapi.revieworg.site/",
    "target_name": "crAPI",
    "asset_type": "api",
    "id": "crapi-exposed-env-with-database-credentials"
  },
  {
    "title": "Exposed application configuration file",
    "category": "public_sensitive_exposure",
    "severity": "high",
    "owasp": "A05:2021",
    "cwe": "CWE-538",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "GET /config",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Exposed application configuration file' on https://crapi.revieworg.site/.",
    "tags": [
      "api",
      "exposure"
    ],
    "status": "confirmed",
    "target": "https://crapi.revieworg.site/",
    "target_name": "crAPI",
    "asset_type": "api",
    "id": "crapi-exposed-application-configuration-file"
  },
  {
    "title": "Broken object level authorization on vehicle location",
    "category": "idor",
    "severity": "high",
    "owasp": "A01:2021",
    "cwe": "CWE-639",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "GET /identity/api/v2/vehicle/{id}/location",
      "expected_signal": "Other user's vehicle"
    },
    "verification": "Reproduce and capture evidence for 'Broken object level authorization on vehicle location' on https://crapi.revieworg.site/.",
    "tags": [
      "api",
      "bola"
    ],
    "status": "confirmed",
    "target": "https://crapi.revieworg.site/",
    "target_name": "crAPI",
    "asset_type": "api",
    "id": "crapi-broken-object-level-authorization-on-vehicle-location"
  },
  {
    "title": "Broken object level authorization on community posts",
    "category": "idor",
    "severity": "high",
    "owasp": "A01:2021",
    "cwe": "CWE-639",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "POST /community/api/v2/community/posts",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Broken object level authorization on community posts' on https://crapi.revieworg.site/.",
    "tags": [
      "api",
      "bola"
    ],
    "status": "confirmed",
    "target": "https://crapi.revieworg.site/",
    "target_name": "crAPI",
    "asset_type": "api",
    "id": "crapi-broken-object-level-authorization-on-community-posts"
  },
  {
    "title": "Broken function level authorization on admin endpoint",
    "category": "auth",
    "severity": "critical",
    "owasp": "A01:2021",
    "cwe": "CWE-285",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "GET /identity/api/v2/admin/* as user",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Broken function level authorization on admin endpoint' on https://crapi.revieworg.site/.",
    "tags": [
      "api",
      "bfla"
    ],
    "status": "confirmed",
    "target": "https://crapi.revieworg.site/",
    "target_name": "crAPI",
    "asset_type": "api",
    "id": "crapi-broken-function-level-authorization-on-admin-endpoint"
  },
  {
    "title": "JWT algorithm confusion allows forged token",
    "category": "auth",
    "severity": "critical",
    "owasp": "A02:2021",
    "cwe": "CWE-347",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "RS256->HS256 with public key",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'JWT algorithm confusion allows forged token' on https://crapi.revieworg.site/.",
    "tags": [
      "api",
      "jwt"
    ],
    "status": "confirmed",
    "target": "https://crapi.revieworg.site/",
    "target_name": "crAPI",
    "asset_type": "api",
    "id": "crapi-jwt-algorithm-confusion-allows-forged-token"
  },
  {
    "title": "JWT signed with weak secret",
    "category": "auth",
    "severity": "high",
    "owasp": "A02:2021",
    "cwe": "CWE-798",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "crack token secret",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'JWT signed with weak secret' on https://crapi.revieworg.site/.",
    "tags": [
      "api",
      "jwt"
    ],
    "status": "confirmed",
    "target": "https://crapi.revieworg.site/",
    "target_name": "crAPI",
    "asset_type": "api",
    "id": "crapi-jwt-signed-with-weak-secret"
  },
  {
    "title": "Mass assignment on user profile update",
    "category": "auth",
    "severity": "high",
    "owasp": "A01:2021",
    "cwe": "CWE-915",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "method": "PUT extra role/credit fields",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Mass assignment on user profile update' on https://crapi.revieworg.site/.",
    "tags": [
      "api"
    ],
    "status": "confirmed",
    "target": "https://crapi.revieworg.site/",
    "target_name": "crAPI",
    "asset_type": "api",
    "id": "crapi-mass-assignment-on-user-profile-update"
  },
  {
    "title": "Excessive data exposure in API responses",
    "category": "public_sensitive_exposure",
    "severity": "medium",
    "owasp": "A01:2021",
    "cwe": "CWE-213",
    "difficulty": "medium",
    "arm": "ai",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Excessive data exposure in API responses' on https://crapi.revieworg.site/.",
    "tags": [
      "api"
    ],
    "status": "confirmed",
    "target": "https://crapi.revieworg.site/",
    "target_name": "crAPI",
    "asset_type": "api",
    "id": "crapi-excessive-data-exposure-in-api-responses"
  },
  {
    "title": "CORS misconfiguration allows credential theft",
    "category": "cors",
    "severity": "high",
    "owasp": "A05:2021",
    "cwe": "CWE-942",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "Origin reflection with credentials",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'CORS misconfiguration allows credential theft' on https://crapi.revieworg.site/.",
    "tags": [
      "api"
    ],
    "status": "confirmed",
    "target": "https://crapi.revieworg.site/",
    "target_name": "crAPI",
    "asset_type": "api",
    "id": "crapi-cors-misconfiguration-allows-credential-theft"
  },
  {
    "title": "SSRF via workshop contact mechanic",
    "category": "ssrf",
    "severity": "high",
    "owasp": "A10:2021",
    "cwe": "CWE-918",
    "difficulty": "medium",
    "arm": "agi",
    "detection": {
      "method": "POST mechanic report with URL",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'SSRF via workshop contact mechanic' on https://crapi.revieworg.site/.",
    "tags": [
      "api",
      "ssrf"
    ],
    "status": "confirmed",
    "target": "https://crapi.revieworg.site/",
    "target_name": "crAPI",
    "asset_type": "api",
    "id": "crapi-ssrf-via-workshop-contact-mechanic"
  },
  {
    "title": "OTP brute force / no rate limiting on password reset",
    "category": "auth",
    "severity": "high",
    "owasp": "A07:2021",
    "cwe": "CWE-307",
    "difficulty": "medium",
    "arm": "agi",
    "detection": {
      "method": "Repeated OTP attempts",
      "expected_signal": "4-digit OTP enumerable"
    },
    "verification": "Reproduce and capture evidence for 'OTP brute force / no rate limiting on password reset' on https://crapi.revieworg.site/.",
    "tags": [
      "api",
      "otp"
    ],
    "status": "confirmed",
    "target": "https://crapi.revieworg.site/",
    "target_name": "crAPI",
    "asset_type": "api",
    "id": "crapi-otp-brute-force-no-rate-limiting-on-password-reset"
  },
  {
    "title": "Coupon redemption abuse",
    "category": "business_logic",
    "severity": "medium",
    "owasp": "A04:2021",
    "cwe": "CWE-840",
    "difficulty": "medium",
    "arm": "agi",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Coupon redemption abuse' on https://crapi.revieworg.site/.",
    "tags": [
      "api",
      "business_logic"
    ],
    "status": "confirmed",
    "target": "https://crapi.revieworg.site/",
    "target_name": "crAPI",
    "asset_type": "api",
    "id": "crapi-coupon-redemption-abuse"
  },
  {
    "title": "Video/mechanic endpoint accepts unauthenticated writes",
    "category": "auth",
    "severity": "medium",
    "owasp": "A01:2021",
    "cwe": "CWE-306",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'Video/mechanic endpoint accepts unauthenticated writes' on https://crapi.revieworg.site/.",
    "tags": [
      "api"
    ],
    "status": "confirmed",
    "target": "https://crapi.revieworg.site/",
    "target_name": "crAPI",
    "asset_type": "api",
    "id": "crapi-video-mechanic-endpoint-accepts-unauthenticated-writes"
  },
  {
    "title": "MailHog public messages API discloses email and OTP",
    "category": "public_sensitive_exposure",
    "severity": "high",
    "owasp": "A01:2021",
    "cwe": "CWE-200",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "tool": "nuclei",
      "method": "GET /api/v2/messages",
      "expected_signal": "Message bodies with OTP"
    },
    "verification": "Reproduce and capture evidence for 'MailHog public messages API discloses email and OTP' on https://mailhog.revieworg.site/.",
    "tags": [
      "mail",
      "otp"
    ],
    "status": "confirmed",
    "target": "https://mailhog.revieworg.site/",
    "target_name": "MailHog",
    "asset_type": "web_app",
    "id": "mailhog-mailhog-public-messages-api-discloses-email-and-otp"
  },
  {
    "title": "MailHog UI publicly exposed",
    "category": "misconfiguration",
    "severity": "medium",
    "owasp": "A05:2021",
    "cwe": "CWE-668",
    "difficulty": "medium",
    "arm": "engines",
    "detection": {
      "method": "GET / unauthenticated",
      "expected_signal": "observable evidence (response, error, or state change)"
    },
    "verification": "Reproduce and capture evidence for 'MailHog UI publicly exposed' on https://mailhog.revieworg.site/.",
    "tags": [
      "mail"
    ],
    "status": "confirmed",
    "target": "https://mailhog.revieworg.site/",
    "target_name": "MailHog",
    "asset_type": "web_app",
    "id": "mailhog-mailhog-ui-publicly-exposed"
  }
]