Labs

A logs endpoint reads files by name from a logs directory without path sanitization, allowing traversal.

A PHP auth endpoint concatenates user input into SQL and uses md5 for passwords.

A Spring inventory service constructs a SQL query with string concatenation, allowing SQL injection.

A receipt rendering endpoint fetches a user-provided URL, enabling server-side request forgery.

A payments microservice exposes a user search endpoint that trusts a JSON filter from the query string, enabling NoSQL injection.