Plugin Registry21 active·3 disabled·10 findings
| Plugin | Category | Severity | CWE | OWASP | Payloads | Findings | Status | |
|---|---|---|---|---|---|---|---|---|
| SQL Injection | Injection | Critical | CWE-89 | A03 | 48 | 1 | Active | |
| XSS (Reflected) | Client-Side | High | CWE-79 | A03 | 32 | — | Active | |
| XSS (Stored) | Client-Side | Critical | CWE-79 | A03 | 12 | 1 | Active | |
| XSS (DOM-Based) | Client-Side | High | CWE-79 | A03 | 18 | — | Active | |
| SSRF | Server-Side | Critical | CWE-918 | A10 | 20 | 1 | Active | |
| XML External Entity (XXE) | Injection | Critical | CWE-611 | A05 | 8 | — | Active | |
| Server-Side Template Injection | Injection | Critical | CWE-94 | A03 | 24 | — | Active | |
| Command Injection | Injection | Critical | CWE-78 | A03 | 16 | — | Active | |
| Path Traversal / LFI | Server-Side | High | CWE-22 | A01 | 20 | 1 | Active | |
| BOLA / IDOR | Authorization | High | CWE-639 | A01 | 12 | 2 | Active | |
| CSRF | Client-Side | Medium | CWE-352 | A01 | 6 | — | Active | |
| JWT Security | Auth | High | CWE-347 | A02 | 8 | 1 | Active | |
| CORS Misconfiguration | Configuration | High | CWE-346 | A05 | 10 | 1 | Active | |
| Security Headers | Configuration | Medium | CWE-16 | A05 | — | 1 | Active | |
| Authentication Weakness | Auth | High | CWE-287 | A02 | 14 | — | Active | |
| OAuth / OIDC Security | Auth | High | CWE-601 | A02 | 8 | — | Active | |
| Open Redirect | Server-Side | Medium | CWE-601 | A03 | 12 | — | Active | |
| Mass Assignment | Logic | High | CWE-915 | A03 | 6 | 1 | Active | |
| Rate Limiting | Logic | Medium | CWE-770 | A04 | — | — | Active | |
| File Upload Security | Server-Side | High | CWE-434 | A04 | 12 | — | Disabled | |
| WebSocket Security | API | Medium | CWE-116 | A08 | 8 | — | Disabled | |
| GraphQL Security | API | High | CWE-285 | A01 | 10 | — | Active | |
| Prototype Pollution | Client-Side | High | CWE-1321 | A08 | 8 | — | Disabled | |
| TLS / SSL Security | Configuration | Medium | CWE-326 | A02 | — | — | Active |
SQL Injection
InjectionCriticalCWE-89OWASP A03
48
Payload Vectors
1
Live Findings
Verified
Verdict Confidence
Execution Settings
Sensitivity:
Input Context
Request + baseline response
Detection Logic
Inject UNION/Boolean/Time/Error payloads. Compare response size, timing, error content.
Diagnostic Output
Finding + SQL error evidence + reproduction
Injection Vectors
querybody-jsonbody-formpath
Mutation Pattern Samples
' OR 1=1--
1' UNION SELECT null, username, password FROM users--
'; WAITFOR DELAY '0:0:5'--
admin' AND 1=2--
Dry Run Simulator
Target:
Click "Simulate Check" to trace execution path live