Back to Engine Brain DAST ScannerSynced with Engine Brain Target Scope: https://demo.testfire.net
🎯 ENTERPRISE DAST VULNERABILITY MANAGEMENT● LIVE SOURCE: ENGINE BRAIN DAST (5 FINDINGS)0–100 DAST RISK SCORE + CISA KEV + EPSS
XTRIKE™ & Aegis.SOC™ — Enterprise DAST Vulnerability Management & Risk Prioritization Center
Directly powered by live Engine Brain DAST Penetration Testing telemetry across
https://demo.testfire.net — uniting Application Context, Crown Jewels, Configurable 0–100 Risk Scoring, Proof Screenshots, Two-Way Ticket Sync, and Automated Retests.Prioritized Remediation Queue (5 Findings)
Ranked by 0–100 contextual risk score (fusing severity, exploitability, application criticality, EPSS, and CISA KEV). Click any row to inspect full evidence.
#1 · DAST-WEB-2026-001Privilege Escalation — Forged SuperAdmin JWT & SUID ElevationCWE-287T1548 · Privilege EscalationCISA KEV · EPSS 94.2%
Application: demo.testfire.net — Primary Web Interface & API Target (Engine Brain)·Endpoint:
POST https://demo.testfire.net/api/admin/rbac/elevate·CVSS: 9.9100/100
Critical
#2 · DAST-WEB-2026-002Unauthenticated SQL Injection (SQLi) in Web Login Authentication HandlerCWE-89T1190 · Initial AccessCISA KEV · EPSS 94.2%
Application: demo.testfire.net — Primary Web Interface & API Target (Engine Brain)·Endpoint:
POST https://demo.testfire.net/doLogin (param: uid)·CVSS: 9.8100/100
Critical
#3 · DAST-WEB-2026-003Reflected Cross-Site Scripting (XSS) & Missing Content-Security-Policy (CSP)CWE-79T1059.007 · Execution
Application: demo.testfire.net — Primary Web Interface & API Target (Engine Brain)·Endpoint:
GET https://demo.testfire.net/search.jsp?query=·CVSS: 3.1100/100
Critical
#4 · DAST-WEB-2026-004Broken Object Level Authorization (BOLA / IDOR) on Account Transaction APICWE-639T1213 · Collection
Application: demo.testfire.net — REST & GraphQL API Gateway (/api/admin/rbac & /graphql)·Endpoint:
GET https://demo.testfire.net/api/account/800001/transactions·CVSS: 3.1100/100
Critical
#5 · DAST-WEB-2026-005Cross-Origin Resource Sharing (CORS) Arbitrary Origin Reflection & Missing HSTSCWE-942T1539 · Credential Access
Application: demo.testfire.net — Primary Web Interface & API Target (Engine Brain)·Endpoint:
OPTIONS https://demo.testfire.net/api/v1/profile·CVSS: 9.879/100
High
⚙️ Configure Risk Scoring Weights & View CVSS Comparison Formula (Severity 40% · Confidence 25% · App Criticality 20% · Exposure 15%)Expand ▾
Risk Score Weights
Severity Weight40%
Exploitability / Confidence25%
Application Criticality20%
Exposure Weight15%
Contextual Risk Score (0–100) vs. Pure CVSS
| Finding | Pure CVSS | Risk Score | Context Drivers |
|---|---|---|---|
| DAST-WEB-2026-001 | 9.9 | 100/100 | EPSS 94.2% · CISA KEV |
| DAST-WEB-2026-002 | 9.8 | 100/100 | EPSS 94.2% · CISA KEV |
| DAST-WEB-2026-003 | 3.1 | 100/100 | EPSS 78.6% |
| DAST-WEB-2026-004 | 3.1 | 100/100 | EPSS 78.6% |
| DAST-WEB-2026-005 | 9.8 | 79/100 | EPSS 41.5% |