Bugsy

DEMO
Back to Marketing
DU

Demo User

demo@acmebank.com

Back to Projects

Payment Gateway API

Core payment processing API handling credit card transactions and ACH payments

Project Details

Repository
github.com/acmebank/payment-gateway
Framework
FastAPI
Languages
PythonJavaScript
Last Scan
4/16/2024
completed

Security Findings

3
Critical
4
High
5
Medium
2
Low
14
Total Findings

Security Findings (14 of 14)

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

critical
src/auth/login.ts:15
Injection Attack
87% confidence

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

critical
src/auth/login.ts:15
Injection Attack
94% confidence

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

critical
src/auth/login.ts:15
Injection Attack
71% confidence

Cross-Site Scripting (XSS) in User Profile Display

Rendering unsanitized user input directly into DOM allows script injection attacks. Attackers can steal session cookies, perform unauthorized actions, or redirect users to malicious sites.

high
components/UserProfile.tsx:23
Cross-Site Scripting
78% confidence

Cross-Site Scripting (XSS) in User Profile Display

Rendering unsanitized user input directly into DOM allows script injection attacks. Attackers can steal session cookies, perform unauthorized actions, or redirect users to malicious sites.

high
components/UserProfile.tsx:23
Cross-Site Scripting
85% confidence

Cross-Site Scripting (XSS) in User Profile Display

Rendering unsanitized user input directly into DOM allows script injection attacks. Attackers can steal session cookies, perform unauthorized actions, or redirect users to malicious sites.

high
components/UserProfile.tsx:23
Cross-Site Scripting
92% confidence

Cross-Site Scripting (XSS) in User Profile Display

Rendering unsanitized user input directly into DOM allows script injection attacks. Attackers can steal session cookies, perform unauthorized actions, or redirect users to malicious sites.

high
components/UserProfile.tsx:23
Cross-Site Scripting
99% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
76% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
83% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
90% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
97% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
74% confidence

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

low
src/auth/login.ts:15
Injection Attack
81% confidence

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

low
src/auth/login.ts:15
Injection Attack
88% confidence