TaintedPort v1.0

Compare Scans
Description
Intentionally vulnerable wine store application for security testing. Built with PHP backend + Next.js frontend + SQLite database.
URL
https://taintedport.com
Tech Stack
Docker Next.js Nginx PHP SQLite
Created by
nuno
Visibility
public
Scans
2 scans

Vulnerabilities (28)

7
critical
10
high
9
medium
2
low
ID Title Severity Type Location
TP-005 Blind SQL Injection - Order Status Filter critical SQLi /orders
TP-023 Privilege Escalation via JWT Claim Forgery critical Privilege Escalation /admin/*
TP-022 Privilege Escalation via Mass Assignment on Registration critical Privilege Escalation /auth/register
TP-001 SQL Injection - Login Email critical SQLi /auth/login
TP-002 SQL Injection - Wine Detail (ID in URL) critical SQLi /wines/:id
TP-004 SQL Injection - Wine Reviews critical SQLi /wines/:id/reviews
TP-003 SQL Injection - Wine Search critical SQLi /wines
TP-025 BFLA - Broken Function Level Authorization on Order Status high Broken Access Control /orders/:id/status
TP-017 BOLA (IDOR) on Order Details high IDOR /orders/:id
TP-018 BOLA / Mass Assignment on Profile Update high IDOR /auth/profile
TP-024 BOPLA - Excessive Data Exposure on Order Details high Data Exposure /orders/:id
TP-020 Broken Access Control on 2FA Disable high Broken Access Control /auth/2fa/disable
TP-021 Discount Code Bypass high Business Logic /orders
TP-011 JWT 'none' Algorithm Accepted high Broken Authentication /*
TP-012 JWT Signature Not Verified high Broken Authentication /*
TP-014 Path Traversal - Wine Export high Path Traversal /wines/export/:filename
TP-019 Price Manipulation on Cart high Business Logic /cart/add
TP-013 Directory Listing low Information Disclosure /files/
TP-016 Missing Security Headers low Security Misconfiguration /*
PRBL01 CORS medium CORS /wines
PRBL02 Deprecated TLS version medium Deprecated TLS version /
TP-015 Open Redirect on Login medium Open Redirect /auth/login
TP-006 Reflected XSS - Login Email medium XSS /auth/login
TP-007 Reflected XSS - Wine Search medium XSS /wines
TP-009 Stored XSS - Shipping Name (Checkout) medium XSS /orders
TP-008 Stored XSS - User Name (Profile) medium XSS /auth/profile
TP-010 Stored XSS - Wine Review Comment medium XSS /wines/:id/reviews
PRBL03 Weak Ciphers medium Weak Ciphers /