Authorized scanner testing only. All data in these routes is synthetic.

Vulnerability catalog

Injection

SQLi numeric/string/auth/error/union, Boolean blind, time blind, second-order SQLi, NoSQL injection, LDAP injection, bounded command oracle

Reflected/stored/DOM XSS, global XSS through lab_banner, clickjacking, missing headers, JSONP injection

IDOR, BOLA, excessive data exposure, mass assignment, unsigned JWT, predictable reset tokens

Bounded SSRF with public OAST support, XXE against synthetic secrets, path traversal, unrestricted file upload, SSTI

CSRF-disabled transfer, race-prone balance update, no rate limit, weak/default credentials

Host-header reset poisoning, cache poisoning oracle, permissive credentialed CORS, debug/config disclosure

Global reflected-XSS probe: append ?lab_banner=<svg/onload=alert(1)> to almost any HTML page.