Mathias Tausig

The web application contains a stored cross-site scripting (XSS) flaw within the assets function. Stored XSS occurs when an application receives data from a user and includes that data within its later HTTP responses in an unsafe way, allowing a malicious script to be permanently stored on the server.

The logout functionality is ineffective, allowing stolen session cookies to be misused for an extended period.

The web application fails to protect its Multi-Factor Authentication (MFA) validation process against brute-force attacks, which occur when an attacker systematically tries all possible combinations of a password or code until the correct one is found.

The web application contains a stored cross-site scripting (XSS) flaw within the custom attributes function. Stored XSS occurs when an application receives data from a user and includes that data within its later HTTP responses in an unsafe way, allowing a malicious script to be permanently stored on the server.

The web application contains a stored cross-site scripting (XSS) flaw within the datastore upload function. Stored XSS occurs when an application receives data from a user and includes that data within its later HTTP responses in an unsafe way, allowing a malicious script to be permanently stored on the server.

The web application does not protect its user authentication process against brute-force attacks, which are trial-and-error methods used to guess login credentials.