15 vulnerabilities · indexed and runnable

The search q parameter is concatenated directly into the SQL query with no parameter binding. A quote ends the string literal.

The name parameter on /greet is rendered as template source, so both HTML and Jinja2 expressions execute.

The host parameter is passed to sh -c "ping -c 3 {host}" without escaping. Semicolons and pipes run arbitrary commands.

The file parameter is joined to /app/files/ with no check for .. sequences. Read any accessible file.

The url parameter is passed to Flask's redirect() with no validation. External URLs work just as well.

The /api/import endpoint parses XML with resolve_entities=True, allowing entity expansion and file disclosure.

/api/orders/{id} returns any order by id alone, never checking if you own it. Try any integer: 1, 2, 3, 10, 100.

/admin requires no login and dumps the full user and order table. It is also listed in robots.txt under Disallow as a hint.

/.env and /backup.zip are routed endpoints that serve fake secrets. Real apps expose these accidentally.

/boom raises an error and renders the full Python traceback as HTML. Production code leaks these in 500 responses.