The response contains Personally Identifiable Information, such as CC number, SSN and similar sensitive data.
", "endpoint": null, "raw": { "pluginid": "10062", "alertRef": "10062", "alert": "PII Disclosure", "name": "PII Disclosure", "riskcode": "3", "confidence": "2", "riskdesc": "High (Medium)", "desc": "The response contains Personally Identifiable Information, such as CC number, SSN and similar sensitive data.
", "instances": [ { "id": "118", "uri": "https://fancam.com/wp-json/wp/v2/pages/8690", "nodeName": "https://fancam.com/wp-json/wp/v2/pages/8690", "method": "GET", "param": "", "attack": "", "evidence": "500 408 258 167", "otherinfo": "Credit Card Type detected: Maestro" } ], "count": "1", "systemic": false, "solution": "Check the response for the potential presence of personally identifiable information (PII), ensure nothing sensitive is leaked by the application.
", "otherinfo": "Credit Card Type detected: Maestro
", "reference": "", "cweid": "359", "wascid": "13", "sourceid": "465" } }, { "tool": "zap", "type": "web", "severity": "high", "title": "Vulnerable JS Library", "description": "The identified library appears to be vulnerable.
", "endpoint": null, "raw": { "pluginid": "10003", "alertRef": "10003", "alert": "Vulnerable JS Library", "name": "Vulnerable JS Library", "riskcode": "3", "confidence": "2", "riskdesc": "High (Medium)", "desc": "The identified library appears to be vulnerable.
", "instances": [ { "id": "116", "uri": "https://fancam.com/wp-content/plugins/qi-addons-for-elementor/assets/plugins/swiper/8.4.5/swiper.min.js?ver=8.4.5", "nodeName": "https://fancam.com/wp-content/plugins/qi-addons-for-elementor/assets/plugins/swiper/8.4.5/swiper.min.js (ver)", "method": "GET", "param": "", "attack": "", "evidence": "/swiper/8.4.5/swiper", "otherinfo": "The identified library swiper, version 8.4.5 is vulnerable.\nCVE-2026-27212\nhttps://github.com/nolimits4web/swiper/security/advisories/GHSA-hmx5-qpq5-p643\nhttps://github.com/nolimits4web/swiper/commit/d3e663322a13043ca63aaba235d8cf3900e0c8cf\nhttps://github.com/nolimits4web/swiper/releases/tag/v12.1.2\n" } ], "count": "1", "systemic": false, "solution": "Upgrade to the latest version of the affected library.
", "otherinfo": "The identified library swiper, version 8.4.5 is vulnerable.
CVE-2026-27212
https://github.com/nolimits4web/swiper/security/advisories/GHSA-hmx5-qpq5-p643
https://github.com/nolimits4web/swiper/commit/d3e663322a13043ca63aaba235d8cf3900e0c8cf
https://github.com/nolimits4web/swiper/releases/tag/v12.1.2
", "reference": "https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/
", "cweid": "1395", "wascid": "-1", "sourceid": "474" } }, { "tool": "zap", "type": "web", "severity": "medium", "title": "Absence of Anti-CSRF Tokens", "description": "No Anti-CSRF tokens were found in a HTML submission form.
A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast, cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf.
CSRF attacks are effective in a number of situations, including:
* The victim has an active session on the target site.
* The victim is authenticated via HTTP auth on the target site.
* The victim is on the same local network as the target site.
CSRF has primarily been used to perform an action against a target site using the victim's privileges, but recent techniques have been discovered to disclose information by gaining access to the response. The risk of information disclosure is dramatically increased when the target site is vulnerable to XSS, because XSS can be used as a platform for CSRF, allowing the attack to operate within the bounds of the same-origin policy.
", "endpoint": null, "raw": { "pluginid": "10202", "alertRef": "10202", "alert": "Absence of Anti-CSRF Tokens", "name": "Absence of Anti-CSRF Tokens", "riskcode": "2", "confidence": "1", "riskdesc": "Medium (Low)", "desc": "No Anti-CSRF tokens were found in a HTML submission form.
A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast, cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf.
CSRF attacks are effective in a number of situations, including:
* The victim has an active session on the target site.
* The victim is authenticated via HTTP auth on the target site.
* The victim is on the same local network as the target site.
CSRF has primarily been used to perform an action against a target site using the victim's privileges, but recent techniques have been discovered to disclose information by gaining access to the response. The risk of information disclosure is dramatically increased when the target site is vulnerable to XSS, because XSS can be used as a platform for CSRF, allowing the attack to operate within the bounds of the same-origin policy.
", "instances": [ { "id": "80", "uri": "https://fancam.com/contact-us/", "nodeName": "https://fancam.com/contact-us/", "method": "GET", "param": "", "attack": "", "evidence": "