⚠ Sandboxed environment — This is an intentionally vulnerable application running inside an isolated Docker container with fake data. Nothing you do here can harm the host machine or other users.

A05 – Injection

OWASP A05:2025 CWE-89 CWE-78 CWE-79

Injection is a single idea — user data is treated as code by an interpreter. The interpreter changes (SQL engine, shell, browser), the bug pattern is identical.

CWE-89 SQL Injection CWE-78 OS Command Injection CWE-79 Reflected XSS
CWE-79 Cross-Site Scripting (Reflected XSS)

A search page echoes the query into the HTML without escaping. <script> in the input becomes a real <script> in the rendered page.

Vulnerable code:
return f"<p>You searched for: {q}</p>"   # q never escaped

Try it yourself

Search normally

Type hello — your query is echoed back as text.

Inject a script

Type <script>alert('XSS')</script> — the browser runs the script.