Security Alerts (Vulnerabilities Index)
- 0Directory BrowsingMedium
- 2Private IP DisclosureLow
- 3-1Session ID in URL RewriteMedium
- 3-2Session ID in URL RewriteMedium
- 3-3Referer Exposes Session IDMedium
- 6-1Path TraversalHigh
- 6-2Path TraversalHigh
- 6-3Path TraversalHigh
- 6-4Path TraversalHigh
- 6-5Path TraversalHigh
- 1
- 2
- 3
- 4
- 5
- 6
- 23
Understanding Security Scanner Alerts: 3 Key Questions
What the alerts on this page mean
Every finding listed here comes from a web security scan and describes one weakness found on a site — from cross-site scripting (XSS) and SQL injection to missing security headers and unsafe SSL/TLS settings. High-risk alerts indicate vulnerabilities an attacker can likely exploit, while medium and low alerts flag hardening opportunities. Reviewing the list gives a practical map of where a website is most exposed.
How to prioritize alerts by risk level
Start with High-risk items, because they are the easiest for attackers to turn into real damage — stored or reflected XSS, SQL injection, or exposed credentials. Medium-risk findings such as missing anti-clickjacking headers and weak cache-control settings should be scheduled next, then low-risk information disclosures such as version banners. Fixing in risk order keeps effort proportional to actual exposure.
Which alerts you can fix yourself
Several common alerts are configuration fixes, not code changes. Adding security headers like Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options is usually a few lines in the server or CDN config. Directory-browsing and information-disclosure alerts often close with a simple access rule. For application-level issues such as SQL injection, involve your developer or use the remediation notes in each alert page.
A security scan alert is a signal to act, not a verdict. Work through alerts from highest risk down, fix what the configuration allows, and re-scan to confirm each issue is gone before moving on.
Frequently Asked Questions (FAQ)
Security scanners group findings by risk and by category. Common categories include injection flaws such as SQL injection, cross-site scripting (XSS), missing security headers, SSL/TLS misconfigurations, information disclosure, and directory browsing. On this page each alert shows its risk level so you can tell critical issues from hardening items.
An alert means the scanner detected a weakness on your site that an attacker might use. It is a signal to investigate and fix, not a sign the site is already compromised. Work through alerts by risk level, and re-scan after fixing to confirm each issue is resolved.
Most security header alerts are configuration fixes. Add the recommended header — such as Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, or Referrer-Policy — in your web server or CDN configuration, then re-scan to confirm it is gone.