Code Security Report: 20 high severity findings, 33 total findings [AltoroJ-3.2]

[mend-for-github-com]

Code Security Report

Scan Metadata

Latest Scan: 2026-04-07 10:40am
Total Findings: 33 | New Findings: 0 | Resolved Findings: 0
Tested Project Files: 63
Detected Programming Languages: 2 (Java*, JavaScript / TypeScript*)

• Check this box to manually trigger a scan

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

Most Relevant Findings

The list below presents the 10 most relevant findings that need your attention. To view information on the remaining findings, navigate to the Mend Application.

Severity	Vulnerability Type	CWE	File	Data Flows	Detected
High	Cross-Site Scripting	CWE-79	feedbacksuccess.jsp:48	1	2026-04-07 10:40am
Vulnerable Code engine-handler-23529/WebContent/feedbacksuccess.jsp Lines 43 to 48 in 44afb8a <% String email = (String) request.getParameter("email_addr"); boolean regExMatch = email!=null && email.matches(ServletUtil.EMAIL_REGEXP); if (email != null && email.trim().length() != 0 && regExMatch) {%> Our reply will be sent to your email: <%= ServletUtil.sanitzieHtmlWithRegex(email.toLowerCase())/*ServletUtil.sanitizeWeb(email.toLowerCase())*/%> <% } else {%> However, the email you gave is incorrect (<%=ServletUtil.sanitzieHtmlWithRegex(email.toLowerCase()) /*ServletUtil.sanitizeWeb(email.toLowerCase())*/%>) and you will not receive a response. 1 Data Flow/s detected engine-handler-23529/WebContent/feedbacksuccess.jsp Line 43 in 44afb8a <% String email = (String) request.getParameter("email_addr"); engine-handler-23529/WebContent/feedbacksuccess.jsp Line 48 in 44afb8a However, the email you gave is incorrect (<%=ServletUtil.sanitzieHtmlWithRegex(email.toLowerCase()) /*ServletUtil.sanitizeWeb(email.toLowerCase())*/%>) and you will not receive a response. engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java Line 249 in 44afb8a public static String sanitzieHtmlWithRegex(String input) { engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java Line 253 in 44afb8a return input; engine-handler-23529/WebContent/feedbacksuccess.jsp Line 48 in 44afb8a However, the email you gave is incorrect (<%=ServletUtil.sanitzieHtmlWithRegex(email.toLowerCase()) /*ServletUtil.sanitizeWeb(email.toLowerCase())*/%>) and you will not receive a response. Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Cross-Site Scripting Training ● Videos    ▪ Secure Code Warrior Cross-Site Scripting Video Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.
High	Cross-Site Scripting	CWE-79	queryxpath.jsp:36	1	2026-04-07 10:40am
Vulnerable Code engine-handler-23529/WebContent/bank/queryxpath.jsp Lines 31 to 36 in 44afb8a <h1>Search News Articles</h1> <form id="QueryXpath" method="get" action="<%=request.getRequestURL()%>"> Search our news articles database <br /><br /> <input type="hidden" id=content" name="content" value="queryxpath.jsp"/> <input type="text" id="query" name="query" width=450 value="<%=(request.getParameter("query")==null)?"Enter title (e.g. Watchfire)":request.getParameter("query")%>"/> 1 Data Flow/s detected engine-handler-23529/WebContent/bank/queryxpath.jsp Line 36 in 44afb8a <input type="text" id="query" name="query" width=450 value="<%=(request.getParameter("query")==null)?"Enter title (e.g. Watchfire)":request.getParameter("query")%>"/> Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Cross-Site Scripting Training ● Videos    ▪ Secure Code Warrior Cross-Site Scripting Video Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.
High	Cross-Site Scripting	CWE-79	search.jsp:44	1	2026-04-07 10:40am
Vulnerable Code engine-handler-23529/WebContent/search.jsp Lines 39 to 44 in 44afb8a <h1>Search Results</h1> <p>No results were found for the query:<br /><br /> <%= query %> 1 Data Flow/s detected engine-handler-23529/WebContent/search.jsp Line 32 in 44afb8a String query = request.getParameter("query"); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Cross-Site Scripting Training ● Videos    ▪ Secure Code Warrior Cross-Site Scripting Video Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.
High	SQL Injection	CWE-89	DBUtil.java:403	3	2026-04-07 10:40am
Vulnerable Code engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Lines 398 to 403 in 44afb8a String query = "SELECT * FROM TRANSACTIONS WHERE (" + acctIds.toString() + ") " + ((dateString==null)?"": "AND (" + dateString + ") ") + "ORDER BY DATE DESC" ; ResultSet resultSet = null; try { resultSet = statement.executeQuery(query); 3 Data Flow/s detected View Data Flow 1 engine-handler-23529/WebContent/bank/transaction.jsp Line 41 in 44afb8a String endString = request.getParameter("endTime"); engine-handler-23529/WebContent/bank/transaction.jsp Line 47 in 44afb8a transactions = user.getUserTransactions(startString, endString, user.getAccounts()); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/model/User.java Line 101 in 44afb8a public Transaction[] getUserTransactions(String startDate, String endDate, Account[] accounts) throws SQLException { engine-handler-23529/src/com/ibm/security/appscan/altoromutual/model/User.java Line 104 in 44afb8a transactions = DBUtil.getTransactions(startDate, endDate, accounts, -1); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 370 in 44afb8a public static Transaction[] getTransactions(String startDate, String endDate, Account[] accounts, int rowCount) throws SQLException { engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 392 in 44afb8a dateString = "DATE BETWEEN '" + startDate + " 00:00:00' AND '" + endDate + " 23:59:59'"; engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 399 in 44afb8a String query = "SELECT * FROM TRANSACTIONS WHERE (" + acctIds.toString() + ") " + ((dateString==null)?"": "AND (" + dateString + ") ") + "ORDER BY DATE DESC" ; engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 403 in 44afb8a resultSet = statement.executeQuery(query); View Data Flow 2 engine-handler-23529/WebContent/bank/transaction.jsp Line 40 in 44afb8a String startString = request.getParameter("startTime"); engine-handler-23529/WebContent/bank/transaction.jsp Line 47 in 44afb8a transactions = user.getUserTransactions(startString, endString, user.getAccounts()); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/model/User.java Line 101 in 44afb8a public Transaction[] getUserTransactions(String startDate, String endDate, Account[] accounts) throws SQLException { engine-handler-23529/src/com/ibm/security/appscan/altoromutual/model/User.java Line 104 in 44afb8a transactions = DBUtil.getTransactions(startDate, endDate, accounts, -1); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 370 in 44afb8a public static Transaction[] getTransactions(String startDate, String endDate, Account[] accounts, int rowCount) throws SQLException { engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 392 in 44afb8a dateString = "DATE BETWEEN '" + startDate + " 00:00:00' AND '" + endDate + " 23:59:59'"; engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 399 in 44afb8a String query = "SELECT * FROM TRANSACTIONS WHERE (" + acctIds.toString() + ") " + ((dateString==null)?"": "AND (" + dateString + ") ") + "ORDER BY DATE DESC" ; engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 403 in 44afb8a resultSet = statement.executeQuery(query); View Data Flow 3 engine-handler-23529/src/com/ibm/security/appscan/altoromutual/api/AccountAPI.java Line 144 in 44afb8a public Response getTransactions(@PathParam("accountNo") String accountNo, engine-handler-23529/src/com/ibm/security/appscan/altoromutual/api/AccountAPI.java Line 157 in 44afb8a myJson =new JSONObject(bodyJSON); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/api/AccountAPI.java Line 158 in 44afb8a startString = (String) myJson.get("startDate"); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/api/AccountAPI.java Line 171 in 44afb8a transactions = user.getUserTransactions(startString, endString, engine-handler-23529/src/com/ibm/security/appscan/altoromutual/model/User.java Line 101 in 44afb8a public Transaction[] getUserTransactions(String startDate, String endDate, Account[] accounts) throws SQLException { engine-handler-23529/src/com/ibm/security/appscan/altoromutual/model/User.java Line 104 in 44afb8a transactions = DBUtil.getTransactions(startDate, endDate, accounts, -1); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 370 in 44afb8a public static Transaction[] getTransactions(String startDate, String endDate, Account[] accounts, int rowCount) throws SQLException { engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 392 in 44afb8a dateString = "DATE BETWEEN '" + startDate + " 00:00:00' AND '" + endDate + " 23:59:59'"; engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 399 in 44afb8a String query = "SELECT * FROM TRANSACTIONS WHERE (" + acctIds.toString() + ") " + ((dateString==null)?"": "AND (" + dateString + ") ") + "ORDER BY DATE DESC" ; engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 403 in 44afb8a resultSet = statement.executeQuery(query); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior SQL Injection Training ● Videos    ▪ Secure Code Warrior SQL Injection Video ● Further Reading    ▪ OWASP SQL Injection Prevention Cheat Sheet    ▪ OWASP SQL Injection    ▪ OWASP Query Parameterization Cheat Sheet Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.
High	SQL Injection	CWE-89	DBUtil.java:219	4	2026-04-07 10:40am
Vulnerable Code engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Lines 214 to 219 in 44afb8a return false; Connection connection = getConnection(); Statement statement = connection.createStatement(); ResultSet resultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */ 4 Data Flow/s detected View Data Flow 1 engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java Line 75 in 44afb8a username = request.getParameter("uid"); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java Line 82 in 44afb8a if (!DBUtil.isValidUser(username, password)){ engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 212 in 44afb8a public static boolean isValidUser(String user, String password) throws SQLException{ engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 219 in 44afb8a ResultSet resultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */ View Data Flow 2 engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/CCApplyServlet.java Line 47 in 44afb8a String passwd = request.getParameter("passwd"); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/CCApplyServlet.java Line 51 in 44afb8a if (DBUtil.isValidUser(user.getUsername(), passwd.trim().toLowerCase())) { engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 212 in 44afb8a public static boolean isValidUser(String user, String password) throws SQLException{ engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 219 in 44afb8a ResultSet resultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */ View Data Flow 3 engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java Line 79 in 44afb8a String password = request.getParameter("passw"); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java Line 80 in 44afb8a password = password.trim().toLowerCase(); //in real life the password usually is case sensitive and this cast would not be done engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java Line 82 in 44afb8a if (!DBUtil.isValidUser(username, password)){ engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 212 in 44afb8a public static boolean isValidUser(String user, String password) throws SQLException{ engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 219 in 44afb8a ResultSet resultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */ View more Data Flows Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior SQL Injection Training ● Videos    ▪ Secure Code Warrior SQL Injection Video ● Further Reading    ▪ OWASP SQL Injection Prevention Cheat Sheet    ▪ OWASP SQL Injection    ▪ OWASP Query Parameterization Cheat Sheet Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.
High	SQL Injection	CWE-89	DBUtil.java:471	2	2026-04-07 10:40am
Vulnerable Code engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Lines 466 to 471 in 44afb8a public static String addAccount(String username, String acctType) { try { Connection connection = getConnection(); Statement statement = connection.createStatement(); statement.execute("INSERT INTO ACCOUNTS (USERID,ACCOUNT_NAME,BALANCE) VALUES ('"+username+"','"+acctType+"', 0)"); 2 Data Flow/s detected View Data Flow 1 engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java Line 45 in 44afb8a String acctType = request.getParameter("accttypes"); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java Line 49 in 44afb8a String error = DBUtil.addAccount(username, acctType); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 467 in 44afb8a public static String addAccount(String username, String acctType) { engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 471 in 44afb8a statement.execute("INSERT INTO ACCOUNTS (USERID,ACCOUNT_NAME,BALANCE) VALUES ('"+username+"','"+acctType+"', 0)"); View Data Flow 2 engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java Line 44 in 44afb8a String username = request.getParameter("username"); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java Line 49 in 44afb8a String error = DBUtil.addAccount(username, acctType); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 467 in 44afb8a public static String addAccount(String username, String acctType) { engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 471 in 44afb8a statement.execute("INSERT INTO ACCOUNTS (USERID,ACCOUNT_NAME,BALANCE) VALUES ('"+username+"','"+acctType+"', 0)"); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior SQL Injection Training ● Videos    ▪ Secure Code Warrior SQL Injection Video ● Further Reading    ▪ OWASP SQL Injection Prevention Cheat Sheet    ▪ OWASP SQL Injection    ▪ OWASP Query Parameterization Cheat Sheet Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.
High	SQL Injection	CWE-89	DBUtil.java:276	2	2026-04-07 10:40am
Vulnerable Code engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Lines 271 to 276 in 44afb8a if (username == null || username.trim().length() == 0) return null; Connection connection = getConnection(); Statement statement = connection.createStatement(); ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = '"+ username +"' "); /* BAD - user input should always be sanitized */ 2 Data Flow/s detected View Data Flow 1 engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java Line 75 in 44afb8a username = request.getParameter("uid"); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java Line 94 in 44afb8a Cookie accountCookie = ServletUtil.establishSession(username,session); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java Line 340 in 44afb8a public static Cookie establishSession(String username, HttpSession session){ engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java Line 342 in 44afb8a User user = DBUtil.getUserInfo(username); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 236 in 44afb8a public static User getUserInfo(String username) throws SQLException{ View remaining steps engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java Line 343 in 44afb8a Account[] accounts = user.getAccounts(); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/model/User.java Line 76 in 44afb8a public Account[] getAccounts(){ engine-handler-23529/src/com/ibm/security/appscan/altoromutual/model/User.java Line 78 in 44afb8a return DBUtil.getAccounts(username); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 270 in 44afb8a public static Account[] getAccounts(String username) throws SQLException{ engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 276 in 44afb8a ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = '"+ username +"' "); /* BAD - user input should always be sanitized */ View Data Flow 2 engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java Line 136 in 44afb8a String accessToken = request.getHeader("Authorization").replaceAll("Bearer ", ""); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java Line 139 in 44afb8a String decodedToken = new String(Base64.decodeBase64(accessToken)); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java Line 140 in 44afb8a StringTokenizer tokenizer = new StringTokenizer(decodedToken,":"); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java Line 141 in 44afb8a String username = new String(Base64.decodeBase64(tokenizer.nextToken())); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java Line 142 in 44afb8a return DBUtil.getUserInfo(username); View remaining steps engine-handler-23529/src/com/ibm/security/appscan/altoromutual/api/AccountAPI.java Line 35 in 44afb8a Account[] account = (OperationsUtil.getUser(request)).getAccounts(); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/model/User.java Line 76 in 44afb8a public Account[] getAccounts(){ engine-handler-23529/src/com/ibm/security/appscan/altoromutual/model/User.java Line 78 in 44afb8a return DBUtil.getAccounts(username); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 270 in 44afb8a public static Account[] getAccounts(String username) throws SQLException{ engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 276 in 44afb8a ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = '"+ username +"' "); /* BAD - user input should always be sanitized */ Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior SQL Injection Training ● Videos    ▪ Secure Code Warrior SQL Injection Video ● Further Reading    ▪ OWASP SQL Injection Prevention Cheat Sheet    ▪ OWASP SQL Injection    ▪ OWASP Query Parameterization Cheat Sheet Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.
High	Cross-Site Scripting	CWE-79	transaction.jsp:128	1	2026-04-07 10:40am
Vulnerable Code engine-handler-23529/WebContent/bank/transaction.jsp Lines 123 to 128 in 44afb8a <table border="0" style="padding-bottom:10px;"> <tr> <td valign=top>After</td> <td><input id="startDate" name="startDate" type="text" value="<%=(request.getParameter("startDate")==null)?"":request.getParameter("startDate")%>"/><br /><span class="credit">yyyy-mm-dd</span></td> <td valign=top>Before</td> <td><input name="endDate" id="endDate" type="text" value="<%=(request.getParameter("endDate")==null)?"":request.getParameter("endDate") %>"/><br /><span class="credit">yyyy-mm-dd</span></td> 1 Data Flow/s detected engine-handler-23529/WebContent/bank/transaction.jsp Line 128 in 44afb8a <td><input name="endDate" id="endDate" type="text" value="<%=(request.getParameter("endDate")==null)?"":request.getParameter("endDate") %>"/><br /><span class="credit">yyyy-mm-dd</span></td> Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Cross-Site Scripting Training ● Videos    ▪ Secure Code Warrior Cross-Site Scripting Video Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.
High	SQL Injection	CWE-89	DBUtil.java:494	5	2026-04-07 10:40am
Vulnerable Code engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Lines 489 to 494 in 44afb8a public static String addUser(String username, String password, String firstname, String lastname) { try { Connection connection = getConnection(); Statement statement = connection.createStatement(); statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')"); 5 Data Flow/s detected View Data Flow 1 engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java Line 57 in 44afb8a String firstname = request.getParameter("firstname"); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java Line 80 in 44afb8a String error = DBUtil.addUser(username, password1, firstname, lastname); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 490 in 44afb8a public static String addUser(String username, String password, String firstname, String lastname) { engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 494 in 44afb8a statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')"); View Data Flow 2 engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java Line 58 in 44afb8a String lastname = request.getParameter("lastname"); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java Line 80 in 44afb8a String error = DBUtil.addUser(username, password1, firstname, lastname); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 490 in 44afb8a public static String addUser(String username, String password, String firstname, String lastname) { engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 494 in 44afb8a statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')"); View Data Flow 3 engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java Line 60 in 44afb8a String password1 = request.getParameter("password1"); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java Line 80 in 44afb8a String error = DBUtil.addUser(username, password1, firstname, lastname); engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 490 in 44afb8a public static String addUser(String username, String password, String firstname, String lastname) { engine-handler-23529/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java Line 494 in 44afb8a statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')"); View more Data Flows Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior SQL Injection Training ● Videos    ▪ Secure Code Warrior SQL Injection Video ● Further Reading    ▪ OWASP SQL Injection Prevention Cheat Sheet    ▪ OWASP SQL Injection    ▪ OWASP Query Parameterization Cheat Sheet Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.
High	Cross-Site Scripting	CWE-79	serverStatusCheckService.jsp:4	1	2026-04-07 10:40am
Vulnerable Code engine-handler-23529/WebContent/util/serverStatusCheckService.jsp Lines 1 to 4 in 44afb8a <%@ page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%> { "HostName": "<%=request.getParameter("HostName")%>", 1 Data Flow/s detected engine-handler-23529/WebContent/util/serverStatusCheckService.jsp Line 1 in 44afb8a <%@ page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%> engine-handler-23529/WebContent/util/serverStatusCheckService.jsp Line 4 in 44afb8a "HostName": "<%=request.getParameter("HostName")%>", Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Cross-Site Scripting Training ● Videos    ▪ Secure Code Warrior Cross-Site Scripting Video Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.

Findings Overview

Severity	Vulnerability Type	CWE	Language	Count
High	Cross-Site Scripting	CWE-79	Java*	10
High	SQL Injection	CWE-89	Java*	8
High	Command Injection	CWE-78	Java*	1
High	Code Injection	CWE-94	JavaScript / TypeScript*	1
Medium	Error Messages Information Exposure	CWE-209	Java*	10
Medium	Trust Boundary Violation	CWE-501	Java*	2
Low	Cookie Without 'HttpOnly' Flag	CWE-1004	Java*	1