⚡ VulnAPI

PRACIVO LAB — INTENTIONALLY VULNERABLE
⚠️ Pracivo Security Lab — SSTI in /render, parameter pollution in /search, verbose errors, CORS wildcard.

Search Items (HTTP Parameter Pollution Lab)

The server handles duplicate parameters inconsistently.

Hint: try /search?category=tools&category=electronics — which one wins?
Try /search?category=all&category=electronics to bypass filters.

Active category filter: []
Results: [
  {
    "id": 1,
    "name": "Widget Alpha",
    "price": 9.99,
    "category": "tools",
    "stock": 50
  },
  {
    "id": 2,
    "name": "Gadget Beta",
    "price": 24.99,
    "category": "electronics",
    "stock": 30
  },
  {
    "id": 3,
    "name": "Device Gamma",
    "price": 49.99,
    "category": "electronics",
    "stock": 10
  }
]