1. Command Injection Risk (CRITICAL) The web application passes user-controlled input directly to subprocess commands without proper sanitization. An attacker could inject malicious commands through the target_url, wordpress_path, llm_endpoint, or tests parameters. app.py:232-264
2. No Authentication (CRITICAL) All API endpoints are completely unauthenticated. Anyone can start security scans against arbitrary URLs, potentially using your server to attack others. app.py:481-516
3. Server-Side Request Forgery (HIGH) Users can provide any URL as the scan target, allowing attackers to scan internal networks, localhost services, or use your server as a proxy for attacks. app.py:484-493
4. No CSRF Protection (HIGH) POST endpoints lack CSRF token validation, making them vulnerable to cross-site request forgery attacks. app.py:481-482 app.py:567-568
5. No Rate Limiting (MEDIUM) Endpoints lack rate limiting, allowing abuse and denial-of-service attacks.