Cross-site scripting (reflected) https://demo-app.synthetic.local /search?q= /search?q= [q parameter] High Certain CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)]]> Cleartext submission of password https://demo-app.synthetic.local /login /login Medium Firm CWE-319: Cleartext Transmission of Sensitive Information]]>