[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572184-105":53,"doc-detail-572184-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","web-application-audit-11-post-remediation-version","Web Application Audit - 1.1 - Post-Remediation Version","","Document contains the TLP:CLEAR Web Application Audit results issued by PWND Labs GmbH on behalf of zeitkapsl reasearch OG for Feb 1, 2026 to Apr 1, 2026. It covers document control, audit team composition, and a version history including a Post-Remediation release. Executive summary reports a clean, well-structured codebase with authentication and centralized error handling, while identifying medium- and low-impact findings tied to business logic, access control, and security configuration weaknesses.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/web-application-audit-11-post-remediation-version/572184/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/web-application-audit-11-post-remediation-version/572184.png","ImageObject",442,249,{"name":88,"@type":89},"Riley West","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-22","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",6,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What audit period and scope does the report cover?","Question",{"text":109,"@type":110},"The audit was conducted from Feb 1, 2026 to Apr 1, 2026. Additional scope and duration details are referenced in the Methodology section (3.1).","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"What is the overall conclusion in the executive summary?",{"text":114,"@type":110},"The codebase is described as clean and well-structured with solid authentication and centralized error handling. No high-risk code-level vulnerabilities were found, but issues related to business logic and access control weaknesses were identified.",{"name":116,"@type":107,"acceptedAnswer":117},"Which types of findings are included in the report?",{"text":118,"@type":110},"Findings are grouped across multiple categories such as media/error disclosure, access control and workflow ownership verification, crypto-related issues, missing security headers, dependency currency, and Snowflake ID generation/oracle concerns.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},572184,1792086181,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":136,"language":137,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":138,"faqs":139,"seo_title":140,"seo_description":61,"update_tm":141,"read_time":142},1099523885074,"https://ap-avatar.wpscdn.com/davatar_9964176cb1d06d4a9deccf72a44ae3dc","TLP:CLEAR  \nzeitkapsl reasearch OG  \nWeb Application Audit  \nzeitkapsl reasearch OG  \nAttn. DI. Peter Spiess-Knafl Luegerstraße 10  \n9020 Klagenfurt  \nPWND Labs GmbH  \nNestroygasse 3, 9020 Klagenfurt a. W. FN651929W  \nKlagenfurt, Version: 1.1  \nTLP:CLEAR  \n1 Document Control  \n1.1 Document Details  \n\n| Title | Details |\n| --- | --- |\n| Customer | zeitkapsl reasearch OG |\n| Auditing Company | PWND Labs GmbH |\n| Audit Type | Web Application Audit |\n| Timeframe | Feb 1, 2026 to Apr 1, 2026 |\n| Document Version | 1.1 |\n| Document Classification | TLP:CLEAR |\n\nTable 1 -Document Details  \n1.2 Audit Team  \n\n| Name | Contact | Role |\n| --- | --- | --- |\n| Dominik Apel | [E-Mail: contact@dfpa.at](E-Mail: contact@dfpa.at) | Pentester |\n| Matthias Pleschinger | E-Mail: matthias@hexsh.at | Pentester |\n| Jannik Schager | E-Mail: [jannik.schager@pwnd.at](jannik.schager@pwnd.at) | Pentester |\n\nTable 2-Audit Team  \n1.3 List of Changes  \n\n| Version | Description | Date |\n| --- | --- | --- |\n| 1.0 | First Release Version | Apr 8, 2026 |\n| 1.1 | Post-Remediation Version | Apr 28, 2026 |\n\nTable 3-List of Changes  \n© PWND Labs GmbH [www.pwnd.at | contact@pwnd.at](www.pwnd.at | contact@pwnd.at) 2  \nTLP:CLEAR  \nTable of Contents  \n1 Document Control ........................................................................ 2  \n1.1 Document Details ............................................................................................. 2  \n1.2 Audit Team ........................................................................................................ 2  \n1.3 List of Changes .................................................................................................. 2  \n2 Executive Summary .................................................................... 5  \n2.1 Overview ........................................................................................................... 5  \n2.2 Identified Vulnerabilities ............................................................................... 5  \n3 Methodology ................................................................................. 7  \n3.1 Scope and Duration ......................................................................................... 7  \n3.2 Provided Resources ......................................................................................... 7  \n3.3 Audit Foundation ............................................................................................ 8  \n3.4 Risk Assessment according to CVSSv4 ..................................................... 8  \n4 Findings ......................................................................................... 9  \nM1: Disclosure of Internal Server Errors ............................................................. 10  \nM2: Broken Access Control in GetMediaPermission ....................................... 14  \nM3: Media-Share Corruption .............................................................................. 18  \nM4: Missing Ownership Verification in Email Change Workflow ................. 25  \nL1: Cache Path Traversal possible on Windows Systems ............................... 29  \nL2: Leaking of Encrypted Media Metadata ........................................................ 31  \nL3: Go core persists mainKey in local SQLite unnecessarily .......................... 37  \nL4: Missing AAD in AES-GCMallows ciphertext role confusion and swap attacks ................................................................................................................... 39  \nI1: Analysis of flows using formal methods ...................................................... 42  \nI2: Email Enumeration Oracles ............................................................................ 51  \nI3: Missing Content-Security-Policy (CSP) ..................................................... 60  \nI4: Missing Input Validation in crypto primitives ........................................... 64  \nI5: Non-Compliance with Security","cbCaicorf2xIHtFg","https://ap.wps.com/l/cbCaicorf2xIHtFg","pdf",5450019,101,"English","# Document Control\n## Document Details\n## Audit Team\n## List of Changes\n# Executive Summary\n## Overview\n## Identified Vulnerabilities\n# Methodology\n## Scope and Duration\n## Provided Resources\n## Audit Foundation\n## Risk Assessment according to CVSSv4\n# Findings\n## Disclosure of Internal Server Errors (M1)\n## Broken Access Control in GetMediaPermission (M2)\n## Media-Share Corruption (M3)\n## Missing Ownership Verification in Email Change Workflow (M4)\n## Cache Path Traversal possible on Windows Systems (L1)\n## Missing Input Validation in crypto primitives (I4)\n## Outdated Dependencies (I6)\n## Missing Content-Security-Policy (CSP) (I3)\n## Email Enumeration Oracles (I2)\n## Snowflake Collision/ID Oracle findings (I7-I9)\n# Appendix\n## Disclaimer\n## Imprint","[{\"question\":\"What audit period and scope does the report cover?\",\"answer\":\"The audit was conducted from Feb 1, 2026 to Apr 1, 2026. Additional scope and duration details are referenced in the Methodology section (3.1).\"},{\"question\":\"What is the overall conclusion in the executive summary?\",\"answer\":\"The codebase is described as clean and well-structured with solid authentication and centralized error handling. No high-risk code-level vulnerabilities were found, but issues related to business logic and access control weaknesses were identified.\"},{\"question\":\"Which types of findings are included in the report?\",\"answer\":\"Findings are grouped across multiple categories such as media/error disclosure, access control and workflow ownership verification, crypto-related issues, missing security headers, dependency currency, and Snowflake ID generation/oracle concerns.\"}]","Web Application Audit - 1.1 - Post-Remediation Version | PDF",1791925993,35]