{
	"@programName": "ZAP",
	"@version": "2.17.0",
	"@generated": "Sat, 11 Apr 2026 17:25:18",
	"created": "2026-04-11T15:25:18.310589580Z",
	"insights":[
		{
			"level": "Info",
			"reason": "Informational",
			"site": "",
			"key": "insight.network.failure",
			"description": "Percentage of network failures",
			"statistic": "1"
		},
		{
			"level": "Info",
			"reason": "Informational",
			"site": "http://127.0.0.1:8080",
			"key": "insight.code.2xx",
			"description": "Percentage of responses with status code 2xx",
			"statistic": "75"
		},
		{
			"level": "Info",
			"reason": "Informational",
			"site": "http://127.0.0.1:8080",
			"key": "insight.code.3xx",
			"description": "Percentage of responses with status code 3xx",
			"statistic": "14"
		},
		{
			"level": "Info",
			"reason": "Informational",
			"site": "http://127.0.0.1:8080",
			"key": "insight.code.4xx",
			"description": "Percentage of responses with status code 4xx",
			"statistic": "6"
		},
		{
			"level": "Info",
			"reason": "Informational",
			"site": "http://127.0.0.1:8080",
			"key": "insight.code.5xx",
			"description": "Percentage of responses with status code 5xx",
			"statistic": "2"
		},
		{
			"level": "Info",
			"reason": "Informational",
			"site": "http://127.0.0.1:8080",
			"key": "insight.endpoint.ctype.image/gif",
			"description": "Percentage of endpoints with content type image/gif",
			"statistic": "1"
		},
		{
			"level": "Info",
			"reason": "Informational",
			"site": "http://127.0.0.1:8080",
			"key": "insight.endpoint.ctype.image/png",
			"description": "Percentage of endpoints with content type image/png",
			"statistic": "4"
		},
		{
			"level": "Info",
			"reason": "Informational",
			"site": "http://127.0.0.1:8080",
			"key": "insight.endpoint.ctype.image/x-icon",
			"description": "Percentage of endpoints with content type image/x-icon",
			"statistic": "1"
		},
		{
			"level": "Info",
			"reason": "Informational",
			"site": "http://127.0.0.1:8080",
			"key": "insight.endpoint.ctype.text/css",
			"description": "Percentage of endpoints with content type text/css",
			"statistic": "6"
		},
		{
			"level": "Info",
			"reason": "Informational",
			"site": "http://127.0.0.1:8080",
			"key": "insight.endpoint.ctype.text/html",
			"description": "Percentage of endpoints with content type text/html",
			"statistic": "72"
		},
		{
			"level": "Info",
			"reason": "Informational",
			"site": "http://127.0.0.1:8080",
			"key": "insight.endpoint.ctype.text/javascript",
			"description": "Percentage of endpoints with content type text/javascript",
			"statistic": "6"
		},
		{
			"level": "Info",
			"reason": "Informational",
			"site": "http://127.0.0.1:8080",
			"key": "insight.endpoint.ctype.text/plain",
			"description": "Percentage of endpoints with content type text/plain",
			"statistic": "1"
		},
		{
			"level": "Info",
			"reason": "Informational",
			"site": "http://127.0.0.1:8080",
			"key": "insight.endpoint.method.GET",
			"description": "Percentage of endpoints with method GET",
			"statistic": "66"
		},
		{
			"level": "Info",
			"reason": "Informational",
			"site": "http://127.0.0.1:8080",
			"key": "insight.endpoint.method.POST",
			"description": "Percentage of endpoints with method POST",
			"statistic": "33"
		},
		{
			"level": "Info",
			"reason": "Informational",
			"site": "http://127.0.0.1:8080",
			"key": "insight.endpoint.total",
			"description": "Count of total endpoints",
			"statistic": "193"
		},
		{
			"level": "Info",
			"reason": "Informational",
			"site": "http://127.0.0.1:8080",
			"key": "insight.response.slow",
			"description": "Percentage of slow responses",
			"statistic": "30"
		}
	],
	"site":[ 
		{
			"@name": "http://127.0.0.1:8080/govwayConsole/auditing.do",
			"@host": "127.0.0.1",
			"@port": "8080",
			"@ssl": "false",
			"alerts": [ 
				{
					"pluginid": "10031",
					"alertRef": "10031",
					"alert": "User Controllable HTML Element Attribute (Potential XSS)",
					"name": "User Controllable HTML Element Attribute (Potential XSS)",
					"riskcode": "0",
					"confidence": "1",
					"riskdesc": "Informational (Low)",
					"desc": "<p>This check looks at user-supplied input in query string parameters and POST data to identify where certain HTML attribute values might be controlled. This provides hot-spot detection for XSS (cross-site scripting) that will require further review by a security analyst to determine exploitability.</p>",
					"instances":[ 
						{
							"id": "622",
							"uri": "http://127.0.0.1:8080/govwayConsole/auditing.do",
							"nodeName": "http:\/\/127.0.0.1:8080\/govwayConsole\/auditing.do ()(__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,contoggetto,datafine,datainizio,edit-mode,id,oldid,statooperazione,tipooggetto,tipooperazione,utente)",
							"method": "POST",
							"param": "contoggetto",
							"attack": "",
							"evidence": "",
							"otherinfo": "User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL:\n\nhttp://127.0.0.1:8080/govwayConsole/auditing.do\n\nappears to include user input in:\na(n) [input] tag [value] attribute\n\nThe user input found was:\ncontoggetto=ZAP\n\nThe user-controlled value was:\nzap"
						},
						{
							"id": "623",
							"uri": "http://127.0.0.1:8080/govwayConsole/auditing.do",
							"nodeName": "http:\/\/127.0.0.1:8080\/govwayConsole\/auditing.do ()(__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,contoggetto,datafine,datainizio,edit-mode,id,oldid,statooperazione,tipooggetto,tipooperazione,utente)",
							"method": "POST",
							"param": "datafine",
							"attack": "",
							"evidence": "",
							"otherinfo": "User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL:\n\nhttp://127.0.0.1:8080/govwayConsole/auditing.do\n\nappears to include user input in:\na(n) [input] tag [value] attribute\n\nThe user input found was:\ndatafine=ZAP\n\nThe user-controlled value was:\nzap"
						},
						{
							"id": "627",
							"uri": "http://127.0.0.1:8080/govwayConsole/auditing.do",
							"nodeName": "http:\/\/127.0.0.1:8080\/govwayConsole\/auditing.do ()(__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,contoggetto,datafine,datainizio,edit-mode,id,oldid,statooperazione,tipooggetto,tipooperazione,utente)",
							"method": "POST",
							"param": "datainizio",
							"attack": "",
							"evidence": "",
							"otherinfo": "User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL:\n\nhttp://127.0.0.1:8080/govwayConsole/auditing.do\n\nappears to include user input in:\na(n) [input] tag [value] attribute\n\nThe user input found was:\ndatainizio=ZAP\n\nThe user-controlled value was:\nzap"
						},
						{
							"id": "676",
							"uri": "http://127.0.0.1:8080/govwayConsole/auditing.do",
							"nodeName": "http:\/\/127.0.0.1:8080\/govwayConsole\/auditing.do ()(__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,contoggetto,datafine,datainizio,edit-mode,id,oldid,statooperazione,tipooggetto,tipooperazione,utente)",
							"method": "POST",
							"param": "edit-mode",
							"attack": "",
							"evidence": "",
							"otherinfo": "User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL:\n\nhttp://127.0.0.1:8080/govwayConsole/auditing.do\n\nappears to include user input in:\na(n) [input] tag [value] attribute\n\nThe user input found was:\nedit-mode=end\n\nThe user-controlled value was:\nend"
						},
						{
							"id": "628",
							"uri": "http://127.0.0.1:8080/govwayConsole/auditing.do",
							"nodeName": "http:\/\/127.0.0.1:8080\/govwayConsole\/auditing.do ()(__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,contoggetto,datafine,datainizio,edit-mode,id,oldid,statooperazione,tipooggetto,tipooperazione,utente)",
							"method": "POST",
							"param": "id",
							"attack": "",
							"evidence": "",
							"otherinfo": "User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL:\n\nhttp://127.0.0.1:8080/govwayConsole/auditing.do\n\nappears to include user input in:\na(n) [input] tag [value] attribute\n\nThe user input found was:\nid=ZAP\n\nThe user-controlled value was:\nzap"
						},
						{
							"id": "629",
							"uri": "http://127.0.0.1:8080/govwayConsole/auditing.do",
							"nodeName": "http:\/\/127.0.0.1:8080\/govwayConsole\/auditing.do ()(__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,contoggetto,datafine,datainizio,edit-mode,id,oldid,statooperazione,tipooggetto,tipooperazione,utente)",
							"method": "POST",
							"param": "oldid",
							"attack": "",
							"evidence": "",
							"otherinfo": "User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL:\n\nhttp://127.0.0.1:8080/govwayConsole/auditing.do\n\nappears to include user input in:\na(n) [input] tag [value] attribute\n\nThe user input found was:\noldid=ZAP\n\nThe user-controlled value was:\nzap"
						},
						{
							"id": "630",
							"uri": "http://127.0.0.1:8080/govwayConsole/auditing.do",
							"nodeName": "http:\/\/127.0.0.1:8080\/govwayConsole\/auditing.do ()(__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,contoggetto,datafine,datainizio,edit-mode,id,oldid,statooperazione,tipooggetto,tipooperazione,utente)",
							"method": "POST",
							"param": "utente",
							"attack": "",
							"evidence": "",
							"otherinfo": "User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL:\n\nhttp://127.0.0.1:8080/govwayConsole/auditing.do\n\nappears to include user input in:\na(n) [input] tag [value] attribute\n\nThe user input found was:\nutente=ZAP\n\nThe user-controlled value was:\nzap"
						}
					],
					"count": "7",
					"systemic": false,
					"solution": "<p>Validate all input and sanitize output it before writing to any HTML attributes.</p>",
					"otherinfo": "<p>User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL:</p><p></p><p>http://127.0.0.1:8080/govwayConsole/auditing.do</p><p></p><p>appears to include user input in:</p><p>a(n) [input] tag [value] attribute</p><p></p><p>The user input found was:</p><p>contoggetto=ZAP</p><p></p><p>The user-controlled value was:</p><p>zap</p>",
					"reference": "<p>https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html</p>",
					"cweid": "20",
					"wascid": "20",
					"sourceid": "188"
				}
			]
		}
	],
	"sequences":[
	]

}