{
    "host": "mover2u.com",
    "host_url": "https://mover2u.com/",
    "task_id": "13b00943-ed88-40ce-a2ad-a48bbadfc5ed",
    "status": "COMPLETED",
    "inline_connection": "Yes",
    "original_header": {
        "Date": "Wed, 21 Jan 2026 00:41:01 GMT",
        "Server": "Apache",
        "X-Powered-By": "PHP/8.2.22",
        "Cache-Control": "no-cache",
        "X-Nitro-Cache": "HIT",
        "X-Nitro-Cache-From": "drop-in",
        "vary": "user-agent,Accept-Encoding",
        "x-nitro-rev": "61eb420",
        "link": "<https://cdn-dglae.nitrocdn.com>; rel=preconnect, <https://mover2u.com/wp-json/>; rel=\"https://api.w.org/\", <https://mover2u.com/wp-json/wp/v2/pages/41>; rel=\"alternate\"; title=\"JSON\"; type=\"application/json\", <https://mover2u.com/>; rel=shortlink",
        "x-cache-ctime": "1768920015",
        "Upgrade": "h2,h2c",
        "Connection": "Upgrade, Keep-Alive",
        "Content-Encoding": "gzip",
        "Keep-Alive": "timeout=5, max=100",
        "Transfer-Encoding": "chunked",
        "Content-Type": "text/html; charset=UTF-8"
    },
    "ip_address": "103.6.198.43",
    "hosting_provider": null,
    "registrar": null,
    "cms": {
        "WordPress": "6.9"
    },
    "cms_cve": null,
    "server": "apache",
    "server_disclosure_cve": null,
    "programming_language": "PHP:8.2.22",
    "technology_disclosure_cve": {
        "Total CVEs": 23,
        "Critical": 3,
        "High": 4,
        "Medium": 13,
        "Low": 3,
        "php-8.2.22": [
            {
                "Id": "CVE-2025-1220",
                "Published": "2025-07-13T23:15:22.773",
                "Description": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.",
                "Severity": "LOW",
                "Score": 3.7,
                "CWE": "CWE-918"
            },
            {
                "Id": "CVE-2025-1735",
                "Published": "2025-07-13T23:15:22.940",
                "Description": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This\u00a0could cause crashes if Postgres server rejects the string as invalid.",
                "Severity": "MEDIUM",
                "Score": 5.9,
                "CWE": "CWE-89"
            },
            {
                "Id": "CVE-2025-14177",
                "Published": "2025-12-27T20:15:40.400",
                "Description": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.",
                "Severity": "MEDIUM",
                "Score": 6.3,
                "CWE": "CWE-125"
            },
            {
                "Id": "CVE-2025-14178",
                "Published": "2025-12-27T20:15:40.570",
                "Description": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.",
                "Severity": "MEDIUM",
                "Score": 6.5,
                "CWE": "CWE-190"
            },
            {
                "Id": "CVE-2025-14180",
                "Published": "2025-12-27T20:15:40.717",
                "Description": "In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \\x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.",
                "Severity": "HIGH",
                "Score": 8.2,
                "CWE": "CWE-476"
            }
        ]
    },
    "mixed_content_analysis": null,
    "operating_system": "Linux/Unix",
    "open_ports": [
        80,
        443
    ],
    "database_technology": null,
    "javascript_libraries": null,
    "javascript_libraries_cve": null,
    "secure_connection": "Enabled",
    "directory_listing": null,
    "passwords_submitted_unencrypted": null,
    "missing_security_headers": [
        "STRICT-TRANSPORT-SECURITY",
        "PERMISSIONS-POLICY",
        "X-FRAME-OPTIONS",
        "CONTENT-SECURITY-POLICY",
        "X-CONTENT-TYPE-OPTIONS",
        "X-XSS-PROTECTION",
        "REFERRER-POLICY",
        "X-PERMITTED-CROSS-DOMAIN"
    ],
    "missing_content_security_policy_header": {
        "issue": "Missing Content-Security-Policy header",
        "severity": "High",
        "cwe_id": "CWE-693",
        "cwe_description": "Failure to enforce mechanisms that protect against unauthorized modifications such as XSS or content injection.",
        "fix": "Implement a strong Content-Security-Policy header such as: \"Content-Security-Policy: default-src 'self'; script-src 'self'\"."
    },
    "missing_strict_transport_security_header": {
        "issue": "Missing Strict-Transport-Security header",
        "severity": "High",
        "cwe_id": "CWE-319",
        "cwe_description": "Sensitive information is exposed in transit due to the absence of secure channel enforcement.",
        "fix": "Enable HSTS with: \"Strict-Transport-Security: max-age=31536000; includeSubDomains; preload\"."
    },
    "missing_referrer_policy_header": {
        "issue": "Missing Referrer-Policy header",
        "severity": "Medium",
        "cwe_id": "CWE-200",
        "cwe_description": "Exposure of sensitive URLs or information to third-party sites.",
        "fix": "Set a secure referrer policy such as: \"Referrer-Policy: no-referrer\"."
    },
    "missing_x_content_type_options_header": {
        "issue": "Missing X-Content-Type-Options header",
        "severity": "Medium",
        "cwe_id": "CWE-16",
        "cwe_description": "Improperly configured security headers allow MIME-type confusion attacks.",
        "fix": "Add the header: \"X-Content-Type-Options: nosniff\"."
    },
    "missing_httponly_flag_in_cookies": {
        "issue": "Missing HttpOnly flag in cookies",
        "severity": "High",
        "cwe_id": "CWE-1004",
        "cwe_description": "Cookies accessible by JavaScript can be stolen via XSS.",
        "fix": "Set the HttpOnly flag to prevent client-side script access."
    },
    "missing_secure_flag_in_cookies": {
        "issue": "Missing Secure flag in cookies",
        "severity": "High",
        "cwe_id": "CWE-614",
        "cwe_description": "Cookies without the Secure flag may be sent over unencrypted connections.",
        "fix": "Enable the Secure flag for all session or sensitive cookies."
    },
    "secret_files_detection": [
        "https://mover2u.com/robots.txt",
        "https://mover2u.com/sitemap.xml"
    ],
    "robots_txt_file_found": null,
    "waf_detection": null,
    "ssl_certificate": null,
    "loose_cookie_domain": null,
    "csp_header_analysis": null,
    "openapi_disclosure": null,
    "password_leakage": null,
    "error_messages_analysis": null,
    "path_disclosure": null,
    "rate_limit_headers": null,
    "email_extraction": {
        "Source": [
            "contact@mover2u.com"
        ],
        "Emails exposed": {
            "issue": "Emails exposed",
            "severity": "Low",
            "cwe_id": "CWE-200",
            "cwe_description": "Publicly exposed email addresses may lead to phishing or spam attacks.",
            "fix": "Obfuscate email addresses or remove unnecessary public exposure."
        }
    },
    "xml_rpc_endpoint_detection": null,
    "http_methods_allowed": [
        "GET",
        "POST",
        "PUT",
        "PATCH",
        "DELETE",
        "OPTIONS",
        "HEAD",
        "DEBUG"
    ],
    "enabled_debug_method": "Yes",
    "enabled_options_method": "Yes",
    "cross_domain_inclusion": [
        "mover2u.com",
        "cdn.trustindex.io",
        "www.googletagmanager.com",
        "cdn-dglae.nitrocdn.com",
        "www.google.com",
        "fonts.gstatic.com"
    ],
    "file_upload": null,
    "client_access_policies": [],
    "x_frame_options": "Missing X-Frame-Options",
    "x_xss_protection": "Missing x-xss-protection header",
    "htaccess_exposure": null,
    "host_header_injection": null,
    "captcha_detection": null,
    "password_field_with_autocomplete": null,
    "spf": null,
    "dmarc": null,
    "dkim": null,
    "unencrypted_viewstate": null,
    "total_scans": [
        "Inline Connection",
        "Ip-Address",
        "Cloud_Provider",
        "Server Disclosure",
        "Technology Disclosure",
        "Cms Detection",
        "Mixed Content Analysis",
        "Operating-System",
        "Open Ports Scan",
        "Database",
        "Javascript Libraries",
        "Secure Connection Check",
        "Directories Listing Exposed",
        "Password Exposing Pages",
        "Missing Security Headers",
        "Missing Content-Security-Policy",
        "Missing Strict-Transport-Security",
        "Missing Referrer-Policy",
        "Missing X-Content-Type-Options",
        "Missing Cookie http flag",
        "Missing Cookie secure flag",
        "Secret Files Detection",
        "WAF-Detection",
        "SSL Certificate Validation",
        "Loose Cookie Domain",
        "CSP Header Analysis",
        "OpenAPI Disclosure",
        "Password Leak Detection",
        "Path Disclosure",
        "Error Messages Analysis",
        "Rate Limit Headers",
        "Email Extraction",
        "Xml-RPC Endpoint Detection",
        "HTTP Methods Allowed",
        "Enabled Debug Method",
        "Enabled OPTIONS Method",
        "Cross-Domain Inclusion",
        "File Upload Detection",
        "Client Access Policies",
        "X-FRAME OPTIONS",
        "X-XSS PROTECTION",
        ".htaccess Exposure"
    ],
    "executive_summary": {
        "Severity": "Critical",
        "Total Checks Passed": 19,
        "Passed Cases": [
            "Mixed Content (HTTP on HTTPS)",
            "Open Ports Scan",
            "Javascript Libraries",
            "Secure Connection",
            "Directory Listing Exposed",
            "Passwords submitted unencrypted",
            "SSL Certificate",
            "Loose cookie domain",
            "Content Security Policy Misconfiguration",
            "OpenAPI Disclosure",
            "Password Leakage",
            "Error Messages Analysis",
            "Path Disclosure",
            "Rate Limit Headers",
            "Enabled Debug Method",
            "Enabled OPTIONS Method",
            "File Upload Detection",
            ".htaccess Exposure",
            "Host Header Injection"
        ],
        "Total Checks Failed": 17,
        "Failed Cases": [
            "Server Disclosure",
            "Technology Disclosure",
            "Missing Security Headers",
            "Missing Content-Security-Policy header",
            "Missing Strict-Transport-Security header",
            "Missing Referrer-Policy header",
            "Missing X-Content-Type-Options header",
            "Missing HttpOnly flag in cookies",
            "Missing Secure flag in cookies",
            "Secret Files Detection",
            "robots.txt file found",
            "WAF Detection",
            "Emails exposed",
            "Cross-Domain Inclusion",
            "Client Access Policies",
            "X-FRAME OPTIONS",
            "X-XSS PROTECTION"
        ],
        "Total CVEs Found": 23,
        "Critical": 3,
        "High": 4,
        "Medium": 13,
        "Low": 3,
        "Total CWEs Found": 6
    },
    "total_scan_time": "1 minute, 22.42 seconds",
    "scan_start_timestamp": "2026-01-21 00:40:58"
}