⚠ Sandboxed environment — This is an intentionally vulnerable application running inside an isolated Docker container with fake data. Nothing you do here can harm the host machine or other users.

A10 – Mishandling Exceptional Conditions

OWASP A10:2025 CWE-636 CWE-754 CWE-209

When code hits an unexpected condition, it has to decide what to do. Each tab is a different way to get that decision wrong — fail open, fall back insecurely, or leak secrets to the user.

CWE-636 Fail Open CWE-754 Silent Insecure Default CWE-209 Stack-Trace Leak
CWE-209 Generation of Error Message Containing Sensitive Information

A debug error handler dumps the full Python traceback to the user. The traceback exposes the SQL query, file paths, framework versions, and any local variables.

Vulnerable code: 
try:
    rows = execute(f"... WHERE username='{user}'")
except Exception:
    return traceback.format_exc()   # full stack trace to the user

Try it yourself

Normal lookup

Submit alice. No error.

Trigger an error

Submit x'. SQL malforms; server replies with the whole traceback including a local variable db_password.