Domain wcdemo.dev.arnlea.one
United Kingdom
-
Swagger API description is publicly available
Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
First seen 2026-01-14 10:51
Last seen 2026-02-16 15:18
Open for 33 days-
Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549d6e5b37747e249be1ac1c9c9b3ca5c5201778341Public Swagger UI/API detected at path: /swagger/index.html - sample paths: GET /integration/report/File/getfile/{id} GET /integration/{siteName}/AdHocInspection/Get GET /integration/{siteName}/WorkOrder/Get GET /integration/{siteName}/WorkOrder/Get/{id} GET /integration/{siteName}/WorkOrder/GetWithInspections/{id} GET /integration/{siteName}/WorkOrder/Inspections/{id} POST /integration/{siteName}/Tag/Post POST /integration/{siteName}/WorkOrder/Post PUT /integration/{siteName}/Tag/Put/{id} PUT /integration/{siteName}/WorkOrder/Status/{id}Found on 2026-02-16 15:18
-
-
Open service 20.90.134.14:443 ยท wcdemo.dev.arnlea.one
2026-01-23 11:06
HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Fri, 23 Jan 2026 11:06:37 GMT Location: https://wcdemo.dev.arnlea.one/Identity/Account/Login?ReturnUrl=%2F Set-Cookie: ARRAffinity=a3b16d20d800a4419233074ddbba9273740533f5f980aaeb88608d3e082f144f;Path=/;HttpOnly;Secure;Domain=wcdemo.dev.arnlea.one Set-Cookie: ARRAffinitySameSite=a3b16d20d800a4419233074ddbba9273740533f5f980aaeb88608d3e082f144f;Path=/;HttpOnly;SameSite=None;Secure;Domain=wcdemo.dev.arnlea.one Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:37c93590-7cc9-48be-a37e-ced6c31a4d1c X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Referrer-Policy: same-origin Content-Security-Policy: font-src 'self' data: default-src 'self' 'unsafe-inline' 'unsafe-eval' ajax.aspnetcdn.com cdnjs.cloudflare.com cdnjs.com kendo.cdn.telerik.com fonts.googleapis.com fonts.gstatic.com; Permissions-Policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=*, execution-while-out-of-viewport=*, fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=*, payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=*, xr-spatial-tracking=(), clipboard-read=(), clipboard-write=*, gamepad=(), speaker-selection=()
Found 2026-01-23 by HttpPluginCreate report