Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1b885ff431818dff1ab714ac2ab714ac2ab714ac2ab714ac2
Public Swagger UI/API detected at path: /swagger.json - sample paths:
GET /v1/{portal}/{entity}/details/{course_id}
GET /v1/{portal}/{entity}/{type}/{region}
Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1b885ff431818dff1ab714ac2ab714ac2ab714ac2ab714ac2
Public Swagger UI/API detected at path: /swagger.json - sample paths:
GET /v1/{portal}/{entity}/details/{course_id}
GET /v1/{portal}/{entity}/{type}/{region}
Open service 103.10.76.148:80 · www.etelectronicsworld.com
2026-01-23 14:56
HTTP/1.1 200 OK Date: Fri, 23 Jan 2026 15:02:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Fri, 23 Jan 2026 14:59:20 GMT Cache-Control: public, max-age=180 Access-Control-Allow-Origin: * Last-Modified: Fri, 23 Jan 2026 14:56:20 GMT Vary: Accept-Encoding Content-Language: en Access-Control-Allow-Credentials: true X-Frame-Options: sameorigin X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff
Open service 103.10.76.148:443 · www.etelectronicsworld.com
2026-01-23 07:29
HTTP/1.1 200 OK Date: Fri, 23 Jan 2026 07:35:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Fri, 23 Jan 2026 07:32:09 GMT Cache-Control: public, max-age=180 Access-Control-Allow-Origin: * Last-Modified: Fri, 23 Jan 2026 07:29:09 GMT Vary: Accept-Encoding Content-Language: en Access-Control-Allow-Credentials: true X-Frame-Options: sameorigin Strict-Transport-Security: max-age=25920000; includeSubdomains X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff