Mysql

A 4-digit PIN with no rate limiting falls to brute force, the dashboard’s ORDER BY sort is blind-SQL-injectable, and the home-made sanitizer only strips ‘<’ — so boolean extraction with ‘>’ dumps the secrets table.