Exploitable CORS allows attacker-controlled pages to read authenticated API responses on behalf of any victim who visits the page while logged in. No phishing needed — just a link that any logged-in user clicks.

Stack traces accelerate every other attack. SQL queries confirm injection points. Framework versions map to known CVEs. File paths reveal code structure. Each piece of exposed information reduces the attacker’s work for the next attack.

An unauthenticated admin endpoint can expose all user data, allow account takeover, or provide RCE (e.g., Spring Boot Actuator /actuator/restart, Kubernetes dashboard pod exec). Tesla: cryptomining. In worse cases: data exfiltration, ransomware deployment.

APIs served over HTTP expose all traffic to network-level interception on the same network (coffee shop, corporate network, ISP). Authentication tokens, session cookies, and API responses are readable by any on-path observer.

A read-only endpoint that also responds to DELETE or PUT allows modification or deletion of data without any authorization check — because the developer never implemented those methods (they “shouldn’t” be called). The framework routes them anyway.