Exploitability Analysis

See which vulnerabilities are actually exploitable.

Farion connects SAST and SCA findings to the routes, functions, data flows, dependencies, and deployed targets through which an attacker could reach them. Each verdict is based on reviewable application evidence instead of severity alone.

Access requests are reviewed within one business day.

A vulnerability becomes relevant when an attacker can reach it.

A package can contain a vulnerable function without the application ever calling it. A dangerous sink can exist without receiving controllable input. Farion evaluates the complete path from an external entry point to the affected operation before a finding is prioritized.

Route Analysis

Findings grouped by route

Farion attaches every finding to the HTTP route, RPC endpoint, or message handler it belongs to — you start from an application path, not one endless global list.

SCA, SAST and active verification, correlated

Open a route and every signal is already there — vulnerable dependencies, code findings, and active-verification results, all tied to the same path. Switch between them without losing context.

Evidence-backed exploitability verdict

See the vulnerable source, the data flow that reaches the sink, and Farion's AI verdict with its supporting evidence — the full case for whether a finding is truly exploitable.

An automated fix, ready to ship

Analysis becomes remediation: a concrete patch with a reviewable code diff and a prepared pull request.

SQL injection in user lookup query

HIGHLine 47•AI confidence: 92%

Hardcoded JWT secret detected

MEDIUMLine 58•AI confidence: 88%

A03:2021 – SQL injection in user lookup query

CWE-89•SAST•HIGH

User-supplied email from req.body is concatenated directly into a raw SQL string without parameterization, allowing an attacker to inject arbitrary SQL commands.

AI Analysis by Farion

True Positive

SQL injection confirmed: user input from req.body.email is concatenated into a raw SQL query without parameterization.

Key Evidence:

•String concatenation in SQL query at line 47

•Input flows from req.body.email

DATA FLOW ANALYSIS: Shows how tainted data flows from source to exploitable sink

src/routes/auth.js → Client.query

Library sinkClient.query

DATA FLOW:

src/lib/db.js (db.js:12 query)

12
async function query(sql) {
13
  const client = await pool.connect();
14
  const result = await client.query(sql);
15
  client.release();
16
  return result;
17
}

Deterministic evidence first

AI evaluates an application model, not an isolated alert.

Farion first resolves routes, functions, concrete object instances, dependency injection, call paths, and field-sensitive data flows. AI is used after this analysis to interpret the evidence, assess exploitability, and generate a remediation. The complete repository is never sent to a language model.

Sources

Native parsing

Java

JavaScript

TypeScript

Python

Rust

Farion Dataflow Engine

Farion Security Scanner

Farion Security AI

Farion ThreatIntel Database

NVD

GHSA

CISA KEV

EPSS

Red Hat

Debian

Ubuntu

Alpine

SUSE

Findings

Reviewable verdicts

Every decision remains connected to its evidence.

An exploitability verdict includes the route, affected code, source-to-sink path, dependency context, advisory information, known exploit signals, confidence, and supporting reasoning. Security teams can review the evidence directly instead of trusting a standalone score.

AI Analysis by Farion

True Positive

This CVE-2024-38816 path traversal in spring-webmvc is reachable through the /api/v1/files/upload endpoint. The vulnerable FileSystemResource is directly instantiated with user-controlled input from the request path parameter without sanitization.

Key Evidence:

•User input flows from REST controller to FileSystemResource constructor without validation

•Public exploit available (Metasploit module since Sept 2024)

•EPSS 0.89 — high exploitation probability (top 1% of CVEs)

•No WAF or input filter detected in the request chain

From assessment to remediation

Fix the finding inside the same workflow.

Assign the finding, adjust its priority, discuss the result, generate an AI patch, create a pull or merge request, and track the change through merge and deployment. The complete sequence remains visible in the Finding History and Audit Log.

	Name	Exploitability	CVEs	CWEs
	POST /auth/login	5/5	7	7
SQL injection in user lookup query HIGHLine 47•AI confidence: 92% Hardcoded JWT secret detected MEDIUMLine 58•AI confidence: 88% A03:2021 – SQL injection in user lookup query CWE-89•SAST•HIGH User-supplied email from req.body is concatenated directly into a raw SQL string without parameterization, allowing an attacker to inject arbitrary SQL commands. AI Analysis by Farion True Positive SQL injection confirmed: user input from req.body.email is concatenated into a raw SQL query without parameterization. Key Evidence: •String concatenation in SQL query at line 47 •Input flows from req.body.email DATA FLOW ANALYSIS: Shows how tainted data flows from source to exploitable sink src/routes/auth.js → Client.query Library sinkClient.query DATA FLOW: src/routes/auth.js (auth.js:45 loginHandler) 45 router.post('/api/auth/login', async (req, res) => { 46 const { email, password } = req.body; - 47 const query = 'SELECT * FROM users WHERE email = \'' + email + '\''; + 47 const query = { text: 'SELECT * FROM users WHERE email = $1', values: [email] }; 48 const result = await db.query(query); 49 res.json(result.rows[0]); 50 });
	GET /users/api	4/5	7	7
	PUT /users/:id	4/5	5	3
	DELETE /users/:id	4/5	4	3
	GET /restaurants/:id/menu	3/5	5	5
	GET /restaurants/feed	3/5	5	2
	POST /payments/checkout	3/5	3	2
	POST /auth/reset-password	3/5	3	2
	GET /users/:id/profile	2/5	2	1
	GET /admin/dashboard	2/5	2	1
	POST /orders	1/5	1	1
	PUT /orders/:id/status	1/5	1	1
	GET /restaurants/:id	-	1	—
	GET /orders/:id/track	-	1	—
	GET /search/export	-	1	—
	GET /orders	-	1	—
	GET /health	-	—	—
	GET /config/features	-	1	—

Frequently asked questions

Yes. SAST findings are evaluated through routes, sources, sinks, and data flows. SCA findings add dependency usage, vulnerable-function reachability, tainted paths, fix information, and current vulnerability intelligence.

No. Farion produces deterministic application evidence first. The AI verdict interprets the resulting code, data-flow, dependency, and threat-intelligence context.

Yes. After target ownership and authorization have been verified, Farion can use static-analysis context to generate targeted exploit tests against the configured application.

Questions to answer before a technical evaluation

How Farion constructs routes and cross-file data flows

See the answer

Which languages and frameworks Farion supports

See the answer

How source-code and AI processing are controlled

See the answer

How Farion verifies a verdict against the running application

See the answer

See how Farion works on your application.

Request a guided evaluation or walk through the relevant workflow with our technical team.

Access requests are reviewed within one business day.

See which vulnerabilities are actually exploitable.

A vulnerability becomes relevant when an attacker can reach it.

Findings grouped by route

SCA, SAST and active verification, correlated

Evidence-backed exploitability verdict

An automated fix, ready to ship

SQL injection in user lookup query

Hardcoded JWT secret detected

A03:2021 – SQL injection in user lookup query

AI Analysis by Farion

AI evaluates an application model, not an isolated alert.

Farion Dataflow Engine

Farion Security Scanner

Farion Security AI

Farion ThreatIntel Database

Findings

Every decision remains connected to its evidence.

AI Analysis by Farion

Fix the finding inside the same workflow.

SQL injection in user lookup query

Hardcoded JWT secret detected

A03:2021 – SQL injection in user lookup query

AI Analysis by Farion

Frequently asked questions

Does Exploitability Analysis work for both SAST and SCA?

Does Exploitability Analysis work for both SAST and SCA?

Does AI decide whether a finding is exploitable on its own?

Does AI decide whether a finding is exploitable on its own?

Can Farion actively verify a verdict?

Can Farion actively verify a verdict?

Questions to answer before a technical evaluation

How Farion constructs routes and cross-file data flows

See the answer

Which languages and frameworks Farion supports

See the answer

How source-code and AI processing are controlled

See the answer

How Farion verifies a verdict against the running application

See the answer

See how Farion works on your application.

See which vulnerabilities are actually exploitable.

A vulnerability becomes relevant when an attacker can reach it.

Findings grouped by route

SCA, SAST and active verification, correlated

Evidence-backed exploitability verdict

An automated fix, ready to ship

SQL injection in user lookup query

Hardcoded JWT secret detected

A03:2021 – SQL injection in user lookup query

AI Analysis by Farion

AI evaluates an application model, not an isolated alert.

Farion Dataflow Engine

Farion Security Scanner

Farion Security AI

Farion ThreatIntel Database

Findings

Every decision remains connected to its evidence.

AI Analysis by Farion

Fix the finding inside the same workflow.

SQL injection in user lookup query

Hardcoded JWT secret detected

A03:2021 – SQL injection in user lookup query

AI Analysis by Farion

Frequently asked questions

Does Exploitability Analysis work for both SAST and SCA?

Does Exploitability Analysis work for both SAST and SCA?

Does AI decide whether a finding is exploitable on its own?

Does AI decide whether a finding is exploitable on its own?

Can Farion actively verify a verdict?

Can Farion actively verify a verdict?

Questions to answer before a technical evaluation

How Farion constructs routes and cross-file data flows

See the answer

Which languages and frameworks Farion supports

See the answer

How source-code and AI processing are controlled

See the answer

How Farion verifies a verdict against the running application

See the answer

See how Farion works on your application.