Exploiting vulnerabilities in Johnson and Johnson web apps