CommanderRE

import java.sql.*;
import java.security.MessageDigest;

public class UserPortal {
    // VULNERABILITY 1: Hardcoded sensitive credentials
    private static final String DB_URL = "jdbc:mysql://localhost:3306/users";
    private static final String DB_USER = "admin";
    private static final String DB_PASS = "P@ssword123!";

    public void login(String username, String password) {