>Successful exploit doesn't require the exploit writer even knowing that vector existed to say nothing of successfully guessing a URL. I'm not following. My CG

>Successful exploit doesn't require the exploit writer even knowing that vector existed to say nothing of successfully guessing a URL. I'm not following. My CGI application is at example.com/stuff/cgi/webapp So now the attack doesn't need to append /stuff/cgi/webapp? It can just point to example.com? How does that work?