./web-app/login.php:9 Password ''$password'' found in URL inside 'SELECT * FROM users WHERE username='$username' AND password='$password''.

./web-app/login.php:9 Password ''$password'' found in URL inside 'SELECT * FROM users WHERE username='$username' AND password='$password''.

Finished scanning, we have 4 findings.

SQL query and a user controlled variable are concaternated. That does not sound good but is no direct indication of a vulnerability as the variable could be filtered or checked.

SQL query-like string literal 'SELECT * FROM users WHERE username='$username' AND password='$password'' contains '$', which could mean variable concaternation.