The state of a web application when it's vulnerable to attack due to an insecure configuration.