Web infrastructure consists of Server infrastructure and Application code. If the Web-infrastructure is vulnerable, application also becomes vulnerable to attackers, even if application is audited/ hardened. As time progresses Penetration Testers find vulnerabilities in web infrastructure components (Software components include Operating system, Content Management System (CMS), Plugins, Vendor specific software etc.). These vulnerabilities are published/ reported in security forums. These vulnerabilities are called known Component vulnerabilities in software. Software vulnerabilities publishing is still process for disclosing vulnerabilities publicly. National vulnerability database (NVD) is one such database which publishes Common vulnerability enumeration (CVE) for vulnerabilities including web infrastructure, CMS etc. Old version software contains vulnerabilities, which need to be patched or updated to latest versions/patches. Metadata information of Webservers, CMS and errors gives web infrastructure information. Attackers perform identification of web-infrastructure information from website using fingerprinting tools from different metadata (headers, default installation file comments, and configuration files) handlers. Vulnerable Scanners have database of all CVE and privileged (undisclosed vulnerabilities) for different platforms. Insecure libraries and plugins are continuously published in security forums. All these leads to high attack success for attackers. Malicious users continuously scan internet for vulnerable applications to deface/leak critical data/ phishing etc. Malicious users also perform supply chain attack on software before release to make them use by production systems, example of one such release is php8.1.0.-dev [zerodium vulnerability]. Third party libraries are extensively in application usage due to ease of use. These libraries usage, testing and maintaining is very difficult for production environments because of sole dependency of third party groups. Software vendors/publishers component security releases are common if software is prone to security issues. Popular web CMS Drupal, Joomla and WordPress had multiple security releases in the past. Identifying these CMS components were very easy to identify as the structure and display of these systems/live Websites are publicly available. Tools to detect lower version Opensource Scanners (such as whatweb and wappalyzer) allow filtering of Web-Infrastructure details by scraping the headers, default installations. Open source Scanners , specific to CMS tries to identify vulnerable themes and Plugins. Examples of such scanners are wpscan, droopescan. Open source scanners altogether gives full initial assessment of web applications. These Scanners after modifying the source codes can also be used as full-fledged fuzzing tools for particular vulnerabilities. Enterprise scanners provide full security scan of applications including CMS and other applications. These scanners have also support from respective vendors Patching Web infrastructure Server hardening is one such process to stop disclosing server technical metadata for finger printers/ scrappers. It may not stop fully, if attacker uses automated exploits on applications. Organizations should know patch requirement applications based on asset collection for updating/ upgrading/virtual patching (through Web Application Firewall-WAF). Virtual patching can be applied by putting the website behind WAF. Patches should be incorporated for Critical Security updates of software releases on regular basis. Minor patches applying to software is less difficult when compared to major version(s), in the production systems, as any downtime in production environment, may not be feasible. Applying updates and configuration changes are required throughout the application lifetime to make it free from vulnerabilities.