Confirming and Prioritizing Web Vulnerabilities