I've been running some scans across a few different networks and on certain sites I will get a flag about an unidentified exploit in the log. When I review what the exploit is, most of the time its a POST'ed value similar to what an SQLi looks like. But after doing some testing they aren't SQL injections.
They mostly look like
d'%4([random texts])90mhitoe24z'"0. with in a button or somewhere in a form. Are these false positives or are they actual exploits that aren't defined in the plugin code for w3af?