Vulnerabilities

Injection · OWASP A03:2021 · CWE-89

User input alters the structure of a database query.

Cross-Site Scripting (XSS)

Injection · OWASP A03:2021 · CWE-79

Attacker-controlled script runs in victims' browsers.

Cross-Site Request Forgery

Session · CWE-352

Victim's browser is tricked into sending authenticated requests.

Server-Side Request Forgery

Injection · OWASP A10:2021 · CWE-918

Server is made to request attacker-chosen URLs.

Insecure Direct Object Reference

Access Control · OWASP A01:2021 · CWE-639

Changing an identifier exposes other users' data.

Authentication Weaknesses

Authentication · OWASP A07:2021 · CWE-287

Weak login, password and session mechanisms.

Authorization Weaknesses

Access Control · OWASP A01:2021 · CWE-285

Users perform actions beyond their role.

Command Injection

Injection · CWE-78

Input is executed by the OS shell.

Path Traversal

File Access · CWE-22

../ sequences access files outside intended directory.

File Upload Vulnerabilities

File Access · CWE-434

Malicious files uploaded and executed or served.

Security Misconfiguration

Configuration · OWASP A05:2021 · CWE-16

Insecure defaults, verbose errors, open storage.

XML External Entity (XXE)

Injection · OWASP A05:2021 · CWE-611

XML parser resolves attacker-controlled external entities.

Insecure Deserialization

Injection · OWASP A08:2021 · CWE-502

Untrusted data is deserialized into objects/code paths.

Open Redirect

Access Control · CWE-601

App redirects users to attacker-chosen URLs.

Clickjacking

UI Redress · CWE-1021

Victim UI is framed so clicks hit hidden controls.

Race Condition / TOCTOU

Logic · CWE-362

Time-of-check vs time-of-use lets parallel requests bypass limits.

Mass Assignment

Access Control · CWE-915

Client sets privileged fields (role, isAdmin) via JSON/form.

Server-Side Template Injection

Injection · CWE-94

User input is evaluated inside a server template engine.

CORS Misconfiguration

Access Control · CWE-942

Over-permissive Access-Control-Allow-Origin with credentials.

Sensitive Data Exposure

Configuration · OWASP A02:2021 · CWE-200

Secrets, PII, or verbose errors leak to clients/logs.

Session Fixation / Weak Session

Session · CWE-384

Predictable or fixable session IDs; missing rotation on login.

Buffer Overflow

Memory · CWE-120

Writes past allocated buffer bounds corrupt memory / control flow.

Local Privilege Escalation

Access Control · CWE-269

Low-privilege user gains admin/root/SYSTEM.

JWT Misuse

Authentication · CWE-347

alg=none, weak secrets, or trusting unverified claims.

LDAP Injection

Injection · CWE-90

User input alters LDAP query structure.

Business Logic Flaw

Logic · CWE-840

Workflow abuse (price tampering, step skipping) without classic inject payload.

HTTP Request Smuggling

Protocol · CWE-444 · OWASP A05:2021

Front/back servers parse HTTP boundaries differently.

HTTP Response Splitting

Injection · CWE-113

CRLF in headers splits response into two.

CSP Misconfiguration

Configuration · CWE-1021

Content-Security-Policy allows unsafe-inline or overly broad sources.

OAuth Misconfiguration

Authentication · CWE-863

Insecure redirect URIs, missing PKCE/state, token leakage.

JWT Algorithm Confusion

Authentication · CWE-347

Server accepts unexpected alg (none/HS/RS confusion).

GraphQL Authorization Issues

API Security · CWE-285

Resolver functions lack object-level authorization.

WebSocket Security Issues

Session · CWE-1385

Missing Origin checks, auth gaps, message injection.

Web Cache Poisoning

Logic · CWE-444

Unkeyed inputs influence cached responses for other users.

Cache Deception

Logic · CWE-525

Attacker tricks cache to store private content at public URL.

Host Header Injection

Injection · CWE-644

App trusts Host header for links/password reset.

XPath Injection

Injection · CWE-643

User input in XPath queries alters logic.

NoSQL Injection

Injection · CWE-943

Operators injected into MongoDB-style queries.

Container Misconfiguration

Configuration · CWE-16

Privileged containers, root user, exposed sockets.

Kubernetes RBAC Misconfiguration

Access Control · CWE-269

Over-broad Roles/ClusterRoleBindings.

Cloud IAM Misconfiguration

Cloud · CWE-284

Wildcard IAM, public buckets, open security groups.

Exposed Secrets

Configuration · CWE-798

API keys/passwords in repos, images, or logs.

Dependency Vulnerabilities

Supply Chain · CWE-1104

Known CVEs in third-party libraries.

Software Supply Chain Risks

Supply Chain · CWE-829

Compromised build, typosquat packages, unsigned artifacts.

Prompt Injection

AI Security · OWASP LLM01

User text overrides system instructions in LLM apps.

Insecure AI Agent Permissions

AI Security · OWASP Agentic

Agents granted excessive API/shell access.

Sensitive Information Disclosure