Structured reference from injection to authentication flaws, with real CVEs, HackerOne reports and code-level prevention.
15 vulnerability classes · 77 variants
OS command injection (CWE-77/CWE-78) lets attackers run arbitrary OS commands on the host server, enabling remote code execution and full system compromise.
SQL injection (CWE-89, OWASP A05:2025) manipulates database queries to extract credentials, bypass authentication, and achieve RCE via xp_cmdshell.
Server-Side Template Injection tricks the template engine into executing attacker-controlled expressions, often leading to Remote Code Execution.
XXE (CWE-611) exploits XML parsers that resolve external entities, enabling file disclosure, SSRF, and RCE. One parser flag eliminates the class.
CSRF (CWE-352, OWASP A01:2025) forces authenticated users to execute unwanted state-changing requests by exploiting browser cookie auto-send.
Open redirect (CWE-601) lets attackers hijack trusted redirect parameters to send users to controlled URLs — phishing, OAuth token theft, and SSRF escalation.
XSS (CWE-79, OWASP A05:2025) lets attackers inject JavaScript into pages served to other users — session theft, credential harvesting, and account takeover.
IDOR (CWE-639) is the object-level form of OWASP A01:2025 Broken Access Control, the #1 risk. Swap an object ID to reach another user's records.
Path traversal (CWE-22) lets attackers escape an intended directory with ../ sequences to read sensitive files or chain to RCE via log poisoning.
JWT vulnerabilities (CWE-287): algorithm confusion, secret brute-force, and key-source injection — all bypass authentication when tokens are misconfigured.
Session fixation (CWE-384) lets an attacker pre-set a victim's session ID before login, then hijack the authenticated session without intercepting cookies.
Business logic flaws abuse valid application features in unintended ways — price manipulation, workflow skipping, race conditions, and discount stacking.
Mass assignment lets attackers write object fields never meant to be user-controlled, escalating to role=admin through ORM auto-binding.
Race conditions (CWE-362) exploit timing gaps between check and action — coupon reuse, balance manipulation, and limit overflows via single-packet HTTP/2.
SSRF (CWE-918, OWASP A01:2025) forces a server to request internal resources — cloud metadata credentials, IMDSv1 tokens, and internal services.
