Structured reference — from injection to authentication flaws. Real CVEs, HackerOne reports, and code-level prevention.
15 vulnerability classes · 92 variants
OS command injection (CWE-77/CWE-78) lets attackers run arbitrary OS commands on the host server, enabling remote code execution and full system compromise.
SQL injection (CWE-89, OWASP A03:2021) manipulates database queries to extract credentials, bypass authentication, and achieve RCE via xp_cmdshell or COPY TO PROGRAM.
Server-Side Template Injection tricks the server's template engine into executing attacker-controlled expressions, often leading directly to Remote Code Execution.
XXE (CWE-611) exploits XML parsers that resolve external entities, enabling file disclosure, SSRF, and RCE in some configurations. One parser flag eliminates the attack class.
CSRF (CWE-352, OWASP A01:2021) forces authenticated users to execute unwanted state-changing requests by exploiting browser cookie auto-send.
Open redirect (CWE-601) lets attackers hijack trusted redirect parameters to send users to controlled URLs — phishing, OAuth token theft, and SSRF escalation.
XSS (CWE-79, OWASP A03:2021) lets attackers inject JavaScript into pages served to other users — session theft, credential harvesting, and account takeover.
IDOR (CWE-639, OWASP A01:2021) lets attackers access any user's records by swapping an object ID — the #1 cause of SaaS data breaches and 49% of all critical bug bounty findings.
Path traversal (CWE-22) lets attackers escape an intended directory with ../ sequences to read sensitive files, chain to RCE via log poisoning, or escape containers entirely.
JWT vulnerabilities (CWE-287): algorithm confusion, secret brute-force, and key-source injection — all bypass authentication entirely when tokens are misconfigured.
Session fixation (CWE-384) lets an attacker pre-set a victim's session ID before login, then hijack the authenticated session without intercepting cookies.
Business logic flaws abuse valid application features in unintended ways — price manipulation, workflow skipping, race conditions, and discount stacking that scanners rarely catch.
Mass assignment vulnerabilities let attackers modify object fields that should never be user-controlled, enabling privilege escalation and data corruption via ORM auto-binding.
Race conditions (CWE-362) exploit timing gaps between check and action — coupon reuse, balance manipulation, and limit overflows via single-packet HTTP/2.
SSRF (CWE-918, OWASP A10:2021) forces a server to request internal resources — cloud metadata credentials, IMDSv1 tokens, and internal services exposed to full takeover.
