Vulnerabilities

Injection · A05:2025 — Injection

User input alters the structure of a database query.

Injection · A05:2025 — Injection

Attacker-controlled script runs in victims' browsers.

Session · CWE-352

Victim's browser is tricked into sending authenticated requests.

Injection · A01:2025 — Broken Access Control

Server is made to request attacker-chosen URLs.

Access Control · A01:2025 — Broken Access Control

Changing an identifier exposes other users' data.

Authentication · A07:2025 — Authentication Failures

Weak login, password and session mechanisms.

Access Control · A01:2025 — Broken Access Control

Users perform actions beyond their role.

Injection · CWE-78

Input is executed by the OS shell.

File Access · CWE-22

../ sequences access files outside intended directory.

File Access · CWE-434

Malicious files uploaded and executed or served.

Configuration · A02:2025 — Security Misconfiguration

Insecure defaults, verbose errors, open storage.

Injection · A05:2025 — Injection · A02:2025 — Security Misconfiguration

XML parser resolves attacker-controlled external entities.

Injection · A08:2025 — Software or Data Integrity Failures

Untrusted data is deserialized into objects/code paths.

Access Control · CWE-601

App redirects users to attacker-chosen URLs.

UI Redress · CWE-1021

Victim UI is framed so clicks hit hidden controls.

Logic · CWE-362

Time-of-check vs time-of-use lets parallel requests bypass limits.

Access Control · CWE-915

Client sets privileged fields (role, isAdmin) via JSON/form.

Injection · CWE-94

User input is evaluated inside a server template engine.

Access Control · CWE-942

Over-permissive Access-Control-Allow-Origin with credentials.

Configuration · A04:2025 — Cryptographic Failures

Secrets, PII, or verbose errors leak to clients/logs.

Session · CWE-384

Predictable or fixable session IDs; missing rotation on login.

Memory · CWE-120

Writes past allocated buffer bounds corrupt memory / control flow.

Access Control · CWE-269

Low-privilege user gains admin/root/SYSTEM.

Authentication · CWE-347

alg=none, weak secrets, or trusting unverified claims.

Injection · CWE-90

User input alters LDAP query structure.

Logic · CWE-840

Workflow abuse (price tampering, step skipping) without classic inject payload.

Protocol · A02:2025 — Security Misconfiguration

Front/back servers parse HTTP boundaries differently.

Injection · CWE-113

CRLF in headers splits response into two.

Configuration · CWE-1021

Content-Security-Policy allows unsafe-inline or overly broad sources.

Authentication · CWE-863

Insecure redirect URIs, missing PKCE/state, token leakage.

Authentication · CWE-347

Server accepts unexpected alg (none/HS/RS confusion).

API Security · CWE-285

Resolver functions lack object-level authorization.

Session · CWE-1385

Missing Origin checks, auth gaps, message injection.

Logic · CWE-444

Unkeyed inputs influence cached responses for other users.

Logic · CWE-525

Attacker tricks cache to store private content at public URL.

Injection · CWE-644

App trusts Host header for links/password reset.

Injection · CWE-643

User input in XPath queries alters logic.

Injection · CWE-943

Operators injected into MongoDB-style queries.

Configuration · CWE-16

Privileged containers, root user, exposed sockets.

Access Control · CWE-269

Over-broad Roles/ClusterRoleBindings.

Cloud · CWE-284

Wildcard IAM, public buckets, open security groups.

Configuration · CWE-798

API keys/passwords in repos, images, or logs.

Supply Chain · CWE-1104

Known CVEs in third-party libraries.

Supply Chain · CWE-829

Compromised build, typosquat packages, unsigned artifacts.

AI Security

User text overrides system instructions in LLM apps.

AI Security

Agents granted excessive API/shell access.

Configuration · CWE-200

Verbose errors, public buckets, debug endpoints leak secrets.