Vulnerabilities
From SQL injection to SSRF: what it is, how an attack works and how to fix it.
A01:2025Broken Access Control15 articles
- Broken access controlBroken access control explained: horizontal and vertical privilege escalation, forced browsing, and how deny by default fixes it server-side.
- Insufficient function level authorizationAn admin function merely hidden from the menu stays reachable through a direct request. Learn how to enforce authorisation per function.
- Insufficient object level authorization in APIsAn API that only checks whether you are logged in, not whether this record is yours, hands over other people's data. Learn how to enforce it.
- Privilege escalationPrivilege escalation explained: how attackers gain admin rights through a client-trusted role field or an unprotected admin route, and how to stop it.
- Server-side request forgery (SSRF)Server-side request forgery (SSRF) explained: how attackers abuse your server to reach internal systems and cloud services, and how to prevent it.
- API responses contain too much dataAn API returning whole database records and leaving the filtering to the frontend leaks fields nobody was meant to see.
- Cross-site WebSocket hijackingA WebSocket connection falls outside the same-origin policy. Without an Origin check, a foreign site can read along and send along.
- Information disclosureInformation disclosure explained: how stack traces, .git directories, source maps and over-sharing API responses leak data, and how to stop it.
- Insecure direct object reference (IDOR)IDOR explained: how attackers tamper with IDs in URLs or APIs to read or change other users' data, and how to detect and prevent this vulnerability.
- IP address trusted from a headerIf your application derives the IP address from a header, the client decides that address. Learn how that bypasses limits and access rules.
- Mass assignmentMass assignment explained: how binding a whole request body onto a model makes isAdmin or balance writable, and how an allowlist prevents it.
- Path traversal (directory traversal)Path traversal (directory traversal) explained: how attackers use ../ to escape the intended folder and read sensitive server files, and how to prevent it.
- Session stays valid after an account is deletedA blocked or deleted account with an active session often keeps its access. Learn why that happens and how to enforce revocation.
- Cross-site request forgery (CSRF)Cross-site request forgery (CSRF) explained: how an attacker abuses a logged-in user's browser to perform unwanted actions, and how you prevent it.
- Open redirectOpen redirect explained: how a returnUrl parameter sends visitors to a phishing site, which bypasses work, and how to redirect safely.
A02:2025Security Misconfiguration22 articles
- Debug mode enabled in productionAn active debug mode or profiler exposes configuration, queries and sometimes a console. Learn how that is abused and how to switch it off.
- Default web server files reachableSample pages, admin consoles and installation files left after setup reveal your platform and are sometimes directly abusable.
- Source code publicly accessibleA published .git folder or backup file gives away your entire source code, including passwords from old commits. Learn how to prevent that.
- Unnecessary services reachable from the internetDatabases, admin ports and monitoring interfaces exposed to the internet are found within minutes. Learn how to shrink that surface.
- Directory structure visibleWith directory listing on, the web server shows the contents of every folder without an index file. Learn what an attacker finds there.
- GraphQL introspection and unprotected fieldsIntrospection exposes your entire GraphQL schema, including fields your frontend never requests. Learn how to cover that.
- Insecure CORS configurationA CORS policy that reflects any origin gives foreign sites access to your API on behalf of logged-in users. Learn how to set it correctly.
- Outdated API versions remain reachableAn old API version left running beside the new one misses the checks added later. Learn how attackers use that detour.
- Security misconfigurationSecurity misconfiguration explained: how default passwords, debug modes and open cloud buckets let attackers in, and how to harden your systems.
- Sending email on behalf of your domainWithout correct SPF, DKIM and DMARC records anyone can send email on behalf of your domain. Learn how to close that without losing mail.
- XML external entity injection (XXE)XML external entity injection (XXE) explained: how attackers abuse an XML parser to read files and reach internal systems, and how to prevent it.
- ClickjackingClickjacking explained: how an attacker loads your site invisibly in a frame and captures your users' clicks, and which headers block it.
- CSP allows inline scripts and evalA CSP with unsafe-inline or unsafe-eval no longer stops cross-site scripting. Learn why, and how nonces and hashes let you drop those exceptions.
- Metadata in published filesDocuments and photos carry hidden data: names, internal paths, software and sometimes locations. Learn how to strip it before publishing.
- MIME sniffing not disabledWithout X-Content-Type-Options the browser may guess what a file is. Learn how an uploaded file can end up running as script on your domain.
- Missing Content Security PolicyWithout a Content Security Policy the browser may load scripts from any source. Learn what a CSP does, how to build one, and which mistakes make it useless.
- Sensitive data shared with analytics servicesAnalytics and error reporting scripts forward page titles, URLs and sometimes form contents. Learn what travels along and how to limit it.
- Unsafe HTTP methods permittedTRACE, PUT and DELETE on a web server are rarely needed and sometimes abusable. Learn which methods to disable and why OPTIONS leaks information.
- Internal IP addresses and hostnames exposedInternal addresses and server names in headers, error messages or redirects sketch your network for an attacker. Learn where they leak.
- Missing Permissions-PolicyA Permissions-Policy records which browser features your site may use. Learn how to switch off camera, microphone and location centrally.
- Missing Referrer-PolicyBrowsers tell external sites which page a visitor came from. Learn when your full URL leaks with it and how a Referrer-Policy bounds that.
- Version information in HTTP headersHeaders such as Server and X-Powered-By state exactly which software you run. Learn why that eases targeted scanning and how to remove them.
A03:2025Software Supply Chain Failures1 article
A04:2025Cryptographic Failures5 articles
- Insecure password storageMD5, SHA-1 and encryption are unsuitable for passwords. Learn which algorithms belong and how to migrate without inconveniencing users.
- Cryptographic failuresCryptographic failures explained: MD5 for passwords, ECB mode, hardcoded IVs and home-grown crypto, and why Argon2id and AES-GCM are the fix.
- Insecure transport and weak TLSInsecure transport explained: plain HTTP, missing HSTS, outdated TLS versions and cookies without Secure, and how to enforce HTTPS everywhere.
- Missing HTTP Strict Transport SecurityWithout HSTS a user's first request can travel unencrypted. Learn how a downgrade attack works and how to configure the header correctly.
- Weak DKIM keyA DKIM key of 1024 bits or shorter can be broken with modern means. Learn how to move to 2048 bits and why rotation belongs with it.
A05:2025Injection12 articles
- NoSQL injectionNoSQL injection explained: how attackers send MongoDB operators such as $ne in a JSON body, what it gets them, and how validation shuts it down.
- OS command injectionOS command injection explained: how shell metacharacters reach a system call, what an attacker gains, and why argument arrays without a shell fix it.
- Remote code execution (RCE)Remote code execution (RCE) explained: how attackers run their own commands or code on your server through unvalidated input, and how to prevent it.
- Server-side template injection (SSTI)Server-side template injection (SSTI) explained: how attacker input reaches the template engine, leads to remote code execution, and how to prevent it.
- SQL injectionSQL injection explained: how attackers use unfiltered input to read or change your database, what the impact is, and how prepared statements stop it.
- CRLF injection and HTTP response splittingCRLF injection explained: how a line break in an HTTP header splits a response or forges a Set-Cookie, and how to shut the problem down for good.
- Cross-site scripting (XSS)Cross-site scripting (XSS) lets attackers inject malicious scripts into web pages that run in visitors' browsers. Learn how XSS works and how to prevent it.
- Cross-site scripting through file uploadAn uploaded SVG or HTML served from your own domain runs script within your origin. Learn how to close that off.
- CSV injection in export filesAn exported CSV can contain formulas that Excel executes on your colleague's computer. Learn how that works and how to prevent it.
- Host header injectionIf your application builds links from the Host header, the attacker decides where they point. Learn how that hijacks password resets.
- LDAP injectionLDAP injection explained: how attackers use filter metacharacters to bypass login, and how RFC 4515 escaping plus a real bind shuts the attack down.
- Prototype pollutionPrototype pollution explained: how __proto__ slips through a recursive merge into Object.prototype, what an attacker gains, and how to close the route.
A06:2025Insecure Design4 articles
- Unrestricted file uploadAn upload function without restrictions can lead to code execution on your server. Learn which checks are needed and which are not enough.
- Input validation missing on the serverValidation that only happens in JavaScript can be bypassed with one direct request. Learn why the server must check every value again.
- Uploading malicious files is possibleAn upload function without content checking turns your platform into a malware carrier, with your domain name providing the credibility.
- No rate limiting on the APIWithout rate limiting an API can be queried without end. Learn how that leads to data theft, cost abuse and outages.
A07:2025Authentication Failures19 articles
- Broken authenticationBroken authentication explained: how attackers take over accounts through brute force, leaked passwords and predictable session tokens, and how to stop them.
- JWT vulnerabilitiesJWT vulnerabilities explained: alg:none, HS256/RS256 confusion, unverified signatures and missing claim checks, plus how to verify a token safely.
- Application uses Basic AuthenticationBasic Authentication sends the password with every request in a reversible encoding. Learn the risks and what the alternatives are.
- Brute force and credential stuffingBrute force and credential stuffing explained: how attackers guess passwords or replay leaked logins, and how throttling and MFA shut both attacks down.
- JWT stays valid after logoutA JWT is valid until its expiry and takes no notice of logging out. Learn how to revoke tokens without losing the benefits.
- Multi-factor authentication can be disabled without verificationA second factor that can be switched off in one click only protects against attackers who do not think of it. Learn how to close that.
- Multi-factor authentication is missingWithout a second factor, a leaked password is enough for full access. Learn which MFA methods offer protection and which do not.
- Multi-factor authentication is not enforcedMFA that is available but not mandatory gets enabled by few users. Learn how to enforce it without locking your users out.
- No re-authentication for sensitive changesChanging an email address or password without asking for the current password turns any hijacked session into a permanent takeover.
- Session fixationSession fixation explained: how an attacker plants a session id in advance, why logging in keeps it valid, and how rotating the id prevents it.
- Session identifier in the URLA session ID in the URL ends up in log files, browser history and referrer headers. Learn why that leaks sessions and how to fix it.
- Authentication cookie valid for too longA session cookie valid for months turns every stolen token into a lasting key. Learn how to build remember-me safely.
- Discovering valid usernamesDifferent error messages at login reveal which accounts exist. Learn how attackers abuse that and how to make the responses identical.
- Session stays valid after logoutA logout that only clears the cookie leaves the token intact on the server. Learn how a captured session then simply keeps working.
- Sessions do not expireA session without an expiry stays usable forever. Learn why that makes stolen tokens valuable and how to set a sensible timeout.
- Unprotected authentication cookieA session cookie without HttpOnly, Secure and SameSite is readable, interceptable and abusable. Learn what each attribute actually covers.
- Weak password requirementsComplexity rules produce weaker passwords than length and a blocklist. Learn which requirements actually work under current guidance.
- Password fields are autofilledAutofilling passwords is desirable on a login form, but not on every field. Learn where it does call for a setting.
- SameSite attribute set to Lax instead of StrictSameSite=Lax still lets cookies travel with navigation from external sites. Learn when that is a risk and when Strict is the better choice.
A08:2025Software or Data Integrity Failures2 articles
- Insecure deserializationInsecure deserialization explained: how untrusted pickle, PHP unserialize or Java readObject data becomes a gadget chain and remote code execution.
- External scripts without integrity checkingLoading JavaScript from a CDN without an integrity attribute means every change there runs straight on your site. Learn how SRI blocks that.