Remote Code Execution (RCE)
Remote Code Execution enables attackers to execute arbitrary commands or code on a target server, representing the most severe class of vulnerability that leads to complete system compromise.
Broken Authentication
Broken Authentication encompasses flaws in identity verification mechanisms that allow attackers to compromise passwords, session tokens, or authentication flows to impersonate legitimate users.
Insecure Deserialization
Insecure Deserialization allows attackers to manipulate serialized objects to achieve remote code execution, privilege escalation, or data tampering by exploiting an application's trust in serialized data.
SQL Injection
SQL Injection allows attackers to manipulate database queries by injecting malicious SQL code through unsanitized user input, leading to data theft, authentication bypass, and full database compromise.
Insecure Direct Object References (IDOR)
Insecure Direct Object References allow attackers to access or modify resources belonging to other users by manipulating object identifiers such as database IDs, filenames, or keys in API requests.
Server-Side Request Forgery (SSRF)
Server-Side Request Forgery allows attackers to coerce a server into making HTTP requests to arbitrary destinations, enabling access to internal services, cloud metadata endpoints, and protected networks.
Privilege Escalation
Privilege Escalation vulnerabilities allow attackers to gain elevated access rights beyond their authorized level, moving from low-privilege users to administrators or from application access to system-level control.
Cross-Site Scripting (XSS)
Cross-Site Scripting enables attackers to inject malicious scripts into web pages viewed by other users, leading to session hijacking, credential theft, and full account takeover.
Path Traversal
Path Traversal vulnerabilities allow attackers to access files and directories outside the intended scope by manipulating file path references with directory traversal sequences like ../ in application requests.
XML External Entity (XXE)
XML External Entity injection exploits misconfigured XML parsers to read local files, perform server-side request forgery, execute denial of service attacks, and in some cases achieve remote code execution.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery forces authenticated users to execute unintended actions on web applications by exploiting the browser's automatic inclusion of credentials in cross-origin requests.