Updates to the Revaizor vulnerability database — new vulnerability profiles, detection techniques, and remediation guidance.https://revaizor.com/en-ushttps://revaizor.com/vulnerabilities/insecure-direct-object-references/https://revaizor.com/vulnerabilities/insecure-direct-object-references/Insecure Direct Object References allow attackers to access or modify resources belonging to other users by manipulating object identifiers such as database IDs, filenames, or keys in API requests.Mon, 15 Dec 2025 00:00:00 GMThighaccess-controlCWE-639https://revaizor.com/vulnerabilities/server-side-request-forgery/https://revaizor.com/vulnerabilities/server-side-request-forgery/Server-Side Request Forgery allows attackers to coerce a server into making HTTP requests to arbitrary destinations, enabling access to internal services, cloud metadata endpoints, and protected networks.Mon, 15 Dec 2025 00:00:00 GMThighssrfCWE-918https://revaizor.com/vulnerabilities/remote-code-execution/https://revaizor.com/vulnerabilities/remote-code-execution/Remote Code Execution enables attackers to execute arbitrary commands or code on a target server, representing the most severe class of vulnerability that leads to complete system compromise.Mon, 15 Dec 2025 00:00:00 GMTcriticalinjectionCWE-94https://revaizor.com/vulnerabilities/privilege-escalation/https://revaizor.com/vulnerabilities/privilege-escalation/Privilege Escalation vulnerabilities allow attackers to gain elevated access rights beyond their authorized level, moving from low-privilege users to administrators or from application access to system-level control.Mon, 15 Dec 2025 00:00:00 GMThighaccess-controlCWE-269https://revaizor.com/vulnerabilities/broken-authentication/https://revaizor.com/vulnerabilities/broken-authentication/Broken Authentication encompasses flaws in identity verification mechanisms that allow attackers to compromise passwords, session tokens, or authentication flows to impersonate legitimate users.Mon, 15 Dec 2025 00:00:00 GMTcriticalbroken-authCWE-287https://revaizor.com/vulnerabilities/insecure-deserialization/https://revaizor.com/vulnerabilities/insecure-deserialization/Insecure Deserialization allows attackers to manipulate serialized objects to achieve remote code execution, privilege escalation, or data tampering by exploiting an application's trust in serialized data.Mon, 15 Dec 2025 00:00:00 GMTcriticaldeserializationCWE-502https://revaizor.com/vulnerabilities/path-traversal/https://revaizor.com/vulnerabilities/path-traversal/Path Traversal vulnerabilities allow attackers to access files and directories outside the intended scope by manipulating file path references with directory traversal sequences like ../ in application requests.Mon, 15 Dec 2025 00:00:00 GMThighaccess-controlCWE-22https://revaizor.com/vulnerabilities/sql-injection/https://revaizor.com/vulnerabilities/sql-injection/SQL Injection allows attackers to manipulate database queries by injecting malicious SQL code through unsanitized user input, leading to data theft, authentication bypass, and full database compromise.Mon, 15 Dec 2025 00:00:00 GMTcriticalinjectionCWE-89https://revaizor.com/vulnerabilities/cross-site-request-forgery/https://revaizor.com/vulnerabilities/cross-site-request-forgery/Cross-Site Request Forgery forces authenticated users to execute unintended actions on web applications by exploiting the browser's automatic inclusion of credentials in cross-origin requests.Mon, 15 Dec 2025 00:00:00 GMTmediumotherCWE-352https://revaizor.com/vulnerabilities/cross-site-scripting/https://revaizor.com/vulnerabilities/cross-site-scripting/Cross-Site Scripting enables attackers to inject malicious scripts into web pages viewed by other users, leading to session hijacking, credential theft, and full account takeover.Mon, 15 Dec 2025 00:00:00 GMThighxssCWE-79https://revaizor.com/vulnerabilities/xml-external-entity/https://revaizor.com/vulnerabilities/xml-external-entity/XML External Entity injection exploits misconfigured XML parsers to read local files, perform server-side request forgery, execute denial of service attacks, and in some cases achieve remote code execution.Mon, 15 Dec 2025 00:00:00 GMThighxxeCWE-611