Articles
- Application-level Denial of Service (DoS)
- Broken Function Level Authorization
- Clickjacking
- Cross-origin resource sharing (CORS) Misconfiguration
- Cross-Site Request Forgery (CSRF)
- Disabled TLS Certificate Validation
- DOM Cross-Site-Scripting (XSS)
- GraphQL Introspection and Query Depth Abuse
- Hardcoded Credentials
- Host Header Injection
- HSTS not Implemented
- HTTP Response Header Injection (CRLF)
- HttpOnly Flag not set
- Insecure Deserialization in Python (Pickle)
- Insecure direct object references (IDOR)
- Insecure Password Reset – Token Exposed in Response
- Insecure Password Storage
- Insecure Randomness in Security Tokens
- Insufficient Account Lockout Policy
- Java Deserialization
- JWT Authentication Bypass
- LDAP Injection
- LLM01: Prompt Injection
- LLM02: Sensitive Information Disclosure
- LLM03: Supply Chain Vulnerabilities in AI Systems
- LLM04: Data and Model Poisoning
- LLM05: Improper Output Handling
- LLM06: Excessive Agency in AI Agents
- LLM07: System Prompt Leakage
- LLM08: Vector and Embedding Weaknesses
- LLM09: Misinformation and Overreliance
- LLM10: Unbounded Consumption
- Local File Inclusion
- Log Injection
- Mass Assignment
- Missing Content-Security-Policy Header
- Missing Rate Limiting on APIs
- Missing Session Expiry and Logout Invalidation
- NoSQL Injection
- Open Redirection
- Prototype Pollution
- Race Condition (TOCTOU)
- Reflected Cross-Site-Scripting (XSS)
- Regular Expression Denial of Service (ReDoS)
- Remote Code Execution (RCE)
- Remote File Inclusion (RFI)
- Secure Cookie not set
- Sensitive Data Stored in Browser Storage
- Server-Side Request Forgery (SSRF)
- Server-side template injection (SSTI)
- Session Fixation
- SQL Injection
- Stored Cross-Site-Scripting (XSS)
- Unrestricted File Upload
- Use of Weak Cryptographic Algorithms
- Verbose Error Messages and Stack Trace Disclosure
- Weak Password Policy
- XPath Injection
- XXE Injection
- Zip Slip (Insecure Archive Extraction)