Vulnerability Repository
In-depth reference covering web application, API, and infrastructure vulnerabilities — each with CVSS score, CWE mapping, OWASP classification, detection guidance, and concrete remediation steps.
API Key Exposure
Hardcoded or publicly leaked API keys grant attackers authenticated access to third-party services, often with billing and data implications.
Broken Authentication
Weaknesses in authentication mechanisms allow attackers to compromise passwords, session tokens, or other credentials and assume other users' identities.
Certificate Validation Bypass
Applications that skip or improperly implement TLS certificate validation are vulnerable to man-in-the-middle attacks, allowing traffic interception and credential theft.
Cloud Storage Misconfiguration
Publicly accessible cloud storage buckets expose sensitive files, backups, and internal data to unauthenticated access, frequently resulting in large-scale data breaches.
Database Credential Exposure
Database connection strings and credentials are stored or transmitted in plaintext, giving attackers direct access to backend data stores and full data compromise.
Default Credentials
Devices, services, and applications deployed with unchanged vendor-default passwords grant immediate full access to any attacker with knowledge of the default.
Docker Socket Exposure
Exposing the Docker socket to containers or the network grants root-equivalent access to the host, enabling immediate container escape and full system compromise.
Hardcoded Credentials
Passwords, API keys, and tokens embedded directly in source code or binaries are trivially extracted by anyone with access to the codebase or application files.
Insecure Deserialization
Deserializing attacker-controlled data without integrity checks enables remote code execution, authentication bypass, and object injection attacks.
JWT Algorithm Confusion
Flawed JWT validation that trusts the algorithm field allows attackers to forge tokens using the public key as an HMAC secret or by setting algorithm to 'none'.
JWT None Algorithm Attack
Servers that accept JWTs with the algorithm set to 'none' verify no signature, allowing attackers to forge tokens for any user including administrators without knowing any secret.
Kubernetes RBAC Misconfiguration
Overly permissive Kubernetes RBAC roles allow workloads or users to escalate privileges, access secrets, and achieve full cluster compromise.
Local File Inclusion (LFI)
User input is passed to a file include directive without validation, allowing attackers to include arbitrary server-side files and potentially execute their contents.
OS Command Injection
Attackers inject shell metacharacters into application inputs to execute arbitrary OS commands on the server, enabling full system compromise.
PHP Object Injection
PHP unserializes attacker-controlled data, instantiating arbitrary objects whose magic methods execute attacker-chosen code during normal application lifecycle events.
Privilege Escalation
An attacker gains elevated permissions beyond those originally granted, allowing access to administrative functions, sensitive data, or system-level controls.
Remote Code Execution (RCE)
Attackers execute arbitrary operating system commands or application code on the server, achieving full host compromise, data theft, and persistence in one step.
Remote File Inclusion (RFI)
Attacker-controlled URLs are passed to server-side include directives, causing the server to fetch and execute remote code from an external attacker-controlled host.
Deserialization of Untrusted Data
Applications that deserialize user-controlled data allow attackers to instantiate arbitrary objects and trigger code execution through exploitable gadget chains in the classpath.
Server-Side Request Forgery (SSRF)
An attacker induces the server to make HTTP requests to an arbitrary destination, including internal services and cloud metadata endpoints that are unreachable from the internet.
Server-Side Template Injection (SSTI)
User input rendered directly inside a server-side template engine executes arbitrary code, typically leading to full remote code execution on the host.
SQL Injection
Malicious SQL is injected into application queries, allowing attackers to read, modify, or delete database contents and in some configurations achieve remote code execution.
SSRF Targeting Cloud Metadata Services
Server-side request forgery directed at cloud metadata endpoints retrieves IAM credentials, allowing full cloud account takeover from a single web application vulnerability.
Unrestricted File Upload
Accepting file uploads without validating type, content, or execution context allows attackers to upload and execute server-side code or malicious payloads.
XML External Entity (XXE) Injection
Maliciously crafted XML documents exploit external entity references to read server files, perform SSRF, and in some cases achieve remote code execution.
Exposed Admin Interface
Publicly accessible admin panels give attackers direct access to privileged application functions, often without strong authentication controls.
Backup File Exposure
Backup and temporary files left in web-accessible directories expose full application source code, database dumps, and configuration secrets to unauthenticated attackers.
Blind XSS
Payloads injected into inputs processed by backend staff or internal tools fire asynchronously, compromising admin accounts and internal systems the attacker cannot directly access.
Broken Object Property Level Authorization
APIs that fail to restrict which object properties users may read or write allow privilege escalation by modifying internal fields in update requests.
Business Logic Bypass
Flaws in application workflow design allow attackers to manipulate intended processes — skipping steps, replaying actions, or abusing features to gain unintended outcomes.
Business Logic Race Condition
Concurrent requests exploit time-of-check to time-of-use gaps in business logic, enabling double-spending, coupon reuse, balance manipulation, and limit bypass attacks.
Cleartext Storage of Sensitive Data
Sensitive data such as passwords, tokens, or PII is written to disk in plaintext, exposing it to anyone with local file system or database access.
Cleartext Transmission of Sensitive Data
Sensitive data transmitted over unencrypted HTTP, FTP, or Telnet connections is exposed to passive eavesdropping and active interception by network-position attackers.
CORS Misconfiguration
Overly permissive Cross-Origin Resource Sharing policies allow attacker-controlled websites to make authenticated API requests and read responses on behalf of victim users.
Credential Stuffing
Automated testing of username and password pairs from prior data breaches exploits password reuse to compromise accounts across unrelated platforms at massive scale.
Cross-Site Request Forgery (CSRF)
CSRF forces authenticated users to unknowingly submit malicious requests, exploiting the browser's automatic inclusion of session credentials on cross-origin requests.
Cross-Site Scripting (XSS)
Attackers inject malicious scripts into pages viewed by other users, enabling session hijacking, credential theft, and silent malware delivery.
Debug Mode Enabled in Production
Applications running with debug mode active in production expose interactive consoles, stack traces, internal configurations, and source code to unauthenticated users.
Dependency Confusion
Package managers fetch a public package with the same name as an internal package, allowing attackers to hijack builds and execute malicious code across the entire organisation.
DNS Rebinding
DNS rebinding bypasses the same-origin policy by causing a domain to resolve to an internal IP, granting attacker-controlled pages access to internal services.
DNS Zone Transfer
DNS zone transfers expose an entire domain's DNS records to unauthenticated requesters, revealing internal infrastructure and attack surface.
DOM-based XSS
Client-side JavaScript reads attacker-controlled data from the DOM and writes it to a dangerous sink, executing scripts entirely within the browser without server involvement.
Excessive Data Exposure
APIs returning more object properties than the client needs expose sensitive fields that attackers extract even when the UI hides them from display.
Exposed .git Repository
A publicly accessible .git directory allows attackers to reconstruct source code, extract secrets, and discover internal infrastructure from version control history.
Function Level Access Control Failure
API endpoints and application functions lack server-side authorization checks, allowing lower-privileged users to invoke administrative or sensitive operations directly.
HTTP Request Smuggling
HTTP request smuggling exploits disagreements between frontend and backend servers over request boundaries to inject requests, bypass security controls, and poison caches.
IDOR via File Download
File download endpoints that use predictable or user-supplied identifiers without authorisation checks allow attackers to access any user's private files and documents.
Insecure Direct Object Reference (IDOR)
An application exposes internal object identifiers without verifying whether the requesting user is authorised to access the referenced resource.
Insecure Password Reset
Flawed password reset flows using predictable tokens, weak security questions, or missing expiry allow attackers to take over any account without knowing the current password.
LDAP Injection
Unsanitized input embedded in LDAP queries lets attackers bypass authentication, enumerate directory objects, and extract sensitive Active Directory data.
Mass Assignment
Frameworks that auto-bind request parameters to model objects allow attackers to set internal fields like role or balance that were never intended to be user-controlled.
Multi-Factor Authentication Bypass
Logic flaws, code reuse, rate limit absence, and response manipulation allow attackers to skip or circumvent MFA challenges and authenticate with credentials alone.
NoSQL Injection
Operator injection into MongoDB, CouchDB, and similar stores bypasses authentication and extracts data by manipulating query logic with JSON or JS operators.
OAuth 2.0 Misconfiguration
Flawed OAuth implementations using open redirect URIs, missing state parameters, or implicit flow grant attackers authorization codes and access tokens for victim accounts.
Outdated and Vulnerable Dependencies
Third-party libraries with known CVEs remain in production, providing attackers with documented exploitation techniques and public proof-of-concept code against your live system.
Padding Oracle Attack
Applications that leak padding validation errors during decryption allow attackers to decrypt and forge ciphertext without knowing the encryption key.
Password Spraying
Testing a small set of common passwords against a large number of accounts evades per-account lockout policies while systematically compromising predictable credentials.
Path Traversal
Unsanitized user input is used to construct file system paths, allowing attackers to read or write files outside the intended directory.
Prototype Pollution
Prototype pollution lets attackers inject properties into JavaScript's Object prototype, corrupting application logic and enabling denial of service or RCE.
Race Condition (TOCTOU)
Race conditions exploit the window between checking and using a resource, allowing attackers to double-spend, bypass limits, or escalate privileges through concurrent requests.
SAML Vulnerabilities
XML signature wrapping, comment injection, and XXE in SAML assertions allow attackers to forge authentication and impersonate any user including administrators.
Second-Order SQL Injection
SQL injection payloads stored safely in the database are later retrieved and unsafely concatenated into a new query, bypassing first-point input sanitisation entirely.
Server-Side Includes (SSI) Injection
User input injected into SSI-enabled pages executes server-side directives, allowing attackers to read files, run OS commands, and achieve remote code execution on the web server.
Session Fixation
An attacker pre-sets a victim's session ID before authentication, then uses that known ID to hijack the session after the victim successfully logs in.
Source Code Disclosure
Application source code is exposed to unauthenticated users, revealing logic, credentials, and attack surface that dramatically accelerates exploitation.
Stored Cross-Site Scripting
Malicious scripts persisted in the application database execute in every victim's browser that loads the affected page, enabling mass session hijacking and malware delivery.
Subdomain Takeover
DNS records pointing to deprovisioned third-party services allow attackers to claim the service and serve content under the victim organization's subdomain.
TLS/SSL Misconfiguration
Insecure TLS configurations — outdated protocol versions, weak cipher suites, or missing HSTS — expose encrypted traffic to interception and downgrade attacks.
Web Application Firewall Bypass
Encoding, obfuscation, and protocol-level techniques allow attackers to evade WAF detection rules and deliver malicious payloads to vulnerable backend applications undetected.
Weak Cryptographic Algorithm
Use of broken or outdated cryptographic algorithms like MD5, SHA-1, DES, or RC4 leaves protected data vulnerable to brute-force, collision, and decryption attacks.
Web Cache Poisoning
Web cache poisoning injects malicious content into a shared cache by manipulating unkeyed inputs, causing the poisoned response to be served to all subsequent users.
XPath Injection
Unsanitized user input in XPath queries manipulates XML document traversal, enabling authentication bypass and extraction of all data from the XML store.
XSS via File Upload
Insufficiently validated file uploads allow attackers to store and serve malicious HTML or SVG content from the application's origin, bypassing same-origin policy protections entirely.
Zip Slip
Maliciously crafted archive files use path traversal sequences in entry names to extract files outside the target directory, enabling arbitrary file write and remote code execution.
Account Enumeration
Differing application responses to valid versus invalid usernames reveal whether accounts exist, enabling targeted attacks and undermining privacy protections.
Clickjacking
Clickjacking tricks users into clicking hidden UI elements by overlaying a transparent iframe, enabling unauthorized actions on authenticated sessions.
Client-Side Storage Exposure
Sensitive data stored in localStorage, sessionStorage, or IndexedDB is accessible to any JavaScript on the page, including injected malicious scripts.
Cookie Security Misconfiguration
Missing HttpOnly, Secure, and SameSite cookie attributes expose session tokens to JavaScript theft, network interception, and cross-site request forgery attacks.
CRLF Injection
Injecting carriage return and line feed characters into HTTP responses allows attackers to split responses, set arbitrary headers, and perform XSS or cache poisoning.
Dangling Markup Injection
Injected unclosed HTML tags cause the browser to send subsequent page content — including CSRF tokens and sensitive data — to attacker-controlled URLs via attribute parsing.
Email Header Injection
Unvalidated newline characters in user-supplied email fields allow attackers to inject additional headers, enabling spam relay, phishing, and disclosure of BCC recipients.
Forced Browsing
Attackers directly request URLs to resources that are not linked in the UI but remain accessible without authorization checks on the server side.
GraphQL Denial of Service
Deeply nested or batched GraphQL queries exhaust server CPU and memory without authentication, making GraphQL APIs uniquely susceptible to resource exhaustion attacks.
GraphQL Introspection Enabled
Enabled GraphQL introspection in production exposes the complete API schema to attackers, revealing all types, queries, mutations, and internal field names.
Host Header Injection
Trusting the HTTP Host header without validation enables password reset poisoning, cache poisoning, SSRF, and web cache attacks via attacker-controlled domain injection.
HTML Injection
Unsanitised user input is rendered as raw HTML in the browser, enabling attackers to inject arbitrary markup, redirect users, and conduct phishing attacks within a trusted domain.
HTTP Parameter Pollution
Supplying duplicate HTTP parameters exploits inconsistent server and WAF parsing to bypass security controls, override logic, and manipulate backend requests.
Insecure Randomness
Use of predictable pseudo-random number generators for security-sensitive operations allows attackers to predict tokens, session IDs, or cryptographic keys.
Insufficient Session Expiry
Sessions that persist indefinitely or for excessive durations extend the window for session theft, replay attacks, and unauthorized access from shared or stolen devices.
Lack of Rate Limiting
APIs without rate limiting allow attackers to brute-force credentials, enumerate resources, scrape data, and exhaust resources without restriction.
Log Injection
Injecting newlines and control characters into application logs forges log entries, conceals attack activity, and can exploit downstream log-processing systems.
Open Redirect
Unvalidated redirect parameters allow attackers to send users from a trusted domain to an arbitrary external URL, enabling phishing and credential harvesting.
Insecure postMessage Handling
Failing to validate the origin of postMessage events allows malicious pages to send arbitrary commands to embedded iframes or parent windows.
Regular Expression Denial of Service (ReDoS)
Crafted inputs exploit catastrophic backtracking in vulnerable regular expressions, causing exponential CPU consumption that takes a single-threaded server process offline.
Reverse Tabnabbing
Links opening in new tabs with target=_blank allow the opened page to redirect the original tab via window.opener, enabling phishing attacks against authenticated users.
Missing Security Headers
Absent or misconfigured HTTP security headers leave browsers without critical protections against XSS, clickjacking, MIME sniffing, and cross-origin data leakage.
Sensitive Data in Logs
Passwords, tokens, PII, and cryptographic secrets written to application logs create persistent, often over-shared records that expose sensitive data long after the original request.
Shadow APIs and Improper Asset Management
Undocumented shadow APIs and forgotten legacy endpoints lack the security controls of current APIs, creating invisible attack surface in production environments.
Missing Subresource Integrity
Without Subresource Integrity checks, a compromised CDN can serve malicious JavaScript or CSS to all users of the application without detection.
User Enumeration
Differences in application responses reveal whether a username or email address exists, enabling attackers to build valid account lists for targeted credential attacks.
Verbose Error Messages
Detailed server error messages expose stack traces, internal paths, database schemas, and technology fingerprints that attackers use to craft targeted exploits.
Weak Password Policy
Permissive password requirements allow users to set easily guessable credentials, dramatically lowering the bar for brute force, credential stuffing, and dictionary attacks.
Web Cache Deception
Attackers trick caching layers into storing authenticated user responses as publicly accessible cached objects, exposing sensitive personal data to anyone who requests the same URL.
Directory Listing Enabled
Web servers configured to display directory contents expose file structure, backup files, and sensitive documents to unauthenticated browsing.
Internal Network Disclosure
Applications leak internal IP addresses, hostnames, or network topology in responses, helping attackers map infrastructure and plan targeted lateral movement attacks.
Every SecureBlock engagement covers these findings — manually, across all in-scope endpoints.