Vulnerability Labs

Cross-Site Scripting (XSS) lets you inject malicious scripts into web pages that other users visit. It's one of the most...

SQL Injection (SQLi) happens when user-controlled input is concatenated into a SQL query without parameterization. It le...

NoSQL Injection exploits the lack of sanitization in queries to NoSQL databases like MongoDB, CouchDB or Redis. Operator...

CSRF forces an authenticated user to perform unwanted actions on a web application where they're logged in. It can chang...

IDOR happens when an application exposes direct references to internal objects (IDs, files, slugs) without verifying tha...

Broken Access Control is #1 in the OWASP Top 10. It covers any situation where a user reaches resources or functionality...

SSRF lets you force the server to make HTTP requests to arbitrary destinations, including internal services, cloud provi...

An Open Redirect happens when an application redirects users to attacker-controlled URLs without validation. It can be u...

Race Conditions occur when the application doesn't correctly handle concurrent operations. They let you duplicate transa...

Path Traversal lets you reach files and directories outside the application's root. Using sequences like ../ you can rea...

Command Injection happens when user input is concatenated into an operating-system shell call. It lets you run arbitrary...

SSTI happens when user input is concatenated into a server-side rendered template (Jinja2, Twig, FreeMarker, Velocity, H...

XXE exploits XML parsers that resolve external entities. It lets you read arbitrary server files, perform SSRF (via remo...

CORS Misconfigurations let malicious sites read API responses containing the victim user's sensitive data. It usually co...

Authentication Bypass is any technique that lets you access an account or resource without passing the legitimate authen...

API Abuse vulnerabilities exploit REST and GraphQL API functionality beyond its intended use: rate limiting bypass, mass...

Business Logic vulnerabilities are flaws in the application's design that let attackers manipulate legitimate business p...

JSON Web Token attacks exploit insecure signature and verification implementations. From accepting alg=none to RS256→HS2...

GraphQL attacks exploit the query language's own features: introspection that exposes the whole schema, alias batching f...

Subdomain Takeover happens when a subdomain points (via CNAME) to an external service that no longer exists or is unclai...

Clickjacking tricks the user into clicking on invisible elements of a victim page loaded in a transparent overlaid ifram...

File Upload vulnerabilities appear when an app allows uploading files without validating type, content or destination. D...

Prototype Pollution is a JavaScript vulnerability where the attacker injects properties into Object.prototype via keys l...

Web Cache Poisoning abuses inputs not included in the cache key (unkeyed inputs) to store a malicious response that's th...

Local File Inclusion happens when an app includes and processes a local file whose path the user controls. Beyond readin...

Insecure Deserialization happens when an app reconstructs objects from user-controlled serialized data without validatin...

OAuth 2.0 and SSO attacks exploit incorrect implementations of the authorization flow: loose redirect_uri validation, mi...

HTTP Request Smuggling exploits the desync between the front-end (proxy/CDN) and the back-end when interpreting where a ...

Prompt Injection means smuggling instructions into the input (or into the content it ingests) of an LLM-powered applicat...

Mass Assignment happens when a framework automatically binds the request fields to an object/model without an allowlist....

Host Header Injection abuses applications that trust the request's Host header (or X-Forwarded-Host). By manipulating it...

CRLF Injection injects carriage-return and line-feed characters (%0d%0a) into input the server reflects inside HTTP head...

Web Cache Deception tricks a cache into storing the victim's dynamic, authenticated page believing it's a static resourc...