Vulnerability library
Understand the risk. Fix it right.
Reference guides for common vulnerability classes: what they are, why they matter, and how to remediate and test for them. Breachvane findings link here for remediation guidance.
VulnerabilityTypical severityCWEOWASP
Broken access control & IDORThe application checks who you are but not whether you're allowed to touch a specific record or function, so changing an ID or calling an endpoint directly exposes other users' data or admin actions.Medium to CriticalCWE-639, CWE-285A01:2021 Broken Access ControlCross-site scripting (XSS)
Untrusted data is written into a web page without the right encoding, so an attacker's script runs in another user's browser with that user's session and permissions.Medium to HighCWE-79A03:2021 InjectionSQL injection (SQLi)
User input is built into a database query as code instead of being passed as data, letting an attacker read, change or delete data and sometimes take over the database server.High to CriticalCWE-89A03:2021 Injection
3 entriesvulnerabilities.json · Advisories →