The security knowledge graph for web and API vulnerabilities.

An application exposes references to objects (IDs, filenames, keys) and fails to verify that the current user is authorized to access the referenced object.

An attacker tricks an authenticated user's browser into submitting a state-changing request the user did not intend.

Unsanitized file path input lets an attacker escape the intended directory and read or write arbitrary files.

Users can act outside their intended permissions - accessing other users' data or admin functionality - because access controls are missing or inconsistent.

Untrusted input is concatenated into a SQL query, letting an attacker alter the query's logic to read, modify, or destroy data.

An application reflects or stores untrusted input that is later interpreted as active script in a victim's browser.

User input is embedded into a server-side template and evaluated by the template engine, often leading to remote code execution.

Untrusted input is passed to a system shell, letting an attacker execute arbitrary operating-system commands.

An attacker coerces a server into making HTTP requests to targets of their choosing - often internal services or cloud metadata endpoints.

A weakly configured XML parser resolves attacker-defined external entities, enabling file disclosure, SSRF, and denial of service.

Weak validation of JSON Web Tokens - unverified signatures, alg confusion, or weak keys - lets attackers forge trusted tokens.

Weaknesses in how an application verifies identity - credential stuffing, weak session handling, or missing rate limits - let an attacker assume another user's identity without their password.

Untrusted serialized data is deserialized without validation, allowing object tampering and often remote code execution.

Concurrent requests exploit the gap between when an application checks a condition and when it acts on it, letting an attacker bypass a limit or duplicate an action that should only happen once.

A framework binds client-supplied JSON directly onto an internal object, letting an attacker set fields - like role or isAdmin - that were never meant to be user-controlled.

The application works exactly as coded, but the workflow itself can be abused - skipping steps, replaying actions, or reordering a process to reach an outcome it was never meant to allow.