The Ultimate List of 100 Web Vulnerabilities Explained

A Complete Reference Guide to Modern Web Application Security Risks and Attack Vectors

 

Whether you are a penetration tester, bug bounty hunter, or developer building secure applications, understanding how web vulnerabilities work is essential. Below is a complete breakdown of 100 web vulnerabilities across 20 core categories, along with a clear explanation of each flaw.

Injection Vulnerabilities

Flaws where untrusted user input is sent to an interpreter and executed as a command or query.

1. SQL Injection (SQLi): Attackers insert malicious SQL statements into input fields to view, modify, or delete database records.

2. Cross-Site Scripting (XSS): Malicious scripts are injected into trusted websites and executed inside the victim's browser.

3. Cross-Site Request Forgery (CSRF): Tricks a logged-in user's browser into sending unauthorized requests to a web application without their knowledge.

4. Remote Code Execution (RCE): Allows an attacker to remotely run arbitrary code or system commands on the target server.

5. Command Injection: Untrusted input is passed into a system shell, allowing attackers to execute arbitrary operating system commands.

6. XML Injection: Attackers insert malicious XML content to alter the logic of an XML application or data structure.

7. LDAP Injection: Manipulates input parameters used to construct LDAP queries to bypass authentication or view directory data.

8. XPath Injection: Exploits applications that construct XPath queries from user input to extract unauthorized data from XML databases.

9. HTML Injection: Injects raw HTML code into a vulnerable web page to alter its appearance or trick users into submitting sensitive data.

10. Server-Side Includes (SSI) Injection: Sends malicious SSI directives into a web app that are later executed by the web server.

11. OS Command Injection: Directly passes unvalidated user data to the underlying operating system shell to execute system-level commands.

12. Blind SQL Injection: A type of SQLi where the database does not return data or errors on screen, so attackers infer answers via true/false responses or time delays.

13. Server-Side Template Injection (SSTI): Attackers inject native template syntax into a web page, which is evaluated on the server and often leads to RCE.

Broken Authentication and Session Management

Weaknesses in how an application handles user login, identity verification, and active sessions.

 

14. Session Fixation: An attacker forces a user to log in using a known session ID, allowing the attacker to take over the session afterward.

15. Brute Force Attack: Automated trial-and-error attempts to guess usernames, passwords, or PINs until the right combination is found.

16. Session Hijacking: Stealing or predicting a valid session token to gain unauthorized access to a user's active account.

17. Password Cracking: Recovering plain-text passwords from leaked or intercepted password hashes using wordlists or computing power.

18. Weak Password Storage: Storing passwords in plain text or using outdated hashing algorithms (like MD5 or SHA-1) without salting.

19. Insecure Authentication: Flaws in the login process that allow attackers to log in without providing valid credentials.

20. Cookie Theft: Stealing session cookies via XSS, network sniffing, or malware to impersonate a legitimate user.

21. Credential Reuse: Attackers use leaked email and password combinations from one breach to log into users' accounts on other websites.

Sensitive Data Exposure

Failing to properly protect confidential information such as financial data, health records, or credentials.

22. Inadequate Encryption: Using weak, outdated, or improperly implemented encryption algorithms to protect sensitive data.

23. Insecure Direct Object References (IDOR): Accessing or modifying another user's data simply by changing an ID parameter in the URL or request.

24. Data Leakage: Unintentionally exposing internal system details, source code, or user data through error messages, logs, or public backups.

25. Unencrypted Data Storage: Saving sensitive information in databases, files, or backups in plain text without encryption at rest.

26. Missing Security Headers: Failing to include HTTP response headers (such as HSTS or CSP) that instruct browsers on how to protect user data.

27. Insecure File Handling: Improperly validating or storing uploaded and downloaded files, leading to unauthorized file access or execution.

 

Security Misconfiguration

Insecure default settings, incomplete setups, or exposed system configurations.

 

28. Default Passwords: Leaving factory-default usernames and passwords active on servers, admin panels, or databases.

29. Directory Listing: A web server setting that displays all files and folders in a directory when no index file is present.

30. Unprotected API Endpoints: Internal or public API routes left accessible without proper authentication or access checks.

31. Open Ports and Services: Leaving unnecessary network ports or services running and exposed to the internet.

32. Improper Access Controls: Misconfigured permission rules that allow regular users or guests to access restricted resources.

33. Information Disclosure: Revealing server versions, stack traces, or framework details that help attackers plan targeted exploits.

34. Unpatched Software: Running outdated operating systems, CMS platforms, or libraries with known security vulnerabilities.

35. Misconfigured CORS: Overly permissive Cross-Origin Resource Sharing rules that let malicious sites read sensitive cross-origin data.

36. HTTP Security Headers Misconfiguration: Setting weak or incorrect values inside security headers, rendering browser protections ineffective.

 

XML-Related Vulnerabilities

Flaws in how an application parses and processes XML input.

 

37. XML External Entity (XXE) Injection: Exploits vulnerable XML parsers to read local files on the server, access internal networks, or trigger denial of service.

38. XML Entity Expansion (XEE): Uses nested XML entities that expand rapidly in memory during parsing, slowing down or crashing the server.

39. XML Bomb: A tiny XML payload (like the Billion Laughs attack) that expands exponentially when parsed, exhausting server memory.

Broken Access Control

Failures in enforcing restrictions on what authenticated users are allowed to do.

 

40. Inadequate Authorization: Failing to verify whether a logged-in user actually has permission to perform a specific action or view a resource.

41. Privilege Escalation: A user gains higher-level permissions than intended—either accessing another user's account or gaining admin rights.

42. Insecure Direct Object References: Allowing direct access to internal objects (files, database keys) without verifying ownership.

43. Forceful Browsing: Directly typing or guessing URLs to access restricted admin pages or unlinked files that lack authorization checks.

44. Missing Function-Level Access Control: Hiding admin buttons in the UI without restricting the actual backend API or controller endpoint.

 

Insecure Deserialization

Untrusted data is used to reconstruct objects in memory, leading to manipulation or code execution.

 

45. Remote Code Execution via Deserialization: Crafting malicious serialized objects that trigger arbitrary code execution as soon as the server deserializes them.

46. Data Tampering: Modifying values inside a serialized object (such as changing user roles) before sending it back to the server.

47. Object Injection: Passing malicious object instances into an application stream to manipulate internal logic or trigger unintended methods.

API Security Issues

Vulnerabilities specific to REST, GraphQL, and SOAP Application Programming Interfaces.

48. Insecure API Endpoints: API routes that expose sensitive actions or data without proper authentication, authorization, or encryption.

49. API Key Exposure: Hardcoding or leaking secret API keys in client-side JavaScript, mobile apps, or public repositories.

50. Lack of Rate Limiting: Failing to restrict how many requests a user or IP can send to an API, enabling brute-force attacks and scraping.

51. Inadequate Input Validation: Accepting unverified data types, oversized payloads, or unexpected fields (mass assignment) in API requests.

 

Insecure Communication

Weaknesses in how data is transmitted between clients, servers, and external services.

 

52. Man-in-the-Middle (MITM) Attack: An attacker secretly intercepts and potentially alters communication between two parties over an unsecured network.

53. Insufficient Transport Layer Security: Transmitting sensitive login or personal data over plain HTTP instead of encrypted HTTPS.

54. Insecure SSL/TLS Configuration: Supporting weak cipher suites, expired certificates, or outdated protocols like SSLv3, TLS 1.0, and TLS 1.1.

55. Insecure Communication Protocols: Using unencrypted legacy protocols such as FTP, Telnet, or plain SMTP for sensitive data transfer.

 

Client-Side Vulnerabilities

Attacks that target the user's browser and client-side code rather than the backend server directly.

 

56. DOM-based XSS: Cross-Site Scripting that happens entirely in the browser when client-side scripts write untrusted data into the DOM.

57. Insecure Cross-Origin Communication: Unsafe use of postMessage() or cross-window communication without verifying the sender's origin.

58. Browser Cache Poisoning: Tricking a browser into storing malicious content in its local cache so it loads on future visits.

59. Clickjacking: Overlaying a transparent iframe over a legitimate-looking page so users unknowingly click buttons on a hidden site.

60. HTML5 Security Issues: Misusing modern HTML5 features such as localStorage, WebSockets, or Web Workers to store sensitive data insecurely.

 

Denial of Service (DoS)

Attacks designed to make a website, server, or network unavailable to legitimate users.

 

61. Distributed Denial of Service (DDoS): Flooding a target website or server with massive traffic from thousands of compromised devices at once.

62. Application Layer DoS: Targeting expensive application functions (like search queries or login endpoints) to crash the server with minimal bandwidth.

63. Resource Exhaustion: Consuming all available server memory, CPU, disk space, or database connections until the system stops responding.

64. Slowloris Attack: Keeping many HTTP connections open to a web server for as long as possible by sending partial requests very slowly.

65. XML Denial of Service: Overwhelming an application by sending deeply nested or oversized XML files that exhaust parser resources.

 

Other Web Vulnerabilities

Additional critical flaws commonly encountered during web security assessments.

 

66. Server-Side Request Forgery (SSRF): Tricking the server into making HTTP requests to internal systems, cloud metadata services, or external servers.

67. HTTP Parameter Pollution (HPP): Sending multiple HTTP parameters with the same name to confuse validation logic or override backend variables.

68. Insecure Redirects and Forwards: Using unvalidated user input to redirect visitors to external phishing or malware websites (Open Redirect).

69. File Inclusion Vulnerabilities: Forcing an application to load and execute local files (LFI) or remote scripts (RFI) on the web server.

70. Security Header Bypass: Exploiting weak directives or browser quirks to bypass protections like CSP or X-Frame-Options.

71. Clickjacking (UI Redressing): Tricking users into interacting with hidden UI elements layered beneath decoy graphics.

72. Inadequate Session Timeout: Failing to expire user sessions after inactivity, leaving accounts vulnerable on shared or unattended devices.

73. Insufficient Logging and Monitoring: Failing to record failed logins, access violations, or server errors, allowing attackers to operate undetected.

74. Business Logic Vulnerabilities: Exploiting flaws in the design and workflow of an application rather than technical code bugs.

75. API Abuse: Exploiting legitimate API functionality at scale to scrape data, automate fake accounts, or disrupt business operations.

 

Mobile Web Vulnerabilities

Security flaws affecting mobile browsers, hybrid apps, and mobile backend services.

 

76. Insecure Data Storage on Mobile Devices: Saving tokens, passwords, or personal data in unencrypted local files, SQLite databases, or shared preferences.

77. Insecure Data Transmission on Mobile Devices: Failing to enforce HTTPS or proper certificate pinning when mobile apps communicate with backend servers.

78. Insecure Mobile API Endpoints: Backend APIs built for mobile apps that return excessive data or lack proper token validation.

79. Mobile App Reverse Engineering: Decompiling mobile application binaries to extract hardcoded secrets, API keys, or proprietary business logic.

 

IoT Web Vulnerabilities

Risks associated with web interfaces and cloud dashboards managing Internet of Things devices.

 

80. Insecure IoT Device Management: Web portals or management interfaces for smart devices that lack encryption, firmware verification, or access controls.

81. Weak Authentication on IoT Devices: Devices shipped with hardcoded credentials or simple login portals with no brute-force protection.

82. IoT Device Vulnerabilities: Outdated embedded web servers and unpatched firmware running on connected hardware.

 

Web of Things (WoT) Vulnerabilities

Security issues in web-connected smart environments and consumer automation platforms.

 

83. Unauthorized Access to Smart Homes: Exploiting weak web dashboards or APIs to unlock smart doors, view cameras, or control home appliances.

84. IoT Data Privacy Issues: Smart devices collecting and transmitting personal habits, location, or audio data without proper consent or encryption.

 

Authentication Bypass

Techniques used to skip login screens or secondary verification steps.

 

85. Insecure "Remember Me" Functionality: Using predictable or unencrypted persistent cookies that allow attackers to forge a permanent login token.

86. CAPTCHA Bypass: Using OCR scripts, logic flaws, or missing server-side token checks to submit forms without solving the CAPTCHA.

 

Server-Side Request Forgery (SSRF)

Advanced variations of SSRF where server responses are not directly returned to the attacker.

 

87. Blind SSRF: Triggering an internal server request where the response is not shown on screen, confirming impact via out-of-band DNS/HTTP callbacks.

88. Time-Based Blind SSRF: Determining whether internal ports or hosts exist by measuring how long the server takes to respond to an SSRF request.

 

Content Spoofing

Tricking browsers or users into trusting forged content types or injected page elements.

 

89. MIME Sniffing: Browsers guessing a file's format and executing a disguised script (such as JavaScript hidden inside an uploaded image).

90. X-Content-Type-Options Bypass: Exploiting missing or misconfigured content-type headers so the browser executes non-executable MIME types.

91. Content Security Policy (CSP) Bypass: Using whitelisted CDNs, JSONP endpoints, or unsafe-inline directives to run malicious scripts despite an active CSP.

 

Business Logic Flaws

Weaknesses in how an application enforces everyday business rules and workflows.

 

92. Inconsistent Validation: Validating input on the frontend or in one step of a workflow, but failing to validate it again on the backend.

93. Race Conditions: Sending multiple simultaneous requests (such as applying a coupon or withdrawing funds) before the database updates.

94. Order Processing Vulnerabilities: Skipping payment steps or altering checkout states to complete an order without paying.

95. Price Manipulation: Modifying item prices, quantities, or discount values in HTTP requests before checkout.

96. Account Enumeration: Discovering valid usernames or email addresses by observing differences in login or password-reset error messages.

97. User-Based Flaws: Exploiting trust assumptions around user roles, referral systems, or trial accounts to gain unintended benefits.

 

Zero-Day Vulnerabilities

Newly discovered security flaws that do not yet have an official fix or patch.

 

98. Unknown Vulnerabilities: Security flaws present in software that neither the vendor nor the public security community has discovered yet.

99. Unpatched Vulnerabilities: Known security bugs for which the vendor has not yet released a patch, or administrators have not applied it.

100. Day-Zero Exploits: Active attacks

and exploit code used in the wild to compromise systems on the exact day a vulnerability becomes known.

For more web security guides, penetration testing notes, and bug bounty resources, 0225853342