Security Vulnerabilities

Attackers manipulate database queries through user input to steal or destroy data.

API keys and passwords embedded directly in source code, exposed in repositories.

Malicious scripts injected into web pages, stealing user data or hijacking sessions.

Endpoints accessible without login, exposing sensitive data or functionality.

Users access other users' data by changing IDs in URLs or requests.

Users perform actions or access data beyond their permissions.

Attackers trick users into performing unwanted actions on authenticated sites.

Overly permissive cross-origin settings allow unauthorized data access.

No limits on API requests, enabling brute force and DoS attacks.

Personal or financial data transmitted or stored without proper protection.

Untrusted data deserialized without validation, enabling code execution.

Weak JWT implementation allowing token forgery or session hijacking.

Users modify restricted fields by adding extra parameters to requests.

Attackers redirect users to malicious sites via trusted URLs.

Attackers access files outside intended directories using ../ sequences.

Server makes requests to attacker-controlled URLs, accessing internal resources.

User input in templates enables server-side code execution.

Malicious XML exploits parsers to read files or make server requests.

User input executed as system commands, giving attackers server access.

Query operators injected into MongoDB/Firestore queries to bypass auth or extract data.