WebApp Security
The OWASP Top 10 (2021), grouped by its own official categories, plus the specific classes (IDOR, CSRF, path traversal, and others) that specialize each one.
Broken Access Control
How an app that correctly identifies a user can still let them reach data or actions they were never authorized for.
Ceiling: HighCross-Site Request Forgery (CSRF)
How a logged-in user's own browser can be tricked into sending a real, authenticated request the user never intended to make.
Ceiling: CriticalInsecure Direct Object Reference (IDOR)
How changing an ID in a request lets an attacker reach another user's data, and why this is the single most common real-world access control pattern.
Ceiling: MediumOpen Redirect
How an unvalidated redirect parameter turns a trusted domain into the first hop of a convincing phishing link.
Ceiling: HighPath Traversal
How manipulating a file path with sequences like ../ lets an attacker read files far outside what an application ever meant to expose.
Cross-Site Scripting (XSS)
How untrusted input reaching a page without output encoding lets an attacker run script in another user's browser, and why that differs from SQL injection despite the surface similarity.
Ceiling: CriticalFile Inclusion Vulnerabilities (LFI/RFI)
How an application that dynamically includes a file based on user input can be tricked into running a local or attacker-hosted remote file as code.
Ceiling: CriticalOS Command Injection
How untrusted input reaching a system shell command lets an attacker run arbitrary operating system commands, not just influence the application's own logic.
Ceiling: CriticalSQL Injection
Untrusted input reaching a raw SQL query lets an attacker rewrite the query's logic, not just supply a value.
Business Logic Vulnerabilities
How abusing the intended workflow of a feature, rather than breaking its code, produces damaging findings a scanner will never catch.
Ceiling: HighInsecure Design
Why a flaw that was never a coding bug, but a missing security control baked into the architecture from day one, cannot be patched the way an ordinary vulnerability can.
View all 10 OWASP Top 10 categories →
Clickjacking
How an invisible, overlaid page can trick a user into clicking something completely different from what they think they're clicking.
Ceiling: HighSecurity Misconfiguration
How a secure product still ships with an insecure default, an unnecessary feature left enabled, or an error message that hands an attacker what they need.
Ceiling: HighSubdomain Takeover
How a forgotten DNS record pointing at a deprovisioned cloud resource lets an attacker claim that resource and serve their own content from a trusted subdomain.
Ceiling: CriticalXML External Entity (XXE) Injection
How an XML parser configured to resolve external entities lets an attacker read local files or reach internal systems through a single malicious XML document.
Mass Assignment
How an API that blindly binds every submitted field to an object lets an attacker set fields they were never supposed to touch.
Ceiling: CriticalSoftware and Data Integrity Failures
How trusting a piece of software or data without verifying it is what it claims to be turns an update mechanism or a serialized object into a way in.