Detection Registry

The most pervasive vulnerability caused by missing or incomplete user input validation, leading to injection attacks like SQLi, XSS, and command injection.

Injection of malicious SQL queries due to unsafe query construction, often via string concatenation without parameterization.

Logic flaws that allow attackers to circumvent authentication protections, gaining unauthorized access.

Embedding API keys, database credentials, and secrets in code repositories, risking leakage.

Executing user-supplied input directly in system commands, enabling arbitrary code execution.

Use of unsafe deserialization methods without validation, risking remote code execution.

Unchecked memory access vulnerabilities common especially in C/C++ code, allowing system compromise.

Memory corruption error where freed resources are accessed, leading to undefined and exploitable behavior.

Lack of bounds checking or unsafe memory handling resulting in exploitable conditions.

Memory management flaws that corrupt heap metadata, enabling arbitrary code execution.

Improper output encoding that allows injection of malicious client-side scripts.

Missing authorization checks allowing unauthorized resource access.

Manipulation of server requests to internal or protected resources.

Vulnerabilities allowing attackers to access files and directories outside intended paths.

Exposing object identifiers in URLs or APIs without proper access control checks.

Endpoints lacking permission checks before performing sensitive operations.

Using weak or outdated hashing algorithms or storing passwords in plaintext.

Incorrect file validation allowing upload of malicious files or denial of service.

Improper handling or storing of personally identifiable or confidential data.

Authentication logic handled wholly on the client, vulnerable to bypasses.

Unvalidated format strings that can lead to memory disclosure or code execution.

Missing anti-CSRF tokens causing unauthorized commands to be transmitted from a user.

Verbose error handling exposing internal paths, configurations, or database details.

Concurrent operations failing to lock shared resources properly, causing inconsistent state.

Processing files without validation, sandboxing, or security controls.

Numeric operations exceeding defined limits causing logic errors or exploits.

State-changing requests lacking CSRF tokens, allowing attackers to forge requests.

Redirect URLs not checked, enabling phishing or open redirect attacks.

Default configs, exposed dev tools, or weak security headers/errors.

Improper session handling exposing session hijacking or fixation risk.