Broken Access Control – Users can access pages or perform actions they shouldn’t be allowed to, like viewing other people’s data.

Privilege Escalation – A low-privilege user can become an admin and gain full control.

Cross Site Scripting (XSS) – Attackers can inject malicious scripts into the site that steal visitor data or hijack their accounts.

Cross Site Scripting (XSS) – Attackers can inject malicious scripts into the site that steal visitor data or hijack their accounts.

PHP Object Injection – Attackers can manipulate how the site processes data to run harmful actions on the server.

Cross Site Scripting (XSS) – Attackers can inject malicious scripts into the site that steal visitor data or hijack their accounts.

Broken Access Control – Users can access pages or perform actions they shouldn’t be allowed to, like viewing other people’s data.

Cross Site Scripting (XSS) – Attackers can inject malicious scripts into the site that steal visitor data or hijack their accounts.

Arbitrary File Deletion – Attackers can delete important files and break the website.

Content Injection – Attackers can add unwanted content to pages (ads, scams, or malware links).

Cross Site Scripting (XSS) – Attackers can inject malicious scripts into the site that steal visitor data or hijack their accounts.

Cross Site Scripting (XSS) – Attackers can inject malicious scripts into the site that steal visitor data or hijack their accounts.

Cross Site Scripting (XSS) – Attackers can inject malicious scripts into the site that steal visitor data or hijack their accounts.

Cross Site Scripting (XSS) – Attackers can inject malicious scripts into the site that steal visitor data or hijack their accounts.

Cross Site Scripting (XSS) – Attackers can inject malicious scripts into the site that steal visitor data or hijack their accounts.

Broken Access Control – Users can access pages or perform actions they shouldn’t be allowed to, like viewing other people’s data.

Privilege Escalation – A low-privilege user can become an admin and gain full control.

Arbitrary Code Execution – Attackers can run their own code on your site’s server and take it over.

Deserialization of untrusted data – Attackers can send crafted data that makes your server blindly trusts, to run commands or gain extra access.

Broken Access Control – Users can access pages or perform actions they shouldn’t be allowed to, like viewing other people’s data.