Insecure Direct Object References (IDOR) – Changing an ID in the URL can expose other people’s data.

Cross Site Request Forgery (CSRF) – Logged-in users can be tricked into performing actions they didn’t intend, like changing passwords or making purchases.

Cross Site Scripting (XSS) – Attackers can inject malicious scripts into the site that steal visitor data or hijack their accounts.

Cross Site Scripting (XSS) – Attackers can inject malicious scripts into the site that steal visitor data or hijack their accounts.

Cross Site Scripting (XSS) – Attackers can inject malicious scripts into the site that steal visitor data or hijack their accounts.

Broken Authentication – Attackers can bypass the login system or log in as other users without their password.

Broken Authentication – This can be abused by a malicious actor to perform action which normally should only be able to be executed by higher privileged users. These actions might allow the malicious actor to gain admin access to the website.

SQL Injection – This could allow a malicious actor to directly interact with your database, including but not limited to stealing information.

Broken Access Control – A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action.

Bypass Vulnerability – A bypass vulnerability could allow a malicious actor to bypass certain restrictions in the code.

Cross Site Scripting (XSS) – This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. 

Cross Site Scripting (XSS) – This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. 

Broken Authentication – This can be abused by a malicious actor to perform action which normally should only be able to be executed by higher privileged users. These actions might allow the malicious actor to gain admin access to the website.

Sensitive Data Exposure – This could allow a malicious actor to view sensitive information that is normally not available to regular users. This can be used to exploit other weaknesses in the system.

Broken Authentication – This can be abused by a malicious actor to perform action which normally should only be able to be executed by higher privileged users. These actions might allow the malicious actor to gain admin access to the website.

Remote Code Execution (RCE) – This could allow a malicious actor to execute commands on the target website. This can be used to gain backdoor access to then take full control of the website.

Bypass Vulnerability – A bypass vulnerability could allow a malicious actor to bypass certain restrictions in the code.

Cross Site Scripting (XSS) – This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. 

Cross Site Scripting (XSS) – This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. 

SQL Injection – This could allow a malicious actor to directly interact with your database, including but not limited to stealing information.