The foundational standard for application security testing and verification. Each category contains deep-dive analyses, vulnerability reproduction triggers, static audit signatures, and hardened code implementations.
Failures enforcing user permissions, IDOR, privilege escalation, and multi-tenant boundary bypasses.
Insecure default settings, open cloud storage, verbose error output, and missing HTTP security headers.
Compromised package registries, vulnerable third-party dependencies, typosquatting, and unpinned builds.
Weak hashing algorithms (MD5/SHA1), hardcoded secret keys, insecure PRNGs, and lack of authenticated encryption.
SQL injection, OS command injection, server-side template injection (SSTI), and unescaped query interpreters.
Architectural flaws, lack of threat modeling, missing rate-limiting defense-in-depth, and business logic bypasses.
Credential stuffing, session fixation, permissive password policies, MFA bypasses, and flawed password reset flows.
Insecure object deserialization (unserialize/pickle), missing Subresource Integrity (SRI), and unsigned plugins.
Unlogged security events, log injection / CRLF forging, absence of real-time alerting, and sensitive PII in logs.
Unhandled exceptions causing fail-open authorization states, partial transaction states, and unreleased resource handles.