Top 100 Web Vulnerabilities Reference

Purpose

Provide a comprehensive, structured reference for the 100 most critical web application vulnerabilities organized by category. This skill enables systematic vulnerability identification, impact assessment, and remediation guidance across the full spectrum of web security threats. Content organized into 15 major vulnerability categories aligned with industry standards and real-world attack patterns.

Prerequisites

Basic understanding of web application architecture (client-server model, HTTP protocol)

Familiarity with common web technologies (HTML, JavaScript, SQL, XML, APIs)

Understanding of authentication and authorization concepts

Access to web application security testing tools (Burp Suite, OWASP ZAP)

Knowledge of secure coding principles recommended

Outputs and Deliverables

Complete vulnerability catalog with definitions, root causes, impacts, and mitigations

Category-based vulnerability groupings for systematic assessment

Quick reference for security testing and remediation

Foundation for vulnerability assessment checklists and security policies

Core Workflow

Phase 1: Injection Vulnerabilities Assessment

Evaluate injection attack vectors targeting data processing components:

SQL Injection (1)

Definition: Malicious SQL code inserted into input fields to manipulate database queries

Root Cause: Lack of input validation, improper use of parameterized queries

Impact: Unauthorized data access, data manipulation, database compromise

Mitigation: Use parameterized queries/prepared statements, input validation, least privilege database accounts

Cross-Site Scripting - XSS (2)

Definition: Injection of malicious scripts into web pages viewed by other users

Root Cause: Insufficient output encoding, lack of input sanitization

Impact: Session hijacking, credential theft, website defacement

Mitigation: Output encoding, Content Security Policy (CSP), input sanitization

Command Injection (5, 11)

Definition: Execution of arbitrary system commands through vulnerable applications

Root Cause: Unsanitized user input passed to system shells

Impact: Full system compromise, data exfiltration, lateral movement

Mitigation: Avoid shell execution, whitelist valid commands, strict input validation

XML Injection (6), LDAP Injection (7), XPath Injection (8)

Definition: Manipulation of XML/LDAP/XPath queries through malicious input

Root Cause: Improper input handling in query construction

Impact: Data exposure, authentication bypass, information disclosure

Mitigation: Input validation, parameterized queries, escape special characters

Server-Side Template Injection - SSTI (13)

Definition: Injection of malicious code into template engines

Root Cause: User input embedded directly in template expressions

Impact: Remote code execution, server compromise

Mitigation: Sandbox template engines, avoid user input in templates, strict input validation

Phase 2: Authentication and Session Security

Assess authentication mechanism weaknesses:

Session Fixation (14)

Definition: Attacker sets victim's session ID before authentication

Root Cause: Session ID not regenerated after login

Impact: Session hijacking, unauthorized account access

Mitigation: Regenerate session ID on authentication, use secure session management

Brute Force Attack (15)

Definition: Systematic password guessing using automated tools

Root Cause: Lack of account lockout, rate limiting, or CAPTCHA

Impact: Unauthorized access, credential compromise

Mitigation: Account lockout policies, rate limiting, MFA, CAPTCHA

Session Hijacking (16)

Definition: Attacker steals or predicts valid session tokens

Root Cause: Weak session token generation, insecure transmission

Impact: Account takeover, unauthorized access

Mitigation: Secure random token generation, HTTPS, HttpOnly/Secure cookie flags

Credential Stuffing and Reuse (22)

Definition: Using leaked credentials to access accounts across services

Root Cause: Users reusing passwords, no breach detection

Impact: Mass account compromise, data breaches

Mitigation: MFA, breach password checks, unique credential requirements

Insecure "Remember Me" Functionality (85)

Definition: Weak persistent authentication token implementation

Root Cause: Predictable tokens, inadequate expiration controls

Impact: Unauthorized persistent access, session compromise

Mitigation: Strong token generation, proper expiration, secure storage

CAPTCHA Bypass (86)

Definition: Circumventing bot detection mechanisms

Root Cause: Weak CAPTCHA algorithms, improper validation

Impact: Automated attacks, credential stuffing, spam

Mitigation: reCAPTCHA v3, layered bot detection, rate limiting

Phase 3: Sensitive Data Exposure

Identify data protection failures:

IDOR - Insecure Direct Object References (23, 42)

Definition: Direct access to internal objects via user-supplied references

Root Cause: Missing authorization checks on object access

Impact: Unauthorized data access, privacy breaches

Mitigation: Access control validation, indirect reference maps, authorization checks

Data Leakage (24)

Definition: Inadvertent disclosure of sensitive information

Root Cause: Inadequate data protection, weak access controls

Impact: Privacy breaches, regulatory penalties, reputation damage

Mitigation: DLP solutions, encryption, access controls, security training

Unencrypted Data Storage (25)

Definition: Storing sensitive data without encryption

Root Cause: Failure to implement encryption at rest

Impact: Data breaches if storage compromised

Mitigation: Full-disk encryption, database encryption, secure key management

Information Disclosure (33)

Definition: Exposure of system details through error messages or responses

Root Cause: Verbose error handling, debug information in production

Impact: Reconnaissance for further attacks, credential exposure

Mitigation: Generic error messages, disable debug mode, secure logging

Phase 4: Security Misconfiguration

Assess configuration weaknesses:

Missing Security Headers (26)

Definition: Absence of protective HTTP headers (CSP, X-Frame-Options, HSTS)

Root Cause: Inadequate server configuration

Impact: XSS attacks, clickjacking, protocol downgrade

Mitigation: Implement CSP, X-Content-Type-Options, X-Frame-Options, HSTS

Default Passwords (28)

Definition: Unchanged default credentials on systems/applications

Root Cause: Failure to change vendor defaults

Impact: Unauthorized access, system compromise

Mitigation: Mandatory password changes, strong password policies

Directory Listing (29)

Definition: Web server exposes directory contents

Root Cause: Improper server configuration

Impact: Information disclosure, sensitive file exposure

Mitigation: Disable directory indexing, use default index files

Unprotected API Endpoints (30)

Definition: APIs lacking authentication or authorization

Root Cause: Missing security controls on API routes

Impact: Unauthorized data access, API abuse

Mitigation: OAuth/API keys, access controls, rate limiting

Open Ports and Services (31)

Definition: Unnecessary network services exposed

Root Cause: Failure to minimize attack surface

Impact: Exploitation of vulnerable services

Mitigation: Port scanning audits, firewall rules, service minimization

Misconfigured CORS (35)

Definition: Overly permissive Cross-Origin Resource Sharing policies

Root Cause: Wildcard origins, improper CORS configuration

Impact: Cross-site request attacks, data theft

Mitigation: Whitelist trusted origins, validate CORS headers

Unpatched Software (34)

Definition: Systems running outdated vulnerable software

Root Cause: Neglected patch management

Impact: Exploitation of known vulnerabilities

Mitigation: Patch management program, vulnerability scanning, automated updates

Phase 5: XML-Related Vulnerabilities

Evaluate XML processing security:

XXE - XML External Entity Injection (37)

Definition: Exploitation of XML parsers to access files or internal systems

Root Cause: External entity processing enabled

Impact: File disclosure, SSRF, denial of service

Mitigation: Disable external entities, use safe XML parsers

XEE - XML Entity Expansion (38)

Definition: Excessive entity expansion causing resource exhaustion

Root Cause: Unlimited entity expansion allowed

Impact: Denial of service, parser crashes

Mitigation: Limit entity expansion, configure parser restrictions

XML Bomb (Billion Laughs) (39)

Definition: Crafted XML with nested entities consuming resources

Root Cause: Recursive entity definitions

Impact: Memory exhaustion, denial of service

Mitigation: Entity expansion limits, input size restrictions

XML Denial of Service (65)

Definition: Specially crafted XML causing excessive processing

Root Cause: Complex document structures without limits

Impact: CPU/memory exhaustion, service unavailability

Mitigation: Schema validation, size limits, processing timeouts

Phase 6: Broken Access Control

Assess authorization enforcement:

Inadequate Authorization (40)

Definition: Failure to properly enforce access controls

Root Cause: Weak authorization policies, missing checks

Impact: Unauthorized access to sensitive resources

Mitigation: RBAC, centralized IAM, regular access reviews

Privilege Escalation (41)

Definition: Gaining elevated access beyond intended permissions

Root Cause: Misconfigured permissions, system vulnerabilities

Impact: Full system compromise, data manipulation

Mitigation: Least privilege, regular patching, privilege monitoring

Forceful Browsing (43)

Definition: Direct URL manipulation to access restricted resources

Root Cause: Weak access controls, predictable URLs

Impact: Unauthorized file/directory access

Mitigation: Server-side access controls, unpredictable resource paths

Missing Function-Level Access Control (44)

Definition: Unprotected administrative or privileged functions

Root Cause: Authorization only at UI level

Impact: Unauthorized function execution

Mitigation: Server-side authorization for all functions, RBAC

Phase 7: Insecure Deserialization

Evaluate object serialization security:

Remote Code Execution via Deserialization (45)

Definition: Arbitrary code execution through malicious serialized objects

Root Cause: Untrusted data deserialized without validation

Impact: Complete system compromise, code execution

Mitigation: Avoid deserializing untrusted data, integrity checks, type validation

Data Tampering (46)

Definition: Unauthorized modification of serialized data

Root Cause: Missing integrity verification

Impact: Data corruption, privilege manipulation

Mitigation: Digital signatures, HMAC validation, encryption

Object Injection (47)

Definition: Malicious object instantiation during deserialization

Root Cause: Unsafe deserialization practices

Impact: Code execution, unauthorized access

Mitigation: Type restrictions, class whitelisting, secure libraries

Phase 8: API Security Assessment

Evaluate API-specific vulnerabilities:

Insecure API Endpoints (48)

Definition: APIs without proper security controls

Root Cause: Poor API design, missing authentication

Impact: Data breaches, unauthorized access

Mitigation: OAuth/JWT, HTTPS, input validation, rate limiting

API Key Exposure (49)

Definition: Leaked or exposed API credentials

Root Cause: Hardcoded keys, insecure storage

Impact: Unauthorized API access, abuse

Mitigation: Secure key storage, rotation, environment variables

Lack of Rate Limiting (50)

Definition: No controls on API request frequency

Root Cause: Missing throttling mechanisms

Impact: DoS, API abuse, resource exhaustion

Mitigation: Rate limits per user/IP, throttling, DDoS protection

Inadequate Input Validation (51)

Definition: APIs accepting unvalidated user input

Root Cause: Missing server-side validation

Impact: Injection attacks, data corruption

Mitigation: Strict validation, parameterized queries, WAF

API Abuse (75)

Definition: Exploiting API functionality for malicious purposes

Root Cause: Excessive trust in client input

Impact: Data theft, account takeover, service abuse

Mitigation: Strong authentication, behavior analysis, anomaly detection

Phase 9: Communication Security

Assess transport layer protections:

Man-in-the-Middle Attack (52)

Definition: Interception of communication between parties

Root Cause: Unencrypted channels, compromised networks

Impact: Data theft, session hijacking, impersonation

Mitigation: TLS/SSL, certificate pinning, mutual authentication

Insufficient Transport Layer Security (53)

Definition: Weak or outdated encryption for data in transit

Root Cause: Outdated protocols (SSLv2/3), weak ciphers

Impact: Traffic interception, credential theft

Mitigation: TLS 1.2+, strong cipher suites, HSTS

Insecure SSL/TLS Configuration (54)

Definition: Improperly configured encryption settings

Root Cause: Weak ciphers, missing forward secrecy

Impact: Traffic decryption, MITM attacks

Mitigation: Modern cipher suites, PFS, certificate validation

Insecure Communication Protocols (55)

Definition: Use of unencrypted protocols (HTTP, Telnet, FTP)

Root Cause: Legacy systems, security unawareness

Impact: Traffic sniffing, credential exposure

Mitigation: HTTPS, SSH, SFTP, VPN tunnels

Phase 10: Client-Side Vulnerabilities

Evaluate browser-side security:

DOM-based XSS (56)

Definition: XSS through client-side JavaScript manipulation

Root Cause: Unsafe DOM manipulation with user input

Impact: Session theft, credential harvesting

Mitigation: Safe DOM APIs, CSP, input sanitization

Insecure Cross-Origin Communication (57)

Definition: Improper handling of cross-origin requests

Root Cause: Relaxed CORS/SOP policies

Impact: Data leakage, CSRF attacks

Mitigation: Strict CORS, CSRF tokens, origin validation

Browser Cache Poisoning (58)

Definition: Manipulation of cached content

Root Cause: Weak cache validation

Impact: Malicious content delivery

Mitigation: Cache-Control headers, HTTPS, integrity checks

Clickjacking (59, 71)

Definition: UI redress attack tricking users into clicking hidden elements

Root Cause: Missing frame protection

Impact: Unintended actions, credential theft

Mitigation: X-Frame-Options, CSP frame-ancestors, frame-busting

HTML5 Security Issues (60)

Definition: Vulnerabilities in HTML5 APIs (WebSockets, Storage, Geolocation)

Root Cause: Improper API usage, insufficient validation

Impact: Data leakage, XSS, privacy violations

Mitigation: Secure API usage, input validation, sandboxing

Phase 11: Denial of Service Assessment

Evaluate availability threats:

DDoS - Distributed Denial of Service (61)

Definition: Overwhelming systems with traffic from multiple sources

Root Cause: Botnets, amplification attacks

Impact: Service unavailability, revenue loss

Mitigation: DDoS protection services, rate limiting, CDN

Application Layer DoS (62)

Definition: Targeting application logic to exhaust resources

Root Cause: Inefficient code, resource-intensive operations

Impact: Application unavailability, degraded performance

Mitigation: Rate limiting, caching, WAF, code optimization

Resource Exhaustion (63)

Definition: Depleting CPU, memory, disk, or network resources

Root Cause: Inefficient resource management

Impact: System crashes, service degradation

Mitigation: Resource quotas, monitoring, load balancing

Slowloris Attack (64)

Definition: Keeping connections open with partial HTTP requests

Root Cause: No connection timeouts

Impact: Web server resource exhaustion

Mitigation: Connection timeouts, request limits, reverse proxy

Phase 12: Server-Side Request Forgery

Assess SSRF vulnerabilities:

SSRF - Server-Side Request Forgery (66)

Definition: Manipulating server to make requests to internal resources

Root Cause: Unvalidated user-controlled URLs

Impact: Internal network access, data theft, cloud metadata access

Mitigation: URL whitelisting, network segmentation, egress filtering

Blind SSRF (87)

Definition: SSRF without direct response visibility

Root Cause: Similar to SSRF, harder to detect

Impact: Data exfiltration, internal reconnaissance

Mitigation: Allowlists, WAF, network restrictions

Time-Based Blind SSRF (88)

Definition: Inferring SSRF success through response timing

Root Cause: Processing delays indicating request outcomes

Impact: Prolonged exploitation, detection evasion

Mitigation: Request timeouts, anomaly detection, timing monitoring

Phase 13: Additional Web Vulnerabilities

#	Vulnerability	Root Cause	Impact	Mitigation
67	HTTP Parameter Pollution	Inconsistent parsing	Injection, ACL bypass	Strict parsing, validation
68	Insecure Redirects	Unvalidated targets	Phishing, malware	Whitelist destinations
69	File Inclusion (LFI/RFI)	Unvalidated paths	Code exec, disclosure	Whitelist files, disable RFI
70	Security Header Bypass	Misconfigured headers	XSS, clickjacking	Proper headers, audits
72	Inadequate Session Timeout	Excessive timeouts	Session hijacking	Idle termination, timeouts
73	Insufficient Logging	Missing infrastructure	Detection gaps	SIEM, alerting
74	Business Logic Flaws	Insecure design	Fraud, unauthorized ops	Threat modeling, testing

Phase 14: Mobile and IoT Security

#	Vulnerability	Root Cause	Impact	Mitigation
76	Insecure Mobile Storage	Plain text, weak crypto	Data theft	Keychain/Keystore, encrypt
77	Insecure Mobile Transmission	HTTP, cert failures	Traffic interception	TLS, cert pinning
78	Insecure Mobile APIs	Missing auth/validation	Data exposure	OAuth/JWT, validation
79	App Reverse Engineering	Hardcoded creds	Credential theft	Obfuscation, RASP
80	IoT Management Issues	Weak auth, no TLS	Device takeover	Strong auth, TLS
81	Weak IoT Authentication	Default passwords	Unauthorized access	Unique creds, MFA
82	IoT Vulnerabilities	Design flaws, old firmware	Botnet recruitment	Updates, segmentation
83	Smart Home Access	Insecure defaults	Privacy invasion	MFA, segmentation
84	IoT Privacy Issues	Excessive collection	Surveillance	Data minimization

Phase 15: Advanced and Zero-Day Threats

#	Vulnerability	Root Cause	Impact	Mitigation
89	MIME Sniffing	Missing headers	XSS, spoofing	X-Content-Type-Options
91	CSP Bypass	Weak config	XSS despite CSP	Strict CSP, nonces
92	Inconsistent Validation	Decentralized logic	Control bypass	Centralized validation
93	Race Conditions	Missing sync	Privilege escalation	Proper locking
94-95	Business Logic Flaws	Missing validation	Financial fraud	Server-side validation
96	Account Enumeration	Different responses	Targeted attacks	Uniform responses
98-99	Unpatched Vulnerabilities	Patch delays	Zero-day exploitation	Patch management
100	Zero-Day Exploits	Unknown vulns	Unmitigated attacks	Defense in depth

Quick Reference

Vulnerability Categories Summary

Category	Vulnerability Numbers	Key Controls
Injection	1-13	Parameterized queries, input validation, output encoding
Authentication	14-23, 85-86	MFA, session management, account lockout
Data Exposure	24-27	Encryption at rest/transit, access controls, DLP
Misconfiguration	28-36	Secure defaults, hardening, patching
XML	37-39, 65	Disable external entities, limit expansion
Access Control	40-44	RBAC, least privilege, authorization checks
Deserialization	45-47	Avoid untrusted data, integrity validation
API Security	48-51, 75	OAuth, rate limiting, input validation
Communication	52-55	TLS 1.2+, certificate validation, HTTPS
Client-Side	56-60	CSP, X-Frame-Options, safe DOM
DoS	61-65	Rate limiting, DDoS protection, resource limits
SSRF	66, 87-88	URL whitelisting, egress filtering
Mobile/IoT	76-84	Encryption, authentication, secure storage
Business Logic	74, 92-97	Threat modeling, logic testing
Zero-Day	98-100	Defense in depth, threat intelligence

Critical Security Headers

Content-Security-Policy: default-src 'self'; script-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubDomains
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=()

OWASP Top 10 Mapping

OWASP 2021	Related Vulnerabilities
A01: Broken Access Control	40-44, 23, 74
A02: Cryptographic Failures	24-25, 53-55
A03: Injection	1-13, 37-39
A04: Insecure Design	74, 92-97
A05: Security Misconfiguration	26-36
A06: Vulnerable Components	34, 98-100
A07: Auth Failures	14-23, 85-86
A08: Data Integrity	45-47
A09: Logging Failures	73
A10: SSRF	66, 87-88

Constraints and Limitations

Vulnerability definitions represent common patterns; specific implementations vary

Mitigations must be adapted to technology stack and architecture

New vulnerabilities emerge continuously; reference should be updated

Some vulnerabilities overlap across categories (e.g., IDOR appears in multiple contexts)

Effectiveness of mitigations depends on proper implementation

Automated scanners cannot detect all vulnerability types (especially business logic)

Troubleshooting

Common Assessment Challenges

Challenge	Solution
False positives in scanning	Manual verification, contextual analysis
Business logic flaws missed	Manual testing, threat modeling, abuse case analysis
Encrypted traffic analysis	Proxy configuration, certificate installation
WAF blocking tests	Rate adjustment, IP rotation, payload encoding
Session handling issues	Cookie management, authentication state tracking
API discovery	Swagger/OpenAPI enumeration, traffic analysis

Vulnerability Verification Techniques

Vulnerability Type	Verification Approach
Injection	Payload testing with encoded variants
XSS	Alert boxes, cookie access, DOM inspection
CSRF	Cross-origin form submission testing
SSRF	Out-of-band DNS/HTTP callbacks
XXE	External entity with controlled server
Access Control	Horizontal/vertical privilege testing
Authentication	Credential rotation, session analysis

References

OWASP Top 10 Web Application Security Risks

CWE/SANS Top 25 Most Dangerous Software Errors

OWASP Testing Guide

OWASP Application Security Verification Standard (ASVS)

NIST Cybersecurity Framework

Source: Kumar MS - Top 100 Web Vulnerabilities