Common Web Vulnerabilities and How They Work
Why Vulnerabilities Recur
Root Causes
Many web vulnerabilities stem from unsafe input handling, missing authorization checks, flawed output encoding, insecure deserialization, and weak trust boundaries between users, services, and storage.
Vulnerability Categories
| Category | Typical Mechanism |
|---|---|
| Injection | Untrusted data changes a command or query |
| XSS | Untrusted data becomes executable script in a browser |
| CSRF | A victim is tricked into sending an unwanted request |
| IDOR | An object is accessible without proper authorization |
| File upload issues | Malicious files or paths are handled unsafely |
Context Matters
A flaw name alone is not enough. You must understand the business logic, trust boundary, and data flow that make the flaw exploitable.
Injection vs XSS
Injection
- Attacker-controlled input changes backend behavior
- Often affects databases, shells, or interpreters
- May impact confidentiality, integrity, and availability
XSS
- Attacker-controlled input executes in a victim browser
- Often impacts users and sessions
- Can lead to account compromise or fraud
What is the main idea behind an IDOR flaw?
IDORs occur when access to an object depends on guessable identifiers without proper permission checks.
Correct answer: An object is accessible without proper authorization
Why is output encoding important?
Encoding helps preserve data as data rather than executable code.
Correct answer: It prevents untrusted data from being interpreted as active content by a browser or other parser.
Recognizing Risk in Practice
Impact and Exploitability
A vulnerability becomes high priority when it is easy to reach, easy to trigger, and capable of causing meaningful harm. The most useful assessments connect technical flaws to real business consequences.
Which factor most increases the priority of a vulnerability?
Business impact is central to prioritization.
Correct answer: It affects a critical business process
Give one reason business logic flaws are dangerous.
Business logic flaws exploit process mistakes, not just code bugs.
Correct answer: They can bypass intended controls even when standard technical protections are present.