Web App Security Glossary

An attack where malicious SQL is inserted into queries via unsanitized user input.

An attack where malicious scripts are injected into web pages viewed by other users.

An attack that tricks authenticated users into performing unwanted actions on your app.

An attack that tricks your server into making requests to internal or cloud metadata services.

A vulnerability where users can access other users' data by changing an ID parameter.

An attack where file paths are manipulated to access restricted files on the server.

An attack that allows arbitrary code execution on your server from a remote source.

An attack that includes local files on the server through user-controlled input.

An attack that includes remote files from external servers through vulnerable includes.

Overly permissive cross-origin resource sharing settings that expose your API.

An attack that tricks users into clicking invisible elements on a page.

Claiming an unclaimed external service pointed to by a subdomain's CNAME record.

Exploitation of weak JWT implementations including algorithm confusion and weak secrets.

An attack where an attacker sets a user's session ID to a known value.

A redirect endpoint that forwards users to arbitrary URLs without validation.

Binding all request parameters to model attributes without filtering sensitive fields.

API vulnerability where object-level access controls are missing or broken.

Accidentally exposing API keys in client-side code or public repositories.

Improper management of secrets through environment variables in client-accessible contexts.

Malicious code introduced through third-party dependencies or compromised packages.

Installing a malicious public package with the same name as an internal private package.

Registering packages with names similar to popular ones to trick developers into installing malware.

Manipulating an LLM's behavior by injecting malicious instructions into user input.

Bypassing an LLM's content safety filters with creative prompting.

Extracting training data from a machine learning model through query-based attacks.

Injecting malicious data into a model's training set to corrupt its behavior.

Injecting malicious content into the knowledge base of a RAG system.

Executing arbitrary code by manipulating serialized objects.

Exploiting XML parsers to read internal files or perform SSRF.

A header that forces browsers to only access your site over HTTPS.

A security header that controls which resources can load on your page.

A browser mechanism controlling which origins can access your web resources.

A DNS record that authorizes which servers can send email for your domain.

A cryptographic email signature that verifies email authenticity.

A policy that tells receiving servers how to handle unauthenticated email.

A security extension that cryptographically signs DNS records to prevent spoofing.

Database-level access control that restricts which rows users can see or modify.

A formal inventory of all components in your software.

A standardized identifier for publicly known security vulnerabilities.

A standard for rating the severity of security vulnerabilities.

A taxonomy of software weakness types.

A nonprofit foundation improving software security through open-source resources.

A vulnerability that is exploited before the vendor knows about it or has a fix.

Authorized simulated attacks to identify security vulnerabilities.

Automated security testing against running applications.

Automated source code analysis for security vulnerabilities.

Automated analysis of open-source components for known vulnerabilities.

Automated security scanning of infrastructure templates and configuration files.

Automated detection and remediation of cloud infrastructure risks.

Restricting the number of requests a client can make within a time window.

Cryptographically verifying that webhook events come from the expected service.

A mathematical framework for ensuring individual data cannot be inferred from query results.

Circumventing login or identity verification mechanisms.

Injecting malicious template directives to achieve RCE on the server.