# 100 web vulnerabilities categorized into various types
**微信 smartcat9999**
---
* **Injection Vulnerabilities:**
1.SQL Injection(SQLi)
2.Cross-Site Scripting(XSS)
3.Cross-Site Request Forgery(CSRF)
4.Remote Code Execution(RCE)
5.Command Injection
6.XML Injection
7.LDAP Injection
8.XPath Injection
9.HTML Injection
10.Server-Side Includes(SSI) Injection
11.OS Command Injection
12.Blind SQL Injection
13.Server-Side Template Injection(SSTI)
* **Broken Authentication and Session Management:**
14.Session Fixation
15.Brute Force Attack
16.Session Hijacking
17.Password Cracking
18.Weak Password Storage
19.Insecure Authentication
20.Cookie Theft
21.Credential Reuse
* **Sensitive Data Exposure:**
22.Inadequate Encryption
23.Insecure Direct Object References(IDOR)
24.Data Leakage
25.Unencrypted Data Storage
26.Missing Security Headers
27.Insecure File Handling
* **Security Misconfiguration:**
28.Default Passwords
29.Directory Listing
30.Unprotected API Endpoints
31.Open Ports and Services
32.Improper Access Controls
33.Information Disclosure
34.Unpatched Software
35.Misconfigured CORS
36.HTTP Security Headers Misconfiguration
* **XML-Related Vulnerabilities:**
37.XML ExternalEntity(XXE) Injection
38.XML Entity Expansion(XEE)
39.XML Bomb
* **Broken Access Control:**
40.Inadequate Authorization
41.Privilege Escalation
42.Insecure Direct Object References
43.Forceful Browsing
44.Missing Function-Level Access Control
* **Insecure Deserialization:**
45.Remote Code Execution via Deserialization
46.Data Tampering
47.Object Injection
* **API Security Issues:**
48.Insecure API Endpoints
49.API Key Exposure
50.Lack of Rate Limiting
51.Inadequate Input Validation
* **Insecure Communication:**
52.Man-in-the-Middle(MITM) Attack
53.Insufficient Transport Layer Security
54.Insecure SSL/TLS Configuration
55.Insecure Communication Protocols
* **Client-Side Vulnerabilities:**
56.DOM-basedXSS
57.Insecure Cross-Origin Communication
58.Browser Cache Poisoning
59.Click jacking
60.HTML5 Security Issues
* **Denial of Service (DoS):**
61.Distributed Denial of Service (DDoS)
62.Application Layer DoS
63.Resource Exhaustion
64.Slowloris Attack
65.XML Denial of Service
* **Other Web Vulnerabilities:**
66.Server-Side Request Forgery (SSRF)
67.HTTP Parameter Pollution (HPP)
68.Insecure Redirects and Forwards
69.File Inclusion Vulnerabilities
[70.Security](http://70.Security) Header Bypass
71.Clickjacking
72.Inadequate Session Timeout
73.Insufficient Logging and Monitoring
[74.Business](http://74.Business) Logic Vulnerabilities
75.API Abuse
* **Mobile Web Vulnerabilities:**
76.Insecure Data Storage on Mobile Devices
77.Insecure Data Transmission on Mobile Devices
78.Insecure Mobile API Endpoints
[79.Mobile](http://79.Mobile) App Reverse Engineering
* **IoT Web Vulnerabilities:**
80.Insecure IoT Device Management
81.Weak Authentication on IoT Devices
82.IoT Device Vulnerabilities
* **Web of Things (WoT) Vulnerabilities:**
83.Unauthorized Access to Smart Homes
84.IoT Data Privacy Issues
* **Authentication Bypass:**
85.Insecure "Remember Me" Functionality
86.CAPTCHA Bypass
* **Server-Side Request Forgery (SSRF):**
87.Blind SSRF
88.Time-Based Blind SSRF
* **Content Spoofing:**
89.MIME Sniffing
90.X-Content-Type-Options Bypass
91.Content Security Policy (CSP) Bypass
* **Business Logic Flaws:**
92.Inconsistent Validation
93.Race Conditions
94.Order Processing Vulnerabilities
95.Price Manipulation
96.Account Enumeration
97.User-Based Flaws
* **Zero-Day Vulnerabilities:**
98.Unknown Vulnerabilities
99.Unpatched Vulnerabilities
100.Day-Zero Exploits