SQL injectionuser value built into the SQL string · query rewrite · CWE-89dataflow
NoSQL injectionraw request bag as a Mongo filter · operator injection · CWE-943dataflow
LDAP injectionuser value built into an LDAP filter · auth bypass / directory dump · CWE-90dataflow
XPath injectionuser value built into an XPath query · auth bypass / data extraction · CWE-643dataflow
Unrestricted uploadupload stored under the attacker's filename+extension · shell drop · CWE-434pattern
Command injectionuser input in an eval/exec/shell sink · RCE · CWE-94/78dataflow
Template injectionuser input compiled as a template source · RCE · CWE-1336dataflow
Path traversaluser input as a file path — reads arbitrary files · CWE-22/98dataflow
XSS / HTML injectionunescaped user input in an HTML sink · session theft · CWE-79dataflow
SSRFuser input as an outbound-request URL · cloud metadata theft · CWE-918dataflow
XXE injectionexternal XML entities enabled · CWE-611pattern
Open redirectuser input as a redirect target · phishing · CWE-601pattern
Prototype pollutionuser input recursively merged into an object · __proto__ inject · CWE-1321pattern
ReDoS (user regex)user input compiled as a regex pattern · CPU denial of service · CWE-1333pattern
CRLF / header injectionrequest value in a response header / cookie · response splitting · CWE-113pattern
Log injectionrequest value concatenated into a log line · forged entries / SIEM poisoning · CWE-117pattern
PHP variable extractionpopulates the local symbol table from request data · extract($_GET) / import_request_variables / single-arg parse_str · overwrite $is_admin (register_globals) · CWE-621pattern
SpEL injectiona request value reaches a Spring SpEL parser (parseExpression/parseRaw) · evaluated as a Java expression · T(java.lang.Runtime).exec(...) → RCE (CVE-2022-22963) · CWE-917pattern
Obfuscated code executionan eval/exec wrapping a decoder (eval(base64_decode(…)) · eval(atob(…)) · exec(base64.b64decode(…))) runs a decoded blob as code — the signature of a webshell or backdoor · CWE-506 / CWE-94pattern
Unsafe reflectiona request value (getParameter / getHeader) passed inline to Class.forName / getMethod — the attacker chooses which class is loaded or which method runs → arbitrary instantiation and RCE · CWE-470pattern
OGNL injectiona request value (getParameter / getHeader) evaluated inline as an OGNL expression (Ognl.getValue / parseExpression, or a Struts OgnlUtil) — the attacker authors the expression → arbitrary method invocation and RCE · CWE-917pattern
Script-engine injectiona request value (getParameter / getHeader) executed inline as script source by a JVM script engine (ScriptEngine.eval / GroovyShell.evaluate / Eval.me) — the attacker authors the program → RCE · CWE-94pattern
JNDI injectiona request value (getParameter / getHeader) is the name resolved by a JNDI context lookup (InitialContext / DirContext) — the attacker points it at a malicious LDAP/RMI server → RCE (the Log4Shell mechanism) · CWE-74pattern
EL injectiona request value (getParameter / getHeader) evaluated inline as a Jakarta/Java EL expression (ELProcessor.eval / createValueExpression) — the attacker authors the expression → RCE · CWE-917pattern
XSLT injectiona request value (getParameter / getHeader) compiled inline as an XSLT stylesheet (newTransformer / newTemplates) — the attacker authors the stylesheet, whose extension functions reach Java → RCE · CWE-91pattern
Node vm code injectiona request field (req.query / req.body) executed inline as code by the Node vm module (runInNewContext / new vm.Script) — the vm module is not a sandbox → RCE · CWE-95pattern
Node require / import injectiona request field (req.query / req.body) is the module specifier loaded inline by require() or a dynamic import() — the attacker names an arbitrary module (LFI → RCE via its top-level side-effects) · CWE-98pattern
Python import injectiona request accessor (request.args / request.GET) is the module name imported inline by __import__() or importlib.import_module() — the attacker names an arbitrary module (LFI/RCE via its side-effects) · CWE-94pattern
Go command injectiona net/http request accessor (r.FormValue / r.URL / r.Header) is passed inline to exec.Command / exec.CommandContext — the attacker injects the command → RCE · CWE-78pattern
.NET command injectionan ASP.NET request accessor (Request[...] / Request.QueryString / Request.Form) is passed inline to Process.Start / new ProcessStartInfo — the attacker injects the command → RCE · CWE-78pattern
Go SSRFa net/http request accessor (r.FormValue / r.URL / r.Header) is the URL of an outbound call by http.Get / http.Post / http.NewRequest — the server fetches an attacker-chosen endpoint (cloud metadata / localhost / internal services) · CWE-918pattern
.NET SSRFan ASP.NET request accessor (Request[...] / Request.QueryString / Request.Form) is the URL of an outbound call by HttpClient / WebClient / WebRequest.Create — the server fetches an attacker-chosen endpoint (cloud metadata / localhost / internal services) · CWE-918pattern
Go SQL injectiona net/http request accessor (r.FormValue / r.URL) is spliced into a database/sql query (db.Query / Exec) via fmt.Sprintf or concatenation — the attacker rewrites the query · CWE-89dataflow
.NET SQL injectionan ASP.NET request accessor (Request[...] / Request.QueryString) is spliced into a SQL string at a .NET sink (SqlCommand / .CommandText / EF FromSqlRaw) via interpolation, string.Format or concat — the attacker rewrites the query · CWE-89dataflow
Go path traversal / LFIa net/http request accessor (r.FormValue / r.URL) is the path of a Go file-read sink (os.Open / os.ReadFile / ioutil.ReadFile) — an attacker supplies ../../etc/passwd for arbitrary file read · CWE-22pattern
.NET path traversal / LFIan ASP.NET request accessor (Request[...] / Request.QueryString) is the path of a .NET file-read sink (File.ReadAllText / OpenRead / new StreamReader / new FileStream) — an attacker supplies ..\..\web.config for arbitrary file read · CWE-22pattern
Go open redirecta net/http request accessor (r.FormValue / r.URL.Query) is the target of http.Redirect — an attacker supplies https://evil.example to bounce the victim off your trusted domain (phishing / OAuth token theft) · CWE-601pattern
.NET open redirectan ASP.NET request accessor (Request[...] / Request.QueryString) is the target of Response.Redirect / the MVC Redirect helper — an attacker supplies https://evil.example to bounce the victim off your trusted domain (phishing / OAuth token theft) · CWE-601pattern
Go XSSa net/http request accessor (r.FormValue / r.URL.Query) is written unescaped into an HTML response (fmt.Fprintf(w, …) / w.Write / io.WriteString with markup) — the attacker's script runs in the victim's session (session theft / account takeover) · CWE-79pattern
.NET XSSan ASP.NET request accessor (Request[...] / Request.QueryString) is written unescaped to the response (Response.Write / Response.WriteAsync) — the attacker's script runs in the victim's session (session theft / account takeover) · CWE-79pattern
Go LDAP injectiona net/http request accessor (r.FormValue / r.URL.Query().Get / r.Header.Get) is built into an LDAP filter string (a `(uid=` literal via concat / fmt.Sprintf) searched by go-ldap — an attacker rewrites the filter (*)(uid=*))(|(uid=* to bypass auth or dump the directory · CWE-90pattern
.NET LDAP injectionan ASP.NET request accessor (Request[...] / Request.QueryString / Request.Form) is built into an LDAP filter string (a `(uid=` literal via concat / interpolation) run by a DirectorySearcher — an attacker rewrites the filter to bypass auth or dump the directory · CWE-90pattern
Go XPath injectiona net/http request accessor (r.FormValue / r.URL.Query().Get / r.Header.Get) is built into an XPath expression (a `//elem` / `[@attr=` literal at a go-xpath sink: xpath.Compile / htmlquery.Find / xmlquery.Find / node.SelectElements) — an attacker rewrites the query to bypass auth or read the whole document · CWE-643pattern
.NET XPath injectionan ASP.NET request accessor (Request[...] / Request.QueryString / Request.Form) is built into an XPath expression (a `//elem` / `[@attr=` literal at a .NET XPath sink: SelectNodes / SelectSingleNode / XPathNavigator.Select / XPathExpression.Compile) — an attacker rewrites the query to bypass auth or read the whole XML document · CWE-643pattern
Go template (SSTI)a net/http request accessor (r.FormValue / r.URL.Query().Get / r.Header.Get) becomes the template SOURCE of a template.New(...).Parse( chain (Go text/template · html/template) — the attacker controls the template itself (action injection, info disclosure) · CWE-1336pattern
.NET template (SSTI)an ASP.NET request accessor (Request[...] / Request.QueryString / Request.Form) becomes the template SOURCE of a Razor/Scriban compile sink (RunCompile / CompileRenderStringAsync / Razor.Parse / Template.Parse) — the attacker controls the template (Razor @{ } C# code = RCE) · CWE-1336pattern
Go log injectiona net/http request accessor (r.FormValue / r.URL.Query().Get / r.Header.Get) is concatenated with + into a Go log call (log.Printf / slog.Info / a logrus-zap logger) with no CR/LF stripping — an attacker forges log entries or poisons a SIEM parser · CWE-117pattern
.NET log injectionan ASP.NET request accessor (Request[...] / Request.QueryString / Request.Form) is concatenated (+) or $"..."-interpolated into a .NET log call (ILogger Log* / Console.WriteLine / Serilog) with no CR/LF stripping — an attacker forges log entries or poisons a SIEM · CWE-117pattern
Go zip-slipan archive entry name (zip/tar .Name) is joined with filepath.Join into a Go file-create sink (os.Create / os.OpenFile / os.MkdirAll) with no containment check — a crafted archive writes ../../ outside the target dir, an arbitrary file write / RCE · CWE-22pattern
.NET zip-slipa ZipArchiveEntry .FullName is joined with Path.Combine into a .NET extract sink (entry.ExtractToFile / new FileStream / File.Create) with no containment check — a crafted archive writes ../../ outside the target dir, an arbitrary file write / RCE · CWE-22pattern
Go weak randomnessa security-named value (token / OTP / session id / salt) is generated from the non-cryptographic math/rand package (Intn / Int63 / Uint64 / Perm) — the value is predictable, an account-takeover / reset-token-prediction risk · CWE-338pattern
.NET weak randomnessa security-named value (token / OTP / session id / salt) is generated from System.Random (new Random() / Random.Shared / rnd.Next*) — the value is predictable, an account-takeover / reset-token-prediction risk · CWE-338pattern
Go CORS misconfigurationa net/http handler sets the Access-Control-Allow-Origin response header to the caller's own Origin request header (w.Header().Set with r.Header.Get Origin) — any site is reflected as an allowed origin; with credentials this is a full same-origin bypass, account takeover · CWE-942pattern
.NET CORS misconfigurationan ASP.NET handler sets Access-Control-Allow-Origin to the caller's own Request.Headers Origin, or a Core CORS policy uses SetIsOriginAllowed(_ => true) with AllowCredentials() — any site gets a credentialed cross-origin response, account takeover · CWE-942pattern
Go NoSQL injectiona net/http request value reaches a MongoDB server-side-JS operator ($where / $function / $accumulator) or is parsed as an extended-JSON query document (bson.UnmarshalExtJSON) — attacker JavaScript runs in the database, or query operators are smuggled ({$ne:null} auth bypass, {$gt:''} dump) · CWE-943pattern
.NET NoSQL injectionan ASP.NET request value reaches a MongoDB server-side-JS operator ($where / $function / $accumulator) or is parsed as a BSON query document (BsonDocument.Parse) — attacker JavaScript runs in the database, or query operators are smuggled ({$ne:null} auth bypass) · CWE-943pattern
Go unrestricted uploada Go multipart upload's raw client .Filename (from multipart.FileHeader) is written to a path-built destination (os.Create / os.OpenFile / os.WriteFile) with no allow-list or generated name — the attacker drops shell.php / x.aspx into a servable directory → RCE · CWE-434pattern
.NET unrestricted uploada .NET multipart upload's raw client .FileName (from IFormFile / HttpPostedFile) is written to disk via SaveAs or a create sink (new FileStream / File.Create) on a path-built destination with no allow-list — the attacker drops shell.aspx into a servable directory → RCE · CWE-434pattern
Go unsafe reflectiona net/http request value names the Go plugin to load (plugin.Open) or the method to invoke (reflect MethodByName) — the attacker chooses which code runs: a plugin's init() executes (RCE) or an arbitrary method is called · CWE-470pattern
.NET unsafe reflectionan ASP.NET request value names the type/assembly to load (Type.GetType / Assembly.Load / Activator.CreateInstance) or the method to invoke (GetMethod / InvokeMember) — arbitrary class instantiation / method call → RCE · CWE-470pattern
LLM insecure code executionan LLM agent is handed an arbitrary-code executor (a Python REPL tool, a PAL chain, a pandas/csv/python code agent, or allow_dangerous_code=True) — a prompt-injected instruction becomes code the runner executes · OWASP LLM06 excessive agency → RCE · CWE-94pattern