Tag: owasp-top10
Server-Side Includes (SSI) Injection
Attacker-controlled SSI directives (`<!--#exec ... -->`) injected into pages parsed by Apache or another SSI-enabled server, achieving file disclosure or remote command execution.
CWE-97 OWASP A3:2021
1w ago
security intermediate
9.8
Security Misconfiguration PHP 5.0+
Insecure default settings, unnecessary features, or missing hardening steps leave applications and infrastructure exposed.
CWE-16 OWASP A5:2021
2mo ago
security beginner
7.5
Sensitive Data Exposure PHP 5.0+
Passwords, tokens, PII, or financial data exposed in logs, error messages, URLs, or unencrypted storage.
CWE-200 OWASP A2:2021
2mo ago
security beginner
Server-Side Request Forgery (SSRF) PHP 5.0+ The server is tricked into making HTTP requests to internal or unintended destinations on behalf of the attacker.
CWE-918 OWASP A10:2021
2mo ago
security advanced
8.6
SQL Injection PHP 5.1+ Unsanitised user input inserted directly into a SQL query, letting attackers read, modify, or delete database data.
CWE-89 OWASP A3:2021
2mo ago
security intermediate
9.8