Haxplain

A social-engineering attack that uses a convincing but fraudulent message to trick a person into revealing credentials, approving a payment, or running malware.

An automated attack that replays username and password pairs leaked from other breaches against your login, succeeding wherever people reused a password.

A phishing variant that hides the malicious link inside a QR code, so the target's phone opens the lure and the email or print gateway never sees a URL to inspect.

A wireless impersonation attack where an unauthorised access point advertises a trusted network name so nearby devices join it and expose credentials and traffic.

An extension that looks useful but holds broad permissions it does not need, letting it read pages, capture sessions and send data to an outside host from inside a trusted browser.

A dropped or planted USB device that relies on curiosity: once plugged in, it either auto-runs code or pretends to be a keyboard and types commands, bypassing the network perimeter entirely.

A lateral-movement technique in which an intruder authenticates to other Windows systems using a stolen NTLM password hash instead of the password, so strong passwords alone do not stop it.

An Active Directory attack in which a service ticket, encrypted with a key derived from a service account's password, is taken and attacked offline, so weak service-account passwords fall without any failed-logon noise.

A web attack in which a page on another site causes the victim's browser to send a state-changing request to an application where they are signed in, and the browser attaches their session cookie automatically.

A flaw where a server fetches a URL supplied by a user, letting that user steer the request toward internal services and cloud metadata endpoints that the server can reach but they cannot.

A web security misconfiguration in which an API tells browsers that any site may read its responses, often by echoing the request's Origin header while also allowing credentials, so a hostile page can read a signed-in user's private data.

A flaw in which untrusted input is concatenated into a database query, so the database parses data as part of the command; it is prevented by keeping query structure and values separate with parameterized queries.

A flaw in which untrusted input is placed into a web page without contextual output encoding, so the browser treats data as active content; it is prevented by encoding output for its context, framework auto-escaping and a strict Content-Security-Policy.

A flaw in which untrusted input is placed into a command string run by the operating system shell, so the shell reads data as extra instructions; it is prevented by not using a shell and passing arguments as an array.

A flaw in LLM applications where untrusted text placed in the model's context is treated as instructions, so it can override intended behaviour or trigger misuse of connected tools; it is contained by separating instructions from data, limiting tool privilege and treating model output as untrusted.

A risk in which untrusted or tampered training, fine-tuning or retrieval data shifts a model's behaviour; it is reduced by data provenance, validation, dataset versioning, pre-deploy evaluation and source allowlists.

A broken access control flaw in which an endpoint returns or changes a record chosen by an identifier in the request without checking that the signed-in caller is allowed to touch that specific record.

A flaw in which user-supplied input is used to build a filesystem path without confinement, so a request can reach files outside the intended directory; it is prevented by resolving the path and verifying it stays inside an allow-listed base directory.

A flaw in which an XML parser is configured to resolve external entities while reading untrusted XML, letting the document make the server read local resources or reach other systems; it is prevented by disabling DTDs and external entities in the parser.

A web flaw in which an endpoint sends the browser to a destination taken from a user-supplied parameter without validating it, so a link on a trusted domain can lead users to an attacker-controlled site.

A web attack in which a sensitive page is loaded in a hidden or disguised frame on another site and positioned so the victim's clicks land on the framed page's buttons instead of what they think they are clicking.

A web flaw in which an application keeps the same session identifier across the login boundary, so an identifier known to someone else before sign-in becomes an authenticated session once the user logs in.

A web flaw in which session identifiers are generated from a predictable source or are too short, so a valid identifier for another user's session can be guessed instead of having to be stolen.

A flaw in which an application accepts files without verifying what they are or controlling where they land, so an uploaded file can be stored in an executable location or served back unsafely; it is prevented by validating real content, storing files outside the web root and serving them as inert downloads.

A broken access control flaw in which a normal user reaches an administrative action, or acts on another user's resources, because the server relies on a hidden button or a client-supplied role instead of checking permission on every request.

A flaw in which an endpoint binds the whole request body onto an internal object, so a client can set fields it should never control, such as a role, a verified flag, a balance or an owner id.

A JavaScript flaw in which untrusted keys reach an object's prototype through an unguarded recursive merge or clone, changing the defaults every object inherits; it is prevented by rejecting dangerous keys and merging into prototype-free structures.

A web flaw in which an application trusts the Host or X-Forwarded-Host request header to build absolute URLs or cache keys, so a caller-supplied value can redirect reset links to another domain or poison cached pages.

A weakness in which a login, signup or password-reset flow reveals whether an account exists, through different messages, status codes or response times, letting someone build a list of valid usernames.

A flaw in which untrusted input is placed into a style context such as an inline style attribute, a style block or a user-controlled theme, letting attacker-supplied styling leak page data or redress the interface; it is prevented by never putting untrusted data in CSS, strict allow-lists and a restrictive Content-Security-Policy.

A flaw in which a backtracking regular expression with ambiguous, nested repetition is run on untrusted input (or the app runs a user-supplied pattern), so one request can consume a CPU for a very long time; it is prevented with safe patterns, a linear-time engine, input limits and timeouts.

A web weakness in which an authenticated endpoint returns sensitive data as executable JavaScript or JSONP, so a script tag on another site can include it, ride the victim's cookies and expose the data to that site.

An attack that exhausts the bandwidth, connection capacity or compute of a service so legitimate users cannot use it, either by sheer traffic volume or by repeatedly hitting expensive application operations.

A condition where a DNS resolver accepts and caches a forged answer, so users and systems asking for a known name are silently sent to the wrong host.

An on-path attack on a hostile network that keeps a victim on plain HTTP while talking HTTPS to the real server, so credentials and sessions travel in the clear.

An on-path attack that pushes a client and server to negotiate an older protocol version or weaker cipher than both support, so the protected channel can be broken.

A service sends credentials or sensitive data over plain HTTP or another unencrypted protocol, so anyone on the network path can read it.

A condition where a DNS record still points at a cloud resource that has been deleted, letting a third party register that resource and serve content under your trusted subdomain.

Forging the sender identity of an email so a message appears to come from a trusted domain, defeated by publishing SPF and DKIM and enforcing DMARC.

Criminals buy or inject ads on legitimate networks so that a trusted site ends up serving visitors a scam redirect or a malware delivery path without the site itself being hacked.

A family of flaws in which an application stores passwords in plaintext or with a fast, unsalted hash, or enforces a weak policy, so a single database leak turns into mass account takeover; it is prevented by slow salted password hashing, breached-password screening and rate limiting with MFA.

A weakness in which an application reveals internal detail, such as stack traces, version banners, debug endpoints or secrets, to people who should never see it, giving an attacker a map of the system.

A memory-safety flaw in which code writes more data into a fixed-size buffer than it can hold, corrupting adjacent memory; it is prevented by bounds-checked code, memory-safe languages and compiler and operating-system mitigations.

A denial-of-service flaw in which an XML parser with no expansion limits lets a tiny document consume huge amounts of CPU and memory; it is prevented by disabling DTDs, enabling secure processing and capping entity expansion, document size and depth.

A risk in which an application ships third-party packages that carry known vulnerabilities, are abandoned, or are outright malicious, and is controlled by software composition analysis, pinned and verified dependencies, and an SBOM.

A weakness in which security-relevant events are not recorded, are recorded without useful detail, or are never reviewed or alerted on, so attacks against an application go unnoticed and uninvestigated.

A flaw where an LLM application exposes secrets, personal data or another user's information in its output; it is contained by keeping secrets out of prompts, enforcing per-user access control on retrieval and tools, minimising data and filtering output.

A supply chain attack in which an attacker registers a package name that coding assistants tend to hallucinate, so a developer who installs an AI-suggested dependency without checking pulls in the attacker's package, and is controlled by verifying packages before install, pinning with integrity hashes, and human review of new dependencies.