Field-tested attack research, mined from real disclosures.

Reflected Cross-Site Scripting

Unknown Weakness

This is HackerOne's own miscellaneous bucket - reports that the platform's automated classifier couldn't confidently map to any specific weakness type, either because the write-up described a novel or hybrid issue, covered multiple distinct bugs in one report, or was too sparse f

788 reports

6 min read

Information Disclosure

The largest bucket in the corpus, spanning very different sub-classes: (1) outdated-software CVE markers (Jira CVE-2020-14179, ColdFusion, Confluence, GitLab) - already covered by Nuclei; (2) public source / config leaks (.env, .git/config, phpinfo, /debug, dump.sql, backup.tar,

779 reports · 10 samples

high priority6 min read

Broken Access Control

Massive bucket spanning unauthenticated-to-internal-resource leaks, role-bypass within multi-tenant apps, and admin-panel exposure. Top patterns: (1) `..;/` and other traversal/normalization tricks bypassing front-door auth (Tomcat scripts, JBoss, WebLogic, IIS); (2) header-based

612 reports · 10 samples

All research

5 min read

Reflected XSS lets an attacker inject a script through a request parameter that's echoed back unescaped, running in the victim's browser via a crafted link. Reflected XSS reports cluster around four reflection contexts: (1) HTML body - payload reflected raw inside <body>/<div> wi

481 reports · 10 samples

4 min read

Stored Cross-Site Scripting

Stored XSS reports follow predictable shapes: (1) profile fields - name, bio, company, signature reflected on viewing pages; (2) message bodies - chat, comment, review, support ticket; (3) file-upload-to-XSS - uploading SVG, HTML, PDF, or via Content-Type confusion (text/html wit

443 reports · 10 samples

high priority4 min read

DoS / Resource Exhaustion

Reports cluster around: (1) ReDoS - vulnerable regex in input-validation paths (Rails Money type, Fastify, every-language ecosystem); (2) HTTP/2 'unknownProtocol' leak (Node CVE-2021-22883); (3) CPU/memory exhaustion via large file upload, deeply-nested JSON, ZIP/gzip bomb, parse

313 reports · 10 samples

Business Logic Errors

A business-logic flaw abuses the legitimate, intended workflow of an application in a way its designers didn't anticipate, without tripping any technical security control - no injection, no broken access control in the conventional sense, just the rules of the workflow itself bei

306 reports

Broken Authentication

This bucket sweeps a wide range of auth bypasses, missing-auth endpoints, and unverified-account abuses. Top patterns: (1) admin/dashboard panels reachable without auth (Grafana, Prometheus, Kibana, Jenkins, Adminer, Spring Boot Actuator, Cisco ASA web interface) - 'no auth' rath

305 reports · 10 samples

Violation of Secure Design Principles

This is CWE-657's umbrella category: the system's security failed not because of an implementation bug in otherwise-sound architecture, but because a foundational design decision itself was insecure - trusting client-side validation as the sole check, relying on an unguessable UR

286 reports

Insecure Direct Object Reference

Classic IDOR pattern: server uses a user-supplied identifier without checking that the requesting user is authorized for that resource. Variants: (1) numeric/sequential IDs (?uid=N, /reports/N) where authorization isn't enforced; (2) UUID/GUID feels like opaque but is exposed els

257 reports · 10 samples

Privilege Escalation

An attacker gains access to functionality or data reserved for a higher privilege tier than their own account holds - a regular user reaching an admin-only action, or a support-role account reaching a super-admin capability. Confirming this class requires two things a fully unaut

237 reports

Cross-Site Request Forgery

CSRF reports in this corpus cluster around four root causes: (1) missing or unvalidated anti-CSRF tokens on state-changing endpoints, (2) state-changing actions exposed via GET, (3) cookies without SameSite=Lax/Strict so cross-origin POSTs carry session, and (4) custom CSRF token

235 reports · 10 samples

3 min read

Code Injection

Wider than just OS Command Injection - covers language-level eval / dynamic-dispatch sinks (PHP `previewBlock` -> eval, Ruby `OptionParser.load`, Python yaml.load, server-side template engines), framework RCE CVEs (Apache Struts2 S2-045, Primefaces CVE-2017-1000486, Drupal CVE-20

218 reports · 10 samples

Server-Side Request Forgery

Path Traversal

Path traversal lets an attacker read, and sometimes write, files outside a web app's intended directory via `../` sequences in a file-path parameter. Canonical Path Traversal category. Reports cluster around: (1) classic ../ traversal in URL parameters used as file paths; (2) Apa

214 reports

high priority6 min read

Server-side request forgery lets an attacker make a server issue requests to arbitrary URLs, exposing internal services, cloud metadata, and local files. SSRF reports in this corpus consistently exploit features that fetch a user-controlled URL: webhook configuration, link previe

207 reports · 10 samples

Memory Corruption - Generic

This is the umbrella CWE bucket for native-code memory-safety bugs - out-of-bounds reads/writes, use-after-free, double-free, and related classes - grouped here because the disclosed report either spanned more than one specific pattern or didn't specify precisely enough to sort i

195 reports

Cross-Site Scripting (Generic)

This bucket holds XSS reports that triagers didn't categorize as reflected, stored, or DOM-based. The patterns are a superset of those specific subcategories: any input field, header, cookie, or referenced URL that lands in the DOM unsanitized. Most reports filed under this gener

187 reports

3 min read

Open Redirect

Open-redirect reports cluster around naive redirect parameter handling: server takes user-controlled `?url=`, `?return_to=`, `?redirect=`, `?next=`, `?goto=`, `?dest=`, `?continue=` and Locations to it without scheme/host validation. Bypass tricks: protocol-relative `//evil.com`,

170 reports · 10 samples

3 min read

SQL Injection

Classic SQLi reports clustered around: (1) URL/POST parameter injection into legacy ASP/PHP pages - `?id=1' OR '1'='1`; (2) time-based blind via `WAITFOR DELAY` (MSSQL), `SLEEP()` (MySQL), `pg_sleep()` (PostgreSQL); (3) Header-based SQLi via Referer, User-Agent, X-Forwarded-For w

163 reports · 10 samples

high priority6 min read

OS Command Injection (and adjacent code-execution chains)

This H1 bucket is wider than its name - alongside classic OS command injection (shell metacharacters in user input passed to popen/spawn/system/exec) it contains: (1) language-level eval/dynamic-dispatch sinks (PHP `$action()` from POST, Ruby OptionParser.load reading `|cmd`, Net

137 reports · 10 samples

4 min read

DOM-Based Cross-Site Scripting

DOM XSS reports cluster around dangerous-sink usage in client-side JavaScript: (1) `document.location` / `location.search` / `location.hash` parsed and concatenated into innerHTML / document.write / eval; (2) `postMessage` handlers using `event.data` without origin check writing

120 reports · 9 samples

medium priority3 min read

Improper Restriction of Authentication Attempts

This is the missing-rate-limit class: a login, registration, password-reset, or OTP-verification endpoint accepts an unlimited number of attempts from the same client with no throttling, lockout, or CAPTCHA challenge kicking in. On its own it enables credential-stuffing and passw

83 reports

medium priority3 min read

Misconfiguration

Catch-all bucket: CORS bypass, Spring Boot Actuator exposed, GraphQL introspection on, weak password policy with default creds, stale DNS pointing to takeover-able CDN, missing CAA records, social-link hijack on team pages, error-page text injection. Covered by existing/proposed

79 reports · 10 samples

UI Redressing (Clickjacking)

Clickjacking loads a sensitive page (account settings, a "delete" or "authorize" button, an OAuth consent screen) inside a transparent or disguised iframe on an attacker's page, so a click the victim believes is landing on the attacker's own UI actually lands on the hidden page u

73 reports

Privacy Violation

This category covers mishandling of personal data in ways that breach user privacy expectations or regulatory obligations (GDPR, CCPA, and similar) rather than a technical access-control failure - collecting more data than disclosed in a privacy policy, sharing data with third pa

72 reports

Cleartext Storage / Secrets Leakage

Reports center on secrets stored or accessible in cleartext: API keys in JS bundles, GitHub commits, source-mapped sources, public config endpoints (/config), license-key text files served from CDN, Elasticsearch indices storing Authorization headers, Kubernetes Secrets created f

69 reports · 8 samples

Cryptographic Issues - Generic

This is the umbrella bucket for cryptographic implementation mistakes that don't fit one of the narrower named categories below - using a correct algorithm with a subtly wrong mode (ECB instead of CBC/GCM), a static or predictable IV/nonce, insufficient key length, or a home-grow

58 reports

Improper Input Validation

This is the catch-all bucket for reports where the specific input-validation failure doesn't map cleanly onto one of the more narrowly named categories. Real-world instances range widely: unrestricted file upload escalating to remote code execution, a missing CAPTCHA or rate limi

57 reports · 9 samples

OS Command Injection

Subset of the Command Injection - Generic bucket focused on direct shell-out paths. Top patterns: unauth Jenkins script-console RCE, Confluence OGNL CVE-2021-26084, CVE-2021-26085, Atlassian/Telerik RCE, and Ruby coreutils-style util-script bugs (rdoc, wait_writable) where filena

55 reports · 6 samples

Classic Buffer Overflow

The canonical native-code memory-safety bug: a fixed-size stack or heap buffer is written past its allocated bound, because the code trusted an input length without validating it against the buffer's actual size, overwriting whatever memory sits adjacent - including, on the stack

52 reports

HTTP Request Smuggling (HRS) / De-sync

HRS reports cluster around parser disagreement between a front-end (CDN/proxy/load-balancer) and a back-end (application server). Variants: classic CL.TE / TE.CL / TE.TE on HTTP/1.1, plus modern HTTP/2 downgrade smuggling, CL.0 desync, pause-based desync, and client-side desync (

52 reports · 10 samples

Buffer Over-read

The read-side counterpart to a buffer overflow: code reads past the end of an allocated buffer instead of writing past it, returning whatever adjacent memory happens to contain rather than corrupting it. The most famous real-world instance is Heartbleed (CVE-2014-0160), where a m

49 reports

Use After Free

Memory is freed, but a pointer to that memory (a "dangling pointer") is used again afterward without being cleared first. If an attacker can control what gets allocated into that now-reusable memory region before the dangling pointer is used, they can corrupt the program's execut

48 reports

Insecure Deserialization

Reports cluster around language-specific deserialization-to-RCE: PHP Phar streams (concrete5 CVE-2021-36766), Ruby Marshal (RubyGems Bundler response), Java SnakeYAML (Kubernetes Java client), .NET Telerik UI BinaryFormatter (CVE-2019-18935), Python pickle in Django cache (CVE-20

47 reports · 9 samples

Improper Authorization (close cousin of IDOR)

Reports here are functionally similar to IDOR but the access-control layer is at a 'role/permission' level rather than 'object-id' level: low-privilege staff can call admin GraphQL operations, OAuth misconfig allows account takeover, 2FA bypass via alternate route, transactions c

45 reports · 9 samples

Heap Overflow

A buffer overflow specifically in heap-allocated (dynamically allocated, as opposed to stack) memory. Because heap allocators keep their own bookkeeping metadata interleaved with allocated blocks, overflowing a heap buffer can corrupt that metadata itself, giving an attacker a pa

43 reports

Insecure Storage of Sensitive Information

Sensitive data, such as credentials, tokens, PII, and financial details, is stored at rest without adequate protection: unencrypted database columns, secrets committed to plaintext configuration files, unencrypted backups, or logs that capture more than they should. This is disti

42 reports

Cleartext Transmission

Mostly curl-CVE family (Proxy-Authorization leak on redirect, Metalink credential leak, HSTS bypass via trailing-dot/IDN, Rocket.Chat OAuth-token-via-API leak). Closely related to Insufficiently Protected Credentials - same module set covers most of it.

36 reports · 9 samples

CRLF Injection / HTTP Header Injection

Reports cluster around: (1) classic HTTP response splitting via newline in user input that ends up in a Set-Cookie / Location header; (2) SMTP command injection via newlines in app-config fields (Grafana SMTP password, Nextcloud Calendar appointment description) leading to RCE th

36 reports · 7 samples

Improper Certificate Validation

Most disclosed reports in this category are bugs in specific libraries or desktop clients rather than in a web application's own code: curl's OCSP handling, Acronis True Image, Node's TLS stack accepting an unset `rejectUnauthorized` option, OpenSSL's certificate verification int

35 reports · 10 samples

Insufficient Session Expiration

Reports cluster around: (1) session not invalidated after password change (most common); (2) old logged-out cookies still work; (3) email-change tokens not expired when new ones issued; (4) mobile app token not revoked on logout; (5) external-login disconnect doesn't invalidate s

33 reports · 10 samples

Phishing

Reports in this bucket describe exploiting user trust and brand recognition rather than a software defect - a subdomain or misconfigured DNS record that could host convincing phishing content under the target's own domain, an observed phishing campaign impersonating the target's

31 reports

Insufficiently Protected Credentials

Reports cluster around: (1) curl/libcurl bugs that leak Authorization / Cookie / Proxy-Authorization / FTP-USER credentials when following redirects across hosts/protocols (CVE-2018-1000007, CVE-2021-22923, CVE-2022-27774, CVE-2022-27776); (2) staging/test app accepting default c

30 reports · 7 samples

Directory Listing Exposure

Apache / Nginx directory-listing enabled on public directory. Detection: probe common upload/backup directories and check for HTML response containing 'Index of /'.

29 reports

Out-of-bounds Read

Code reads memory outside the bounds of an allocated buffer or array - the general form of the pattern that Buffer Over-read and Heartbleed-style bugs are specific instances of. The read itself doesn't corrupt anything, but whatever adjacent memory content comes back can leak sen

28 reports