ScanRub Security Research

Unknown Weakness

Fri, 21 Aug 2026 06:31:53 GMT

This is HackerOne's own miscellaneous bucket - reports that the platform's automated classifier couldn't confidently map to any specific weakness type, either because the write-up described a novel or hybrid issue, covered multiple distinct bugs in one report, or was too sparse f

Information Disclosure

Fri, 21 Aug 2026 06:31:53 GMT

The largest bucket in the corpus, spanning very different sub-classes: (1) outdated-software CVE markers (Jira CVE-2020-14179, ColdFusion, Confluence, GitLab) - already covered by Nuclei; (2) public source / config leaks (.env, .git/config, phpinfo, /debug, dump.sql, backup.tar,

Broken Access Control

Fri, 21 Aug 2026 06:31:53 GMT

Massive bucket spanning unauthenticated-to-internal-resource leaks, role-bypass within multi-tenant apps, and admin-panel exposure. Top patterns: (1) `..;/` and other traversal/normalization tricks bypassing front-door auth (Tomcat scripts, JBoss, WebLogic, IIS); (2) header-based

Reflected Cross-Site Scripting

Fri, 21 Aug 2026 06:31:53 GMT

Reflected XSS lets an attacker inject a script through a request parameter that's echoed back unescaped, running in the victim's browser via a crafted link. Reflected XSS reports cluster around four reflection contexts: (1) HTML body - payload reflected raw inside /

Stored Cross-Site Scripting

Fri, 21 Aug 2026 06:31:53 GMT

Stored XSS reports follow predictable shapes: (1) profile fields - name, bio, company, signature reflected on viewing pages; (2) message bodies - chat, comment, review, support ticket; (3) file-upload-to-XSS - uploading SVG, HTML, PDF, or via Content-Type confusion (text/html wit

DoS / Resource Exhaustion

Fri, 21 Aug 2026 06:31:53 GMT

Reports cluster around: (1) ReDoS - vulnerable regex in input-validation paths (Rails Money type, Fastify, every-language ecosystem); (2) HTTP/2 'unknownProtocol' leak (Node CVE-2021-22883); (3) CPU/memory exhaustion via large file upload, deeply-nested JSON, ZIP/gzip bomb, parse

Business Logic Errors

Fri, 21 Aug 2026 06:31:53 GMT

A business-logic flaw abuses the legitimate, intended workflow of an application in a way its designers didn't anticipate, without tripping any technical security control - no injection, no broken access control in the conventional sense, just the rules of the workflow itself bei

Broken Authentication

Fri, 21 Aug 2026 06:31:53 GMT

This bucket sweeps a wide range of auth bypasses, missing-auth endpoints, and unverified-account abuses. Top patterns: (1) admin/dashboard panels reachable without auth (Grafana, Prometheus, Kibana, Jenkins, Adminer, Spring Boot Actuator, Cisco ASA web interface) - 'no auth' rath

Violation of Secure Design Principles

Fri, 21 Aug 2026 06:31:53 GMT

This is CWE-657's umbrella category: the system's security failed not because of an implementation bug in otherwise-sound architecture, but because a foundational design decision itself was insecure - trusting client-side validation as the sole check, relying on an unguessable UR

Insecure Direct Object Reference

Fri, 21 Aug 2026 06:31:53 GMT

Classic IDOR pattern: server uses a user-supplied identifier without checking that the requesting user is authorized for that resource. Variants: (1) numeric/sequential IDs (?uid=N, /reports/N) where authorization isn't enforced; (2) UUID/GUID feels like opaque but is exposed els

Privilege Escalation

Fri, 21 Aug 2026 06:31:53 GMT

An attacker gains access to functionality or data reserved for a higher privilege tier than their own account holds - a regular user reaching an admin-only action, or a support-role account reaching a super-admin capability. Confirming this class requires two things a fully unaut

Cross-Site Request Forgery

Fri, 21 Aug 2026 06:31:53 GMT

CSRF reports in this corpus cluster around four root causes: (1) missing or unvalidated anti-CSRF tokens on state-changing endpoints, (2) state-changing actions exposed via GET, (3) cookies without SameSite=Lax/Strict so cross-origin POSTs carry session, and (4) custom CSRF token

Code Injection

Fri, 21 Aug 2026 06:31:53 GMT

Wider than just OS Command Injection - covers language-level eval / dynamic-dispatch sinks (PHP `previewBlock` -> eval, Ruby `OptionParser.load`, Python yaml.load, server-side template engines), framework RCE CVEs (Apache Struts2 S2-045, Primefaces CVE-2017-1000486, Drupal CVE-20

Path Traversal

Fri, 21 Aug 2026 06:31:53 GMT

Path traversal lets an attacker read, and sometimes write, files outside a web app's intended directory via `../` sequences in a file-path parameter. Canonical Path Traversal category. Reports cluster around: (1) classic ../ traversal in URL parameters used as file paths; (2) Apa

Server-Side Request Forgery

Fri, 21 Aug 2026 06:31:53 GMT

Server-side request forgery lets an attacker make a server issue requests to arbitrary URLs, exposing internal services, cloud metadata, and local files. SSRF reports in this corpus consistently exploit features that fetch a user-controlled URL: webhook configuration, link previe

Memory Corruption - Generic

Fri, 21 Aug 2026 06:31:53 GMT

This is the umbrella CWE bucket for native-code memory-safety bugs - out-of-bounds reads/writes, use-after-free, double-free, and related classes - grouped here because the disclosed report either spanned more than one specific pattern or didn't specify precisely enough to sort i

Cross-Site Scripting (Generic)

Fri, 21 Aug 2026 06:31:53 GMT

This bucket holds XSS reports that triagers didn't categorize as reflected, stored, or DOM-based. The patterns are a superset of those specific subcategories: any input field, header, cookie, or referenced URL that lands in the DOM unsanitized. Most reports filed under this gener

Open Redirect

Fri, 21 Aug 2026 06:31:53 GMT

Open-redirect reports cluster around naive redirect parameter handling: server takes user-controlled `?url=`, `?return_to=`, `?redirect=`, `?next=`, `?goto=`, `?dest=`, `?continue=` and Locations to it without scheme/host validation. Bypass tricks: protocol-relative `//evil.com`,

SQL Injection

Fri, 21 Aug 2026 06:31:53 GMT

Classic SQLi reports clustered around: (1) URL/POST parameter injection into legacy ASP/PHP pages - `?id=1' OR '1'='1`; (2) time-based blind via `WAITFOR DELAY` (MSSQL), `SLEEP()` (MySQL), `pg_sleep()` (PostgreSQL); (3) Header-based SQLi via Referer, User-Agent, X-Forwarded-For w

OS Command Injection (and adjacent code-execution chains)

Fri, 21 Aug 2026 06:31:53 GMT

This H1 bucket is wider than its name - alongside classic OS command injection (shell metacharacters in user input passed to popen/spawn/system/exec) it contains: (1) language-level eval/dynamic-dispatch sinks (PHP `$action()` from POST, Ruby OptionParser.load reading `|cmd`, Net

DOM-Based Cross-Site Scripting

Fri, 21 Aug 2026 06:31:53 GMT

DOM XSS reports cluster around dangerous-sink usage in client-side JavaScript: (1) `document.location` / `location.search` / `location.hash` parsed and concatenated into innerHTML / document.write / eval; (2) `postMessage` handlers using `event.data` without origin check writing

Improper Restriction of Authentication Attempts

Fri, 21 Aug 2026 06:31:53 GMT

This is the missing-rate-limit class: a login, registration, password-reset, or OTP-verification endpoint accepts an unlimited number of attempts from the same client with no throttling, lockout, or CAPTCHA challenge kicking in. On its own it enables credential-stuffing and passw

Misconfiguration

Fri, 21 Aug 2026 06:31:53 GMT

Catch-all bucket: CORS bypass, Spring Boot Actuator exposed, GraphQL introspection on, weak password policy with default creds, stale DNS pointing to takeover-able CDN, missing CAA records, social-link hijack on team pages, error-page text injection. Covered by existing/proposed

UI Redressing (Clickjacking)

Fri, 21 Aug 2026 06:31:53 GMT

Clickjacking loads a sensitive page (account settings, a "delete" or "authorize" button, an OAuth consent screen) inside a transparent or disguised iframe on an attacker's page, so a click the victim believes is landing on the attacker's own UI actually lands on the hidden page u

Privacy Violation

Fri, 21 Aug 2026 06:31:53 GMT

This category covers mishandling of personal data in ways that breach user privacy expectations or regulatory obligations (GDPR, CCPA, and similar) rather than a technical access-control failure - collecting more data than disclosed in a privacy policy, sharing data with third pa

Cleartext Storage / Secrets Leakage

Fri, 21 Aug 2026 06:31:53 GMT

Reports center on secrets stored or accessible in cleartext: API keys in JS bundles, GitHub commits, source-mapped sources, public config endpoints (/config), license-key text files served from CDN, Elasticsearch indices storing Authorization headers, Kubernetes Secrets created f

Cryptographic Issues - Generic

Fri, 21 Aug 2026 06:31:53 GMT

This is the umbrella bucket for cryptographic implementation mistakes that don't fit one of the narrower named categories below - using a correct algorithm with a subtly wrong mode (ECB instead of CBC/GCM), a static or predictable IV/nonce, insufficient key length, or a home-grow

Improper Input Validation

Fri, 21 Aug 2026 06:31:53 GMT

This is the catch-all bucket for reports where the specific input-validation failure doesn't map cleanly onto one of the more narrowly named categories. Real-world instances range widely: unrestricted file upload escalating to remote code execution, a missing CAPTCHA or rate limi

OS Command Injection

Fri, 21 Aug 2026 06:31:53 GMT

Subset of the Command Injection - Generic bucket focused on direct shell-out paths. Top patterns: unauth Jenkins script-console RCE, Confluence OGNL CVE-2021-26084, CVE-2021-26085, Atlassian/Telerik RCE, and Ruby coreutils-style util-script bugs (rdoc, wait_writable) where filena

Classic Buffer Overflow

Fri, 21 Aug 2026 06:31:53 GMT

The canonical native-code memory-safety bug: a fixed-size stack or heap buffer is written past its allocated bound, because the code trusted an input length without validating it against the buffer's actual size, overwriting whatever memory sits adjacent - including, on the stack

HTTP Request Smuggling (HRS) / De-sync

Fri, 21 Aug 2026 06:31:53 GMT

HRS reports cluster around parser disagreement between a front-end (CDN/proxy/load-balancer) and a back-end (application server). Variants: classic CL.TE / TE.CL / TE.TE on HTTP/1.1, plus modern HTTP/2 downgrade smuggling, CL.0 desync, pause-based desync, and client-side desync (

Buffer Over-read

Fri, 21 Aug 2026 06:31:53 GMT

The read-side counterpart to a buffer overflow: code reads past the end of an allocated buffer instead of writing past it, returning whatever adjacent memory happens to contain rather than corrupting it. The most famous real-world instance is Heartbleed (CVE-2014-0160), where a m

Use After Free

Fri, 21 Aug 2026 06:31:53 GMT

Memory is freed, but a pointer to that memory (a "dangling pointer") is used again afterward without being cleared first. If an attacker can control what gets allocated into that now-reusable memory region before the dangling pointer is used, they can corrupt the program's execut

Insecure Deserialization

Fri, 21 Aug 2026 06:31:53 GMT

Reports cluster around language-specific deserialization-to-RCE: PHP Phar streams (concrete5 CVE-2021-36766), Ruby Marshal (RubyGems Bundler response), Java SnakeYAML (Kubernetes Java client), .NET Telerik UI BinaryFormatter (CVE-2019-18935), Python pickle in Django cache (CVE-20

Improper Authorization (close cousin of IDOR)

Fri, 21 Aug 2026 06:31:53 GMT

Reports here are functionally similar to IDOR but the access-control layer is at a 'role/permission' level rather than 'object-id' level: low-privilege staff can call admin GraphQL operations, OAuth misconfig allows account takeover, 2FA bypass via alternate route, transactions c

Heap Overflow

Fri, 21 Aug 2026 06:31:53 GMT

A buffer overflow specifically in heap-allocated (dynamically allocated, as opposed to stack) memory. Because heap allocators keep their own bookkeeping metadata interleaved with allocated blocks, overflowing a heap buffer can corrupt that metadata itself, giving an attacker a pa

Insecure Storage of Sensitive Information

Fri, 21 Aug 2026 06:31:53 GMT

Sensitive data, such as credentials, tokens, PII, and financial details, is stored at rest without adequate protection: unencrypted database columns, secrets committed to plaintext configuration files, unencrypted backups, or logs that capture more than they should. This is disti

Cleartext Transmission

Fri, 21 Aug 2026 06:31:53 GMT

Mostly curl-CVE family (Proxy-Authorization leak on redirect, Metalink credential leak, HSTS bypass via trailing-dot/IDN, Rocket.Chat OAuth-token-via-API leak). Closely related to Insufficiently Protected Credentials - same module set covers most of it.

CRLF Injection / HTTP Header Injection

Fri, 21 Aug 2026 06:31:53 GMT

Reports cluster around: (1) classic HTTP response splitting via newline in user input that ends up in a Set-Cookie / Location header; (2) SMTP command injection via newlines in app-config fields (Grafana SMTP password, Nextcloud Calendar appointment description) leading to RCE th

Improper Certificate Validation

Fri, 21 Aug 2026 06:31:53 GMT

Most disclosed reports in this category are bugs in specific libraries or desktop clients rather than in a web application's own code: curl's OCSP handling, Acronis True Image, Node's TLS stack accepting an unset `rejectUnauthorized` option, OpenSSL's certificate verification int

Insufficient Session Expiration

Fri, 21 Aug 2026 06:31:53 GMT

Reports cluster around: (1) session not invalidated after password change (most common); (2) old logged-out cookies still work; (3) email-change tokens not expired when new ones issued; (4) mobile app token not revoked on logout; (5) external-login disconnect doesn't invalidate s

Phishing

Fri, 21 Aug 2026 06:31:53 GMT

Reports in this bucket describe exploiting user trust and brand recognition rather than a software defect - a subdomain or misconfigured DNS record that could host convincing phishing content under the target's own domain, an observed phishing campaign impersonating the target's

Insufficiently Protected Credentials

Fri, 21 Aug 2026 06:31:53 GMT

Reports cluster around: (1) curl/libcurl bugs that leak Authorization / Cookie / Proxy-Authorization / FTP-USER credentials when following redirects across hosts/protocols (CVE-2018-1000007, CVE-2021-22923, CVE-2022-27774, CVE-2022-27776); (2) staging/test app accepting default c

Directory Listing Exposure

Fri, 21 Aug 2026 06:31:53 GMT

Apache / Nginx directory-listing enabled on public directory. Detection: probe common upload/backup directories and check for HTML response containing 'Index of /'.

Out-of-bounds Read

Fri, 21 Aug 2026 06:31:53 GMT

Code reads memory outside the bounds of an allocated buffer or array - the general form of the pattern that Buffer Over-read and Heartbleed-style bugs are specific instances of. The read itself doesn't corrupt anything, but whatever adjacent memory content comes back can leak sen

Resource Injection

Fri, 21 Aug 2026 06:31:53 GMT

Catch-all bucket: (1) URI scheme injection via desktop client URL handlers (Nextcloud Desktop CVE-2021-22879); (2) object-injection-to-SQLi (Stripe-billing-typographic); (3) cloud-resource tag-based replacement (AWS Load Balancer Controller); (4) Ruby rdoc symlink-attack file inj

Information Disclosure (Error Message)

Fri, 21 Aug 2026 06:31:53 GMT

This is the error-triggered instance of information disclosure: sending malformed, oversized, or otherwise unexpected input causes the application to fail in a way that reveals more than a generic error should. A "Whitelabel Error Page" or default 500 response is meant to hide im

Man-in-the-Middle

Fri, 21 Aug 2026 06:31:53 GMT

An attacker positioned on the network path between a client and server - a malicious Wi-Fi access point, a compromised router, ARP/DNS spoofing on a local network - intercepts, reads, or modifies traffic that should have been protected end-to-end. Reports in this category typical

Resource Allocation Without Limits

Fri, 21 Aug 2026 06:31:53 GMT

This is CWE-770, closely related to the broader uncontrolled-resource-consumption category but narrower in a useful way: it's specifically about an *allocation* step, memory, file handles, threads, database connections, or storage, that happens with no upper bound tied to it. A s

Authentication Bypass via Alternate Path

Fri, 21 Aug 2026 06:31:53 GMT

This is CWE-288: a resource is properly protected along its primary access path, but the same underlying data or action is also reachable through a second path that never got the same authentication check applied. The primary web login flow might correctly enforce authentication,