> ## Documentation Index > Fetch the complete documentation index at: https://docs.vidocsecurity.com/llms.txt > Use this file to discover all available pages before exploring further. # Attack Vulnerabilities > Security vulnerabilities that can be directly exploited Attack vulnerabilities are code patterns that allow malicious actors to perform unauthorized actions. These represent direct security threats. ## Injection Attacks ### SQL Injection (sqli) **Severity:** Critical User input incorporated into SQL queries without proper sanitization. ```javascript theme={null} // Vulnerable const query = `SELECT * FROM users WHERE id = ${userId}`; // Fixed const query = `SELECT * FROM users WHERE id = ?`; db.query(query, [userId]); ``` **Impact:** Database theft, modification, or deletion. *** ### NoSQL Injection (nosql-injection) **Severity:** Critical User input in NoSQL database queries. ```javascript theme={null} // Vulnerable db.users.find({ user: req.body.user, pass: req.body.pass }); // Fixed - validate input types const user = String(req.body.user); const pass = String(req.body.pass); ``` **Impact:** Authentication bypass, data theft. *** ### Command Injection (command-injection) **Severity:** Critical User input passed to system commands. ```javascript theme={null} // Vulnerable exec(`ping ${userInput}`); // Fixed - use parameterized APIs execFile('ping', ['-c', '4', userInput]); ``` **Impact:** Full system compromise. *** ### Code Evaluation (code-evaluation) **Severity:** Critical Dynamic code execution with user input. ```javascript theme={null} // Vulnerable eval(userInput); new Function(userInput)(); // Fixed - avoid eval entirely JSON.parse(userInput); // for JSON data ``` **Impact:** Arbitrary code execution. *** ### Server-Side Template Injection (ssti) **Severity:** Critical User input in server-side templates. ```python theme={null} # Vulnerable template.render("Hello " + user_input) # Fixed template.render("Hello {{ name }}", name=user_input) ``` **Impact:** Remote code execution. ## Cross-Site Scripting (XSS) **Severity:** High User input rendered in HTML without proper encoding. ```javascript theme={null} // Vulnerable element.innerHTML = userInput; // Fixed element.textContent = userInput; // Or use proper sanitization element.innerHTML = DOMPurify.sanitize(userInput); ``` **Impact:** Session hijacking, phishing, malware distribution. ## Request Forgery ### Server-Side Request Forgery (ssrf) **Severity:** High Server makes requests to URLs controlled by user input. ```javascript theme={null} // Vulnerable fetch(userProvidedUrl); // Fixed - validate against allowlist const allowed = ['api.example.com']; const url = new URL(userProvidedUrl); if (!allowed.includes(url.hostname)) throw new Error('Invalid URL'); ``` **Impact:** Internal network access, cloud metadata exposure. *** ### Cross-Site Request Forgery (csrf) **Severity:** Medium State-changing requests without CSRF protection. ```javascript theme={null} // Vulnerable - no CSRF token app.post('/transfer', (req, res) => { /* ... */ }); // Fixed - verify CSRF token app.post('/transfer', csrfProtection, (req, res) => { /* ... */ }); ``` **Impact:** Unauthorized actions on behalf of users. ## Access Control ### Insecure Direct Object Reference (idor) **Severity:** High Access to resources without proper authorization checks. ```javascript theme={null} // Vulnerable app.get('/document/:id', (req, res) => { return db.documents.findById(req.params.id); }); // Fixed app.get('/document/:id', (req, res) => { const doc = db.documents.findById(req.params.id); if (doc.userId !== req.user.id) return res.status(403); return doc; }); ``` **Impact:** Unauthorized data access. *** ### Broken Access Control (broken-access-control) **Severity:** High Missing or improper access control checks. **Impact:** Privilege escalation, unauthorized actions. *** ### Broken Authentication (broken-authentication) **Severity:** High Flawed authentication implementation. **Impact:** Account takeover, unauthorized access. ## File System ### Path Traversal (path-traversal) **Severity:** High User input in file paths allowing access outside intended directory. ```javascript theme={null} // Vulnerable const file = path.join('/uploads', userInput); // Fixed const file = path.join('/uploads', path.basename(userInput)); ``` **Impact:** Arbitrary file read/write. *** ### Unrestricted File Upload (unrestricted-file-upload) **Severity:** High File uploads without proper validation. **Impact:** Remote code execution, malware hosting. ## Other Attack Vectors ### Remote Code Execution (rce) **Severity:** Critical Any method allowing arbitrary code execution. **Impact:** Full system compromise. *** ### XML External Entity (xxe) **Severity:** High XML parsing with external entity processing enabled. ```javascript theme={null} // Vulnerable xmlParser.parse(userXml); // Fixed - disable external entities xmlParser.parse(userXml, { noent: false, dtdload: false }); ``` **Impact:** File disclosure, SSRF, denial of service. *** ### Open Redirect (open-redirect) **Severity:** Medium Redirects to URLs controlled by user input. ```javascript theme={null} // Vulnerable res.redirect(req.query.next); // Fixed const allowedHosts = ['example.com']; const url = new URL(req.query.next, 'https://example.com'); if (!allowedHosts.includes(url.hostname)) throw new Error('Invalid redirect'); ``` **Impact:** Phishing, credential theft. *** ### Prototype Pollution (prototype-pollution) **Severity:** High Modification of JavaScript object prototypes via user input. **Impact:** Denial of service, potential RCE. *** ### Insecure Deserialization (insecure-deserialization) **Severity:** Critical Deserializing untrusted data without validation. **Impact:** Remote code execution. *** ### Header Injection (header-injection) **Severity:** Medium User input in HTTP headers. **Impact:** Response splitting, cache poisoning. *** ### Log Injection (log-injection) **Severity:** Low User input in log messages without sanitization. **Impact:** Log forging, log analysis bypass. *** ### Session Fixation (session-fixation) **Severity:** Medium Session ID can be set by attacker. **Impact:** Session hijacking. *** ### Race Condition (race-condition) **Severity:** Medium Time-of-check to time-of-use vulnerabilities. **Impact:** Security bypass, data corruption. *** ### Denial of Service (dos) **Severity:** Medium Code patterns that can cause service unavailability. **Impact:** Service disruption. *** ### Regex Injection (regex-injection) **Severity:** Medium User input in regular expressions (ReDoS risk). **Impact:** Denial of service. *** ### PostMessage Misuse (postmessage-misuse) **Severity:** Medium Improper handling of cross-origin messages. **Impact:** Cross-origin attacks. ## Related Pages Security weaknesses All security categories View your findings Detection explained