Top 10 web hacking techniques of 2025
Summary: PortSwigger Research published its 19th annual Top 10 Web Hacking Techniques of 2025, drawn from 63 community nominations reviewed by a panel including Nicolas Grégoire, Soroush Dalili, STÖK, Fabian (LiveOverflow) and James Kettle. The top spot went to Vladislav Korchagin's Successful Errors on error-based code injection and blind SSTI, followed by Alex Brown's ORM Leaking More Than You Joined at #2, with entries also covering HTTP/2 CONNECT, XS-Leaks, Next.js cache poisoning, SOAPwn and Unicode normalization attacks.
Key Takeaway: The list's own framing is that 2025 saw side-channels become a core exploitation primitive, and the winning entry turns old SQL injection error-based tricks into a toolkit for blind server-side template injection - a class that does not need a database to be dangerous.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026