nOtWASP bottom 10: vulnerabilities that make you cry
Summary: PortSwigger Research published a satirical 'nOtWASP Bottom 10' list on 1 April 2021 cataloguing vulnerability reports that 'simply don't make sense,' including session timeouts, 'Server: Apache' banners, CSV injection, and dead XSS vectors like document.write(location.pathname). The researchers note that Burp Scanner deliberately reports behavior that might be dangerous to avoid false negatives, trusting its skilled users to judge.
Bottom line: The team describes triaging thousands of version-based vulnerability reports to find the roughly 1% that are actually exploitable, and notes one HackerOne report to a government program generated 23 messages over a month before a fix was deployed with 10 people involved.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026