Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger describes DOM-based local file path manipulation as a vulnerability that arises when a client-side script reads controllable data from the DOM, such as the URL, and passes it as the filename parameter to a file handling API. An attacker can...
PortSwigger describes stored DOM-based WebSocket URL poisoning, where user input is stored and later embedded into the DOM, and a client-side script uses that controllable data as the target URL of a WebSocket connection. An attacker can construct a URL...
PortSwigger describes reflected DOM-based WebSocket URL poisoning, where a script uses controllable data as the target URL of a WebSocket connection, letting an attacker construct a URL that makes another user's browser open a WebSocket to a server the...
PortSwigger describes DOM-based WebSocket URL poisoning, where a client-side script reads controllable data such as the URL and uses it as the target of a WebSocket connection. An attacker can construct a URL that, when visited by another user, makes that...
PortSwigger Research describes client-side SQL injection as a stored DOM-based vulnerability where a script incorporates controllable data into a client-side SQL query in an unsafe way, letting an attacker construct a URL that executes an arbitrary SQL...
PortSwigger describes reflected DOM-based client-side SQL injection, where data copied from a request is echoed into the immediate response in a part of the DOM that a client-side script then processes unsafely, letting an attacker control a JavaScript...
Client-side SQL injection is a DOM-based vulnerability that arises when a script incorporates controllable data, such as data from the URL, into a client-side SQL query in an unsafe way. An attacker may construct a URL that, when visited by another user,...
PortSwigger Research describes path-relative style sheet import vulnerabilities, which arise under specific conditions and let an attacker construct a URL that causes the victim's browser to import a different URL as CSS, containing text the attacker can...
Stored DOM-based JavaScript injection occurs when user input is stored and later embedded into a response within a part of the DOM that a client-side script processes unsafely, letting an attacker control data such as a JavaScript string that the script...
Reflected DOM-based JavaScript injection occurs when data from a request is echoed into the immediate response inside a part of the DOM that a client-side script then processes unsafely, letting an attacker control a JavaScript string or similar value. An...
DOM-based JavaScript injection occurs when a client-side script reads data from a controllable part of the DOM, such as the URL, and executes that data as JavaScript. An attacker can craft a URL that, when visited by another user, runs attacker-supplied...
PortSwigger Research describes client-side prototype pollution as any user-controlled JSON property, query string, or hash parameter that gets converted to a JavaScript object and merged with another object, letting an attacker use keys like __proto__ to...
Stored DOM-based cross-site scripting occurs when user input is stored and later embedded in a response inside a part of the DOM that a client-side script processes unsafely, letting an attacker control data such as a JavaScript string that triggers the...
Reflected DOM-based vulnerabilities occur when data from a request is echoed into the application's immediate response inside a part of the DOM that a client-side script then processes unsafely. PortSwigger notes that an attacker can use this reflection to...
DOM-based cross-site scripting occurs when a client-side script reads data from a controllable part of the DOM, such as the URL, and writes it into the HTML document in an unsafe way. An attacker can then construct a URL that, when visited by another user,...
Client-side template injection occurs when applications using a client-side template framework dynamically embed user input in web pages, and the framework scans the rendered page for template expressions and executes any it finds. An attacker exploits...
Reflected cross-site scripting occurs when data from a request is copied and echoed into the application's immediate response without safe handling, letting an attacker construct a request that executes their JavaScript in another user's browser within...
HTTP response header injection vulnerabilities arise when user-supplied data is copied into a response header in an unsafe way, letting an attacker who can inject newline characters add new HTTP headers or, by injecting an empty line, break out of the...
PortSwigger Research describes web cache poisoning, which arises when an application behind a cache processes input that is not part of the cache key, so two requests the cache treats as equivalent can produce different responses. An attacker sends crafted...
Client-side desync vulnerabilities occur when a web server fails to correctly process the Content-Length of POST requests, letting an attacker force a victim's browser to desynchronize its connection with the website, typically leading to XSS. PortSwigger...
HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers that parse HTTP inconsistently, letting an attacker supply a request that different servers read as having different lengths. The attacker can then poison...
Stored cross-site scripting occurs when user input is saved and later embedded into application responses without safe handling, letting an attacker inject JavaScript that runs in the browser of anyone who views that content. PortSwigger notes the injected...
PortSwigger Research reports that React Server Components and Next.js carry critical remote code execution vulnerabilities tracked as CVE-2025-55182 (React) and CVE-2025-66478 (Next.js), with a CVSS score of 10.0. The flaw allows unauthenticated attackers...
Server-Side Include (SSI) injection vulnerabilities arise when an application incorporates user-controllable data into a response that is then parsed for SSI directives, and without strict validation an attacker can modify or inject directives. PortSwigger...
Server-side template injection occurs when user input is unsafely embedded into a server-side template, letting an attacker inject template directives that may execute arbitrary code and take full control of the web server. PortSwigger notes that...
PortSwigger Research describes server-side code injection, which arises when an application incorporates user-controllable data into a string that is dynamically evaluated by a code interpreter. If that data is not strictly validated, an attacker can use...
PortSwigger describes server-side code injection as arising when an application places user-controllable data into a string that a code interpreter evaluates dynamically, letting an attacker who supplies unvalidated input modify and inject arbitrary code...
PortSwigger describes server-side code injection as occurring when an application incorporates user-controllable data into a string that is dynamically evaluated by a code interpreter, letting crafted input modify the code that executes on the server. The...
PortSwigger Research describes server-side code injection, which arises when an application incorporates user-controllable data into a string that is dynamically evaluated by a code interpreter. If that data is not strictly validated, an attacker can craft...
PortSwigger describes server-side code injection as arising when an application incorporates user-controllable data into a string that is dynamically evaluated by a code interpreter, allowing crafted input to modify and inject arbitrary code when that data...