{
  "generated": "2026-11-02T05:08:25.954Z",
  "vulnerabilities": [
    {
      "slug": "broken-access-control",
      "url": "https://www.breachvanelabs.com/library/broken-access-control/",
      "title": "Broken access control & IDOR",
      "short": "IDOR",
      "aliases": [
        "Insecure direct object reference",
        "Broken object level authorization (BOLA)",
        "Missing function level access control"
      ],
      "summary": "The application checks who you are but not whether you're allowed to touch a specific record or function, so changing an ID or calling an endpoint directly exposes other users' data or admin actions.",
      "cwe": [
        "CWE-639",
        "CWE-285"
      ],
      "owasp": "A01:2021 Broken Access Control",
      "typical_severity": {
        "min": "medium",
        "max": "critical"
      },
      "updated": "2026-10-14",
      "references": [
        {
          "title": "CWE-639: Authorization Bypass Through User-Controlled Key",
          "url": "https://cwe.mitre.org/data/definitions/639.html"
        },
        {
          "title": "CWE-285: Improper Authorization",
          "url": "https://cwe.mitre.org/data/definitions/285.html"
        },
        {
          "title": "OWASP Top 10 A01:2021 Broken Access Control",
          "url": "https://owasp.org/Top10/A01_2021-Broken_Access_Control/"
        },
        {
          "title": "OWASP API Security Top 10 API1:2023 Broken Object Level Authorization",
          "url": "https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/"
        },
        {
          "title": "OWASP Authorization Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Insecure Direct Object Reference Prevention Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/broken-access-control/#overview",
        "https://www.breachvanelabs.com/library/broken-access-control/#impact",
        "https://www.breachvanelabs.com/library/broken-access-control/#examples",
        "https://www.breachvanelabs.com/library/broken-access-control/#remediation",
        "https://www.breachvanelabs.com/library/broken-access-control/#testing",
        "https://www.breachvanelabs.com/library/broken-access-control/#references"
      ]
    },
    {
      "slug": "clickjacking",
      "url": "https://www.breachvanelabs.com/library/clickjacking/",
      "title": "Clickjacking",
      "short": "Clickjacking",
      "aliases": [
        "UI redressing",
        "User interface redress attack",
        "Frame overlay attack"
      ],
      "summary": "Clickjacking places a trusted page inside a deceptive frame so the user clicks or types into controls they cannot clearly see. It can turn an ordinary authenticated action into an unintended change.",
      "cwe": [
        "CWE-1021"
      ],
      "owasp": "A04:2021 Insecure Design",
      "typical_severity": {
        "min": "low",
        "max": "high"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-1021: Improper Restriction of Rendered UI Layers or Frames",
          "url": "https://cwe.mitre.org/data/definitions/1021.html"
        },
        {
          "title": "OWASP Clickjacking Defense Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Top 10 A04:2021 Insecure Design",
          "url": "https://owasp.org/Top10/A04_2021-Insecure_Design/"
        },
        {
          "title": "PortSwigger Web Security Academy: Clickjacking",
          "url": "https://portswigger.net/web-security/clickjacking"
        },
        {
          "title": "MDN: CSP frame-ancestors",
          "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/clickjacking/#overview",
        "https://www.breachvanelabs.com/library/clickjacking/#impact",
        "https://www.breachvanelabs.com/library/clickjacking/#examples",
        "https://www.breachvanelabs.com/library/clickjacking/#remediation",
        "https://www.breachvanelabs.com/library/clickjacking/#testing",
        "https://www.breachvanelabs.com/library/clickjacking/#references"
      ]
    },
    {
      "slug": "cross-site-request-forgery",
      "url": "https://www.breachvanelabs.com/library/cross-site-request-forgery/",
      "title": "Cross-site request forgery (CSRF)",
      "short": "CSRF",
      "aliases": [
        "Session riding",
        "One-click attack",
        "Cross-site request forgery"
      ],
      "summary": "CSRF tricks a signed-in user's browser into submitting an unwanted request with that user's cookies. It can change account settings, initiate transactions, or perform administrative actions without the user's informed approval.",
      "cwe": [
        "CWE-352"
      ],
      "owasp": "A01:2021 Broken Access Control",
      "typical_severity": {
        "min": "medium",
        "max": "high"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-352: Cross-Site Request Forgery",
          "url": "https://cwe.mitre.org/data/definitions/352.html"
        },
        {
          "title": "OWASP Cross-Site Request Forgery Prevention Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Top 10 A01:2021 Broken Access Control",
          "url": "https://owasp.org/Top10/A01_2021-Broken_Access_Control/"
        },
        {
          "title": "PortSwigger Web Security Academy: CSRF",
          "url": "https://portswigger.net/web-security/csrf"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/cross-site-request-forgery/#overview",
        "https://www.breachvanelabs.com/library/cross-site-request-forgery/#impact",
        "https://www.breachvanelabs.com/library/cross-site-request-forgery/#examples",
        "https://www.breachvanelabs.com/library/cross-site-request-forgery/#remediation",
        "https://www.breachvanelabs.com/library/cross-site-request-forgery/#testing",
        "https://www.breachvanelabs.com/library/cross-site-request-forgery/#references"
      ]
    },
    {
      "slug": "cross-site-scripting",
      "url": "https://www.breachvanelabs.com/library/cross-site-scripting/",
      "title": "Cross-site scripting (XSS)",
      "short": "XSS",
      "aliases": [
        "Reflected XSS",
        "Stored XSS",
        "DOM-based XSS"
      ],
      "summary": "Untrusted data is written into a web page without the right encoding, so an attacker's script runs in another user's browser with that user's session and permissions.",
      "cwe": [
        "CWE-79"
      ],
      "owasp": "A03:2021 Injection",
      "typical_severity": {
        "min": "medium",
        "max": "high"
      },
      "updated": "2026-10-14",
      "references": [
        {
          "title": "CWE-79: Improper Neutralization of Input During Web Page Generation",
          "url": "https://cwe.mitre.org/data/definitions/79.html"
        },
        {
          "title": "OWASP Cross Site Scripting Prevention Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html"
        },
        {
          "title": "OWASP DOM based XSS Prevention Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Web Security Testing Guide: Testing for Cross Site Scripting",
          "url": "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/01-Testing_for_Reflected_Cross_Site_Scripting"
        },
        {
          "title": "MDN: Content Security Policy (CSP)",
          "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"
        },
        {
          "title": "MITRE ATT&CK T1189: Drive-by Compromise",
          "url": "https://attack.mitre.org/techniques/T1189/"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/cross-site-scripting/#overview",
        "https://www.breachvanelabs.com/library/cross-site-scripting/#impact",
        "https://www.breachvanelabs.com/library/cross-site-scripting/#examples",
        "https://www.breachvanelabs.com/library/cross-site-scripting/#remediation",
        "https://www.breachvanelabs.com/library/cross-site-scripting/#testing",
        "https://www.breachvanelabs.com/library/cross-site-scripting/#references"
      ]
    },
    {
      "slug": "file-upload-flaws",
      "url": "https://www.breachvanelabs.com/library/file-upload-flaws/",
      "title": "File upload flaws",
      "short": "File upload",
      "aliases": [
        "Unrestricted file upload",
        "Unsafe file upload",
        "Malicious file upload"
      ],
      "summary": "File upload flaws let users store files with unsafe content, names, locations, or permissions. Consequences range from stored script execution and malware distribution to server-side code execution.",
      "cwe": [
        "CWE-434"
      ],
      "owasp": "A04:2021 Insecure Design",
      "typical_severity": {
        "min": "medium",
        "max": "critical"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-434: Unrestricted Upload of File with Dangerous Type",
          "url": "https://cwe.mitre.org/data/definitions/434.html"
        },
        {
          "title": "OWASP File Upload Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Top 10 A04:2021 Insecure Design",
          "url": "https://owasp.org/Top10/A04_2021-Insecure_Design/"
        },
        {
          "title": "PortSwigger Web Security Academy: File upload vulnerabilities",
          "url": "https://portswigger.net/web-security/file-upload"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/file-upload-flaws/#overview",
        "https://www.breachvanelabs.com/library/file-upload-flaws/#impact",
        "https://www.breachvanelabs.com/library/file-upload-flaws/#examples",
        "https://www.breachvanelabs.com/library/file-upload-flaws/#remediation",
        "https://www.breachvanelabs.com/library/file-upload-flaws/#testing",
        "https://www.breachvanelabs.com/library/file-upload-flaws/#references"
      ]
    },
    {
      "slug": "insecure-deserialization",
      "url": "https://www.breachvanelabs.com/library/insecure-deserialization/",
      "title": "Insecure deserialization",
      "short": "Deserialization",
      "aliases": [
        "Unsafe deserialization",
        "Untrusted object deserialization",
        "Object injection"
      ],
      "summary": "Insecure deserialization occurs when an application reconstructs native objects from attacker-controlled data. Depending on the runtime and available classes, this can change application state, bypass checks, or execute code.",
      "cwe": [
        "CWE-502"
      ],
      "owasp": "A08:2021 Software and Data Integrity Failures",
      "typical_severity": {
        "min": "medium",
        "max": "critical"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-502: Deserialization of Untrusted Data",
          "url": "https://cwe.mitre.org/data/definitions/502.html"
        },
        {
          "title": "OWASP Deserialization Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Top 10 A08:2021 Software and Data Integrity Failures",
          "url": "https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/"
        },
        {
          "title": "PortSwigger Web Security Academy: Insecure deserialization",
          "url": "https://portswigger.net/web-security/deserialization"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/insecure-deserialization/#overview",
        "https://www.breachvanelabs.com/library/insecure-deserialization/#impact",
        "https://www.breachvanelabs.com/library/insecure-deserialization/#examples",
        "https://www.breachvanelabs.com/library/insecure-deserialization/#remediation",
        "https://www.breachvanelabs.com/library/insecure-deserialization/#testing",
        "https://www.breachvanelabs.com/library/insecure-deserialization/#references"
      ]
    },
    {
      "slug": "jwt-weaknesses",
      "url": "https://www.breachvanelabs.com/library/jwt-weaknesses/",
      "title": "JSON Web Token (JWT) weaknesses",
      "short": "JWT weaknesses",
      "aliases": [
        "JWT validation flaws",
        "Insecure JWT handling",
        "Token signature bypass"
      ],
      "summary": "JWT weaknesses occur when applications decode tokens without fully validating their signature, algorithm, issuer, audience, lifetime, and key source. Attackers may forge identities or privileges that the server treats as trusted.",
      "cwe": [
        "CWE-347",
        "CWE-287"
      ],
      "owasp": "A07:2021 Identification and Authentication Failures",
      "typical_severity": {
        "min": "medium",
        "max": "critical"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-347: Improper Verification of Cryptographic Signature",
          "url": "https://cwe.mitre.org/data/definitions/347.html"
        },
        {
          "title": "RFC 8725: JSON Web Token Best Current Practices",
          "url": "https://www.rfc-editor.org/rfc/rfc8725.html"
        },
        {
          "title": "OWASP JSON Web Token Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Top 10 A07:2021 Identification and Authentication Failures",
          "url": "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/"
        },
        {
          "title": "PortSwigger Web Security Academy: JWT attacks",
          "url": "https://portswigger.net/web-security/jwt"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/jwt-weaknesses/#overview",
        "https://www.breachvanelabs.com/library/jwt-weaknesses/#impact",
        "https://www.breachvanelabs.com/library/jwt-weaknesses/#examples",
        "https://www.breachvanelabs.com/library/jwt-weaknesses/#remediation",
        "https://www.breachvanelabs.com/library/jwt-weaknesses/#testing",
        "https://www.breachvanelabs.com/library/jwt-weaknesses/#references"
      ]
    },
    {
      "slug": "ldap-injection",
      "url": "https://www.breachvanelabs.com/library/ldap-injection/",
      "title": "LDAP injection",
      "short": "LDAP injection",
      "aliases": [
        "LDAP filter injection",
        "Directory query injection",
        "Lightweight Directory Access Protocol injection"
      ],
      "summary": "LDAP injection occurs when untrusted input changes the structure of a directory query. It can bypass authentication, broaden searches, disclose directory data, or modify records beyond the intended scope.",
      "cwe": [
        "CWE-90"
      ],
      "owasp": "A03:2021 Injection",
      "typical_severity": {
        "min": "medium",
        "max": "critical"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query",
          "url": "https://cwe.mitre.org/data/definitions/90.html"
        },
        {
          "title": "OWASP LDAP Injection Prevention Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html"
        },
        {
          "title": "OWASP LDAP Injection",
          "url": "https://owasp.org/www-community/attacks/LDAP_Injection"
        },
        {
          "title": "OWASP Top 10 A03:2021 Injection",
          "url": "https://owasp.org/Top10/A03_2021-Injection/"
        },
        {
          "title": "Oracle Java DirContext search documentation",
          "url": "https://docs.oracle.com/en/java/javase/21/docs/api/java.naming/javax/naming/directory/DirContext.html"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/ldap-injection/#overview",
        "https://www.breachvanelabs.com/library/ldap-injection/#impact",
        "https://www.breachvanelabs.com/library/ldap-injection/#examples",
        "https://www.breachvanelabs.com/library/ldap-injection/#remediation",
        "https://www.breachvanelabs.com/library/ldap-injection/#testing",
        "https://www.breachvanelabs.com/library/ldap-injection/#references"
      ]
    },
    {
      "slug": "missing-multi-factor-authentication",
      "url": "https://www.breachvanelabs.com/library/missing-multi-factor-authentication/",
      "title": "Missing multi-factor authentication",
      "short": "Missing MFA",
      "aliases": [
        "Single-factor authentication",
        "MFA not enforced",
        "Two-factor authentication missing"
      ],
      "summary": "Missing MFA leaves an account protected by only one factor, commonly a reusable password. A stolen, phished, sprayed, or reused password can therefore provide immediate access.",
      "cwe": [
        "CWE-308"
      ],
      "owasp": "A07:2021 Identification and Authentication Failures",
      "typical_severity": {
        "min": "medium",
        "max": "critical"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-308: Use of Single-factor Authentication",
          "url": "https://cwe.mitre.org/data/definitions/308.html"
        },
        {
          "title": "NIST SP 800-63B: Authentication and Authenticator Management",
          "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
        },
        {
          "title": "OWASP Multifactor Authentication Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Authentication Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Top 10 A07:2021 Identification and Authentication Failures",
          "url": "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/missing-multi-factor-authentication/#overview",
        "https://www.breachvanelabs.com/library/missing-multi-factor-authentication/#impact",
        "https://www.breachvanelabs.com/library/missing-multi-factor-authentication/#examples",
        "https://www.breachvanelabs.com/library/missing-multi-factor-authentication/#remediation",
        "https://www.breachvanelabs.com/library/missing-multi-factor-authentication/#testing",
        "https://www.breachvanelabs.com/library/missing-multi-factor-authentication/#references"
      ]
    },
    {
      "slug": "missing-security-headers",
      "url": "https://www.breachvanelabs.com/library/missing-security-headers/",
      "title": "Missing security headers",
      "short": "Security headers",
      "aliases": [
        "HTTP security headers missing",
        "Browser security policy missing",
        "Response header hardening"
      ],
      "summary": "Missing or weak HTTP security headers leave browser protections undefined or permissive. They can increase the impact of cross-site scripting, clickjacking, content-type confusion, information leakage, and insecure transport.",
      "cwe": [
        "CWE-693"
      ],
      "owasp": "A05:2021 Security Misconfiguration",
      "typical_severity": {
        "min": "low",
        "max": "high"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-693: Protection Mechanism Failure",
          "url": "https://cwe.mitre.org/data/definitions/693.html"
        },
        {
          "title": "OWASP HTTP Headers Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Content Security Policy Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Top 10 A05:2021 Security Misconfiguration",
          "url": "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/"
        },
        {
          "title": "MDN: HTTP headers",
          "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/missing-security-headers/#overview",
        "https://www.breachvanelabs.com/library/missing-security-headers/#impact",
        "https://www.breachvanelabs.com/library/missing-security-headers/#examples",
        "https://www.breachvanelabs.com/library/missing-security-headers/#remediation",
        "https://www.breachvanelabs.com/library/missing-security-headers/#testing",
        "https://www.breachvanelabs.com/library/missing-security-headers/#references"
      ]
    },
    {
      "slug": "null-session-anonymous-access",
      "url": "https://www.breachvanelabs.com/library/null-session-anonymous-access/",
      "title": "Null sessions and anonymous access to domain controllers",
      "short": "Null session",
      "aliases": [
        "Null authentication",
        "Anonymous logon",
        "Anonymous SMB and RPC enumeration",
        "Anonymous LDAP bind"
      ],
      "summary": "A domain controller accepts connections with no username or password and answers directory questions for them. Anyone who can reach it on the network can list users, groups and the password policy without a single credential.",
      "cwe": [
        "CWE-287",
        "CWE-200"
      ],
      "owasp": "A05:2021 Security Misconfiguration",
      "typical_severity": {
        "min": "medium",
        "max": "high"
      },
      "updated": "2026-10-19",
      "references": [
        {
          "title": "CWE-287: Improper Authentication",
          "url": "https://cwe.mitre.org/data/definitions/287.html"
        },
        {
          "title": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
          "url": "https://cwe.mitre.org/data/definitions/200.html"
        },
        {
          "title": "OWASP Top 10 A05:2021 Security Misconfiguration",
          "url": "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/"
        },
        {
          "title": "Microsoft: Network access: Do not allow anonymous enumeration of SAM accounts and shares",
          "url": "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares"
        },
        {
          "title": "Microsoft: Network access: Restrict anonymous access to Named Pipes and Shares",
          "url": "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares"
        },
        {
          "title": "MITRE ATT&CK T1087.002 Account Discovery: Domain Account",
          "url": "https://attack.mitre.org/techniques/T1087/002/"
        },
        {
          "title": "CIS Benchmarks: Microsoft Windows Server",
          "url": "https://www.cisecurity.org/benchmark/microsoft_windows_server"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/null-session-anonymous-access/#overview",
        "https://www.breachvanelabs.com/library/null-session-anonymous-access/#impact",
        "https://www.breachvanelabs.com/library/null-session-anonymous-access/#examples",
        "https://www.breachvanelabs.com/library/null-session-anonymous-access/#remediation",
        "https://www.breachvanelabs.com/library/null-session-anonymous-access/#testing",
        "https://www.breachvanelabs.com/library/null-session-anonymous-access/#references"
      ]
    },
    {
      "slug": "open-redirect",
      "url": "https://www.breachvanelabs.com/library/open-redirect/",
      "title": "Open redirect",
      "short": "Open redirect",
      "aliases": [
        "Unvalidated redirect",
        "Unvalidated forward",
        "Arbitrary redirect"
      ],
      "summary": "An open redirect lets untrusted input choose where a trusted application sends the user's browser. It is commonly abused for convincing phishing links and can become more serious when combined with authentication or authorization flows.",
      "cwe": [
        "CWE-601"
      ],
      "owasp": "A01:2021 Broken Access Control",
      "typical_severity": {
        "min": "low",
        "max": "high"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-601: URL Redirection to Untrusted Site",
          "url": "https://cwe.mitre.org/data/definitions/601.html"
        },
        {
          "title": "OWASP Unvalidated Redirects and Forwards Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Open Redirect",
          "url": "https://community.owasp.org/attacks/open_redirect"
        },
        {
          "title": "OWASP Top 10 A01:2021 Broken Access Control",
          "url": "https://owasp.org/Top10/A01_2021-Broken_Access_Control/"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/open-redirect/#overview",
        "https://www.breachvanelabs.com/library/open-redirect/#impact",
        "https://www.breachvanelabs.com/library/open-redirect/#examples",
        "https://www.breachvanelabs.com/library/open-redirect/#remediation",
        "https://www.breachvanelabs.com/library/open-redirect/#testing",
        "https://www.breachvanelabs.com/library/open-redirect/#references"
      ]
    },
    {
      "slug": "os-command-injection",
      "url": "https://www.breachvanelabs.com/library/os-command-injection/",
      "title": "Operating system command injection",
      "short": "OS command injection",
      "aliases": [
        "Shell injection",
        "Command injection",
        "OS command injection"
      ],
      "summary": "OS command injection occurs when untrusted input changes a command executed by the operating system. It can let an attacker run commands with the application's privileges and often leads to full server compromise.",
      "cwe": [
        "CWE-78"
      ],
      "owasp": "A03:2021 Injection",
      "typical_severity": {
        "min": "high",
        "max": "critical"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-78: Improper Neutralization of Special Elements used in an OS Command",
          "url": "https://cwe.mitre.org/data/definitions/78.html"
        },
        {
          "title": "OWASP OS Command Injection Defense Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Top 10 A03:2021 Injection",
          "url": "https://owasp.org/Top10/A03_2021-Injection/"
        },
        {
          "title": "Node.js child_process documentation",
          "url": "https://nodejs.org/api/child_process.html"
        },
        {
          "title": "PortSwigger Web Security Academy: OS command injection",
          "url": "https://portswigger.net/web-security/os-command-injection"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/os-command-injection/#overview",
        "https://www.breachvanelabs.com/library/os-command-injection/#impact",
        "https://www.breachvanelabs.com/library/os-command-injection/#examples",
        "https://www.breachvanelabs.com/library/os-command-injection/#remediation",
        "https://www.breachvanelabs.com/library/os-command-injection/#testing",
        "https://www.breachvanelabs.com/library/os-command-injection/#references"
      ]
    },
    {
      "slug": "path-traversal",
      "url": "https://www.breachvanelabs.com/library/path-traversal/",
      "title": "Path traversal",
      "short": "Path traversal",
      "aliases": [
        "Directory traversal",
        "Dot-dot-slash attack",
        "File path traversal"
      ],
      "summary": "Path traversal lets untrusted input escape an intended directory and access other files or locations. It can expose secrets, overwrite application data, or turn file-handling features into server compromise.",
      "cwe": [
        "CWE-22"
      ],
      "owasp": "A01:2021 Broken Access Control",
      "typical_severity": {
        "min": "medium",
        "max": "critical"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory",
          "url": "https://cwe.mitre.org/data/definitions/22.html"
        },
        {
          "title": "OWASP Path Traversal",
          "url": "https://owasp.org/www-community/attacks/Path_Traversal"
        },
        {
          "title": "OWASP Top 10 A01:2021 Broken Access Control",
          "url": "https://owasp.org/Top10/A01_2021-Broken_Access_Control/"
        },
        {
          "title": "PortSwigger Web Security Academy: Directory traversal",
          "url": "https://portswigger.net/web-security/file-path-traversal"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/path-traversal/#overview",
        "https://www.breachvanelabs.com/library/path-traversal/#impact",
        "https://www.breachvanelabs.com/library/path-traversal/#examples",
        "https://www.breachvanelabs.com/library/path-traversal/#remediation",
        "https://www.breachvanelabs.com/library/path-traversal/#testing",
        "https://www.breachvanelabs.com/library/path-traversal/#references"
      ]
    },
    {
      "slug": "security-misconfiguration-default-credentials",
      "url": "https://www.breachvanelabs.com/library/security-misconfiguration-default-credentials/",
      "title": "Security misconfiguration and default credentials",
      "short": "Security misconfiguration",
      "aliases": [
        "Insecure defaults",
        "Default credentials",
        "Improper security configuration",
        "Factory credentials"
      ],
      "summary": "Security misconfiguration leaves systems exposed through unsafe defaults, unnecessary features, excessive permissions, or shared credentials. A single overlooked setting can bypass otherwise sound application controls.",
      "cwe": [
        "CWE-16",
        "CWE-1392"
      ],
      "owasp": "A05:2021 Security Misconfiguration",
      "typical_severity": {
        "min": "low",
        "max": "critical"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-16: Configuration",
          "url": "https://cwe.mitre.org/data/definitions/16.html"
        },
        {
          "title": "CWE-1392: Use of Default Credentials",
          "url": "https://cwe.mitre.org/data/definitions/1392.html"
        },
        {
          "title": "OWASP Top 10 A05:2021 Security Misconfiguration",
          "url": "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/"
        },
        {
          "title": "OWASP Application Security Verification Standard",
          "url": "https://owasp.org/www-project-application-security-verification-standard/"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/security-misconfiguration-default-credentials/#overview",
        "https://www.breachvanelabs.com/library/security-misconfiguration-default-credentials/#impact",
        "https://www.breachvanelabs.com/library/security-misconfiguration-default-credentials/#examples",
        "https://www.breachvanelabs.com/library/security-misconfiguration-default-credentials/#remediation",
        "https://www.breachvanelabs.com/library/security-misconfiguration-default-credentials/#testing",
        "https://www.breachvanelabs.com/library/security-misconfiguration-default-credentials/#references"
      ]
    },
    {
      "slug": "sensitive-data-exposure",
      "url": "https://www.breachvanelabs.com/library/sensitive-data-exposure/",
      "title": "Sensitive data exposure",
      "short": "Sensitive data exposure",
      "aliases": [
        "Information disclosure",
        "Sensitive information exposure",
        "Data leakage",
        "Cryptographic failure"
      ],
      "summary": "Sensitive data exposure occurs when confidential information is collected unnecessarily, returned to the wrong audience, logged, stored, or transmitted without adequate protection. The result may be account takeover, privacy harm, fraud, or large-scale breach.",
      "cwe": [
        "CWE-200",
        "CWE-312"
      ],
      "owasp": "A02:2021 Cryptographic Failures",
      "typical_severity": {
        "min": "low",
        "max": "critical"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
          "url": "https://cwe.mitre.org/data/definitions/200.html"
        },
        {
          "title": "CWE-312: Cleartext Storage of Sensitive Information",
          "url": "https://cwe.mitre.org/data/definitions/312.html"
        },
        {
          "title": "OWASP Top 10 A02:2021 Cryptographic Failures",
          "url": "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/"
        },
        {
          "title": "OWASP Cryptographic Storage Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Logging Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Secrets Management Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/sensitive-data-exposure/#overview",
        "https://www.breachvanelabs.com/library/sensitive-data-exposure/#impact",
        "https://www.breachvanelabs.com/library/sensitive-data-exposure/#examples",
        "https://www.breachvanelabs.com/library/sensitive-data-exposure/#remediation",
        "https://www.breachvanelabs.com/library/sensitive-data-exposure/#testing",
        "https://www.breachvanelabs.com/library/sensitive-data-exposure/#references"
      ]
    },
    {
      "slug": "server-side-request-forgery",
      "url": "https://www.breachvanelabs.com/library/server-side-request-forgery/",
      "title": "Server-side request forgery (SSRF)",
      "short": "SSRF",
      "aliases": [
        "Server-side request forgery",
        "Blind SSRF",
        "Cross-service request forgery"
      ],
      "summary": "SSRF lets an attacker make the application server send requests to destinations the attacker could not normally reach. It can expose internal services, cloud metadata, credentials, and trusted administrative interfaces.",
      "cwe": [
        "CWE-918"
      ],
      "owasp": "A10:2021 Server-Side Request Forgery",
      "typical_severity": {
        "min": "medium",
        "max": "critical"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-918: Server-Side Request Forgery",
          "url": "https://cwe.mitre.org/data/definitions/918.html"
        },
        {
          "title": "OWASP Top 10 A10:2021 Server-Side Request Forgery",
          "url": "https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/"
        },
        {
          "title": "OWASP Server-Side Request Forgery Prevention Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html"
        },
        {
          "title": "PortSwigger Web Security Academy: Server-side request forgery",
          "url": "https://portswigger.net/web-security/ssrf"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/server-side-request-forgery/#overview",
        "https://www.breachvanelabs.com/library/server-side-request-forgery/#impact",
        "https://www.breachvanelabs.com/library/server-side-request-forgery/#examples",
        "https://www.breachvanelabs.com/library/server-side-request-forgery/#remediation",
        "https://www.breachvanelabs.com/library/server-side-request-forgery/#testing",
        "https://www.breachvanelabs.com/library/server-side-request-forgery/#references"
      ]
    },
    {
      "slug": "server-side-template-injection",
      "url": "https://www.breachvanelabs.com/library/server-side-template-injection/",
      "title": "Server-side template injection (SSTI)",
      "short": "SSTI",
      "aliases": [
        "Template injection",
        "Server template injection",
        "Expression language injection"
      ],
      "summary": "SSTI occurs when untrusted input is interpreted as template source instead of ordinary data. It can expose application objects and secrets and, in many template engines, lead to server-side code execution.",
      "cwe": [
        "CWE-1336"
      ],
      "owasp": "A03:2021 Injection",
      "typical_severity": {
        "min": "high",
        "max": "critical"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
          "url": "https://cwe.mitre.org/data/definitions/1336.html"
        },
        {
          "title": "OWASP Top 10 A03:2021 Injection",
          "url": "https://owasp.org/Top10/A03_2021-Injection/"
        },
        {
          "title": "PortSwigger Web Security Academy: Server-side template injection",
          "url": "https://portswigger.net/web-security/server-side-template-injection"
        },
        {
          "title": "Flask documentation: Templates",
          "url": "https://flask.palletsprojects.com/en/stable/tutorial/templates/"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/server-side-template-injection/#overview",
        "https://www.breachvanelabs.com/library/server-side-template-injection/#impact",
        "https://www.breachvanelabs.com/library/server-side-template-injection/#examples",
        "https://www.breachvanelabs.com/library/server-side-template-injection/#remediation",
        "https://www.breachvanelabs.com/library/server-side-template-injection/#testing",
        "https://www.breachvanelabs.com/library/server-side-template-injection/#references"
      ]
    },
    {
      "slug": "session-fixation",
      "url": "https://www.breachvanelabs.com/library/session-fixation/",
      "title": "Session fixation",
      "short": "Session fixation",
      "aliases": [
        "Session identifier fixation",
        "Pre-authentication session reuse",
        "Session adoption"
      ],
      "summary": "Session fixation occurs when an application keeps the same session identifier after login or a privilege change. An attacker who knows or sets the pre-login identifier may be able to reuse it as an authenticated session.",
      "cwe": [
        "CWE-384"
      ],
      "owasp": "A07:2021 Identification and Authentication Failures",
      "typical_severity": {
        "min": "medium",
        "max": "high"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-384: Session Fixation",
          "url": "https://cwe.mitre.org/data/definitions/384.html"
        },
        {
          "title": "OWASP Session Management Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Session Fixation",
          "url": "https://owasp.org/www-community/attacks/Session_fixation"
        },
        {
          "title": "OWASP Top 10 A07:2021 Identification and Authentication Failures",
          "url": "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/session-fixation/#overview",
        "https://www.breachvanelabs.com/library/session-fixation/#impact",
        "https://www.breachvanelabs.com/library/session-fixation/#examples",
        "https://www.breachvanelabs.com/library/session-fixation/#remediation",
        "https://www.breachvanelabs.com/library/session-fixation/#testing",
        "https://www.breachvanelabs.com/library/session-fixation/#references"
      ]
    },
    {
      "slug": "sql-injection",
      "url": "https://www.breachvanelabs.com/library/sql-injection/",
      "title": "SQL injection (SQLi)",
      "short": "SQLi",
      "aliases": [
        "Blind SQL injection",
        "Error-based SQL injection",
        "Second-order SQL injection"
      ],
      "summary": "User input is built into a database query as code instead of being passed as data, letting an attacker read, change or delete data and sometimes take over the database server.",
      "cwe": [
        "CWE-89"
      ],
      "owasp": "A03:2021 Injection",
      "typical_severity": {
        "min": "high",
        "max": "critical"
      },
      "updated": "2026-10-14",
      "references": [
        {
          "title": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
          "url": "https://cwe.mitre.org/data/definitions/89.html"
        },
        {
          "title": "OWASP SQL Injection Prevention Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Query Parameterization Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Web Security Testing Guide: Testing for SQL Injection",
          "url": "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05-Testing_for_SQL_Injection"
        },
        {
          "title": "MITRE ATT&CK T1190: Exploit Public-Facing Application",
          "url": "https://attack.mitre.org/techniques/T1190/"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/sql-injection/#overview",
        "https://www.breachvanelabs.com/library/sql-injection/#impact",
        "https://www.breachvanelabs.com/library/sql-injection/#examples",
        "https://www.breachvanelabs.com/library/sql-injection/#remediation",
        "https://www.breachvanelabs.com/library/sql-injection/#testing",
        "https://www.breachvanelabs.com/library/sql-injection/#references"
      ]
    },
    {
      "slug": "tls-misconfiguration",
      "url": "https://www.breachvanelabs.com/library/tls-misconfiguration/",
      "title": "TLS misconfiguration",
      "short": "TLS misconfiguration",
      "aliases": [
        "Weak TLS configuration",
        "Obsolete TLS enabled",
        "TLS 1.0 or TLS 1.1 enabled",
        "Weak cipher suites"
      ],
      "summary": "TLS misconfiguration weakens the protection of data in transit through obsolete protocols, weak algorithms, invalid certificates, or inconsistent HTTPS enforcement. Attackers may intercept, downgrade, or impersonate connections.",
      "cwe": [
        "CWE-326",
        "CWE-327"
      ],
      "owasp": "A02:2021 Cryptographic Failures",
      "typical_severity": {
        "min": "low",
        "max": "high"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-326: Inadequate Encryption Strength",
          "url": "https://cwe.mitre.org/data/definitions/326.html"
        },
        {
          "title": "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
          "url": "https://cwe.mitre.org/data/definitions/327.html"
        },
        {
          "title": "RFC 8996: Deprecating TLS 1.0 and TLS 1.1",
          "url": "https://www.rfc-editor.org/rfc/rfc8996.html"
        },
        {
          "title": "NIST SP 800-52 Rev. 2: Guidelines for TLS Implementations",
          "url": "https://csrc.nist.gov/pubs/sp/800/52/r2/final"
        },
        {
          "title": "OWASP Transport Layer Security Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Top 10 A02:2021 Cryptographic Failures",
          "url": "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/tls-misconfiguration/#overview",
        "https://www.breachvanelabs.com/library/tls-misconfiguration/#impact",
        "https://www.breachvanelabs.com/library/tls-misconfiguration/#examples",
        "https://www.breachvanelabs.com/library/tls-misconfiguration/#remediation",
        "https://www.breachvanelabs.com/library/tls-misconfiguration/#testing",
        "https://www.breachvanelabs.com/library/tls-misconfiguration/#references"
      ]
    },
    {
      "slug": "vulnerable-outdated-components",
      "url": "https://www.breachvanelabs.com/library/vulnerable-outdated-components/",
      "title": "Vulnerable and outdated components",
      "short": "Outdated components",
      "aliases": [
        "Known vulnerable dependencies",
        "Unsupported software",
        "Dependency vulnerabilities",
        "Unpatched components"
      ],
      "summary": "Applications inherit risk from unsupported or vulnerable libraries, frameworks, runtimes, images, appliances, and services. A reachable weakness in one component can compromise the entire application or its supply chain.",
      "cwe": [
        "CWE-1104"
      ],
      "owasp": "A06:2021 Vulnerable and Outdated Components",
      "typical_severity": {
        "min": "low",
        "max": "critical"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-1104: Use of Unmaintained Third Party Components",
          "url": "https://cwe.mitre.org/data/definitions/1104.html"
        },
        {
          "title": "OWASP Top 10 A06:2021 Vulnerable and Outdated Components",
          "url": "https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/"
        },
        {
          "title": "CISA Known Exploited Vulnerabilities Catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "title": "NIST Secure Software Development Framework",
          "url": "https://csrc.nist.gov/pubs/sp/800/218/final"
        },
        {
          "title": "OWASP Dependency-Check",
          "url": "https://owasp.org/www-project-dependency-check/"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/vulnerable-outdated-components/#overview",
        "https://www.breachvanelabs.com/library/vulnerable-outdated-components/#impact",
        "https://www.breachvanelabs.com/library/vulnerable-outdated-components/#examples",
        "https://www.breachvanelabs.com/library/vulnerable-outdated-components/#remediation",
        "https://www.breachvanelabs.com/library/vulnerable-outdated-components/#testing",
        "https://www.breachvanelabs.com/library/vulnerable-outdated-components/#references"
      ]
    },
    {
      "slug": "weak-password-policy",
      "url": "https://www.breachvanelabs.com/library/weak-password-policy/",
      "title": "Weak password policy",
      "short": "Weak passwords",
      "aliases": [
        "Insufficient password policy",
        "Weak credential requirements",
        "Poor password controls"
      ],
      "summary": "A weak password policy permits short, common, compromised, or repeatedly guessed passwords. Attackers can exploit it through password spraying, credential stuffing, online guessing, or offline cracking after a data breach.",
      "cwe": [
        "CWE-521"
      ],
      "owasp": "A07:2021 Identification and Authentication Failures",
      "typical_severity": {
        "min": "medium",
        "max": "high"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-521: Weak Password Requirements",
          "url": "https://cwe.mitre.org/data/definitions/521.html"
        },
        {
          "title": "NIST SP 800-63B: Authenticators",
          "url": "https://pages.nist.gov/800-63-4/sp800-63b/authenticators/"
        },
        {
          "title": "OWASP Authentication Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Password Storage Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Top 10 A07:2021 Identification and Authentication Failures",
          "url": "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/weak-password-policy/#overview",
        "https://www.breachvanelabs.com/library/weak-password-policy/#impact",
        "https://www.breachvanelabs.com/library/weak-password-policy/#examples",
        "https://www.breachvanelabs.com/library/weak-password-policy/#remediation",
        "https://www.breachvanelabs.com/library/weak-password-policy/#testing",
        "https://www.breachvanelabs.com/library/weak-password-policy/#references"
      ]
    },
    {
      "slug": "xml-external-entity-injection",
      "url": "https://www.breachvanelabs.com/library/xml-external-entity-injection/",
      "title": "XML external entity injection (XXE)",
      "short": "XXE",
      "aliases": [
        "XML external entity attack",
        "External entity injection",
        "Blind XXE"
      ],
      "summary": "XXE occurs when an XML parser processes attacker-controlled external entities or document type definitions. It can expose local files, trigger server-side requests, or exhaust application resources.",
      "cwe": [
        "CWE-611",
        "CWE-776"
      ],
      "owasp": "A05:2021 Security Misconfiguration",
      "typical_severity": {
        "min": "medium",
        "max": "critical"
      },
      "updated": "2026-10-15",
      "references": [
        {
          "title": "CWE-611: Improper Restriction of XML External Entity Reference",
          "url": "https://cwe.mitre.org/data/definitions/611.html"
        },
        {
          "title": "CWE-776: Improper Restriction of Recursive Entity References in DTDs",
          "url": "https://cwe.mitre.org/data/definitions/776.html"
        },
        {
          "title": "OWASP XML External Entity Prevention Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html"
        },
        {
          "title": "OWASP Top 10 A05:2021 Security Misconfiguration",
          "url": "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/"
        },
        {
          "title": "PortSwigger Web Security Academy: XML external entity injection",
          "url": "https://portswigger.net/web-security/xxe"
        }
      ],
      "sections": [
        "https://www.breachvanelabs.com/library/xml-external-entity-injection/#overview",
        "https://www.breachvanelabs.com/library/xml-external-entity-injection/#impact",
        "https://www.breachvanelabs.com/library/xml-external-entity-injection/#examples",
        "https://www.breachvanelabs.com/library/xml-external-entity-injection/#remediation",
        "https://www.breachvanelabs.com/library/xml-external-entity-injection/#testing",
        "https://www.breachvanelabs.com/library/xml-external-entity-injection/#references"
      ]
    }
  ]
}