Despite decades of awareness, the same families of flaws keep appearing in web applications. Injection attacks lead the list. SQL injection happens when untrusted input is concatenated into a query, allowing attackers to alter its structure. Variants include UNION-based attacks that append rows from arbitrary tables, blind SQLi where results are not directly returned and data must be inferred from boolean or timing side channels, and second-order SQLi where input is stored safely but later concatenated in a different context. Path traversal uses sequences like "../../" in file-related input to escape intended directories. CRLF injection smuggles carriage return or line feed characters into headers or logs, enabling response splitting, while HTTP request smuggling exploits disagreements between front-end and back-end parsers about Content-Length versus Transfer-Encoding: chunked.
Cross-site issues affect users through their browsers. Reflected XSS echoes attacker-supplied script from a request (often in a URL) directly back to the victim. Stored XSS persists a payload on the server — in a comment, profile field, or similar — so it runs for every viewer of the affected page. DOM-based XSS exists entirely in client-side JavaScript that reads an attacker-controllable source (such as location.hash) and writes it to a dangerous sink. Cross-Site Request Forgery (CSRF) tricks an already-authenticated browser into submitting a state-changing request the user never intended. Clickjacking is related but distinct: it overlays disguised UI so the user clicks something other than what they see.
Authorization flaws form a third major category. Insecure Direct Object References (IDOR) occur when an app uses a user-supplied identifier to fetch an object without verifying the requester is allowed to see it; horizontal privilege escalation is accessing another user's data at the same level, while vertical escalation is gaining higher privilege (for example, becoming an admin). Server-Side Request Forgery (SSRF) tricks the server into issuing requests to unintended targets, often internal services or cloud metadata endpoints like IMDS, and URL parser confusion can make "validated" URLs resolve to hidden hosts. XML External Entity (XXE) attacks abuse DTD processing to read files or pivot SSRF. Finally, mass assignment binds every incoming request field to a model (letting an attacker set fields like is_admin), prototype pollution mutates Object.prototype through unsafe deep-merges in JavaScript, and insecure deserialization turns untrusted serialized data into live objects capable of remote code execution, replay, or privilege escalation.