# Web application vulnerabilities

Source: https://penetrationtestservices.com/vulnerabilities/
Publisher: Excession Labs (penetrationtestservices.com)
Last updated: 2026-11-09

Guides to web application and API vulnerabilities: how each one works, how penetration testers prove it with evidence, and how to fix it in your code.

Each guide explains one vulnerability class the way a penetration tester meets it: what it is, how it works, how a tester proves it with evidence instead of a scanner alert, and how to fix it in the languages and frameworks teams use. Examples run against fictional demo apps and are labeled in each guide.

- [After the pentest: remediation, retest and close-out](https://penetrationtestservices.com/guides/after-the-pentest-remediation-and-retest/): What to do after a penetration test: triage findings, assign fixes, verify them, request a retest and close out with evidence. Includes a tracker template.
- [Authentication testing checklist: login, reset, MFA, sessions and OAuth](https://penetrationtestservices.com/guides/authentication-testing-checklist/): An authentication testing checklist for web apps and APIs: login, password reset, MFA, sessions, OAuth and account enumeration, with proof and fixes.
- [Black box vs grey box vs white box penetration testing](https://penetrationtestservices.com/guides/black-box-grey-box-white-box-testing/): How black box, grey box and white box penetration tests differ, what each costs you in time and depth, and a decision table to choose one.
- [Bubble app security: privacy rules, Data API and workflow API checklist](https://penetrationtestservices.com/guides/bubble-app-security/): How to check your own Bubble app: privacy rules on every data type, Data API and Workflow API settings, search exposure and client-side data, with a test checklist.
- [Business logic vulnerabilities: examples, testing and fixes](https://penetrationtestservices.com/guides/business-logic-vulnerabilities/): What business logic vulnerabilities are, why scanners miss them, examples in pricing, workflows and limits, how testers prove them and how to fix them.
- [CMMC penetration testing: which level requires a pentest](https://penetrationtestservices.com/guides/cmmc-penetration-testing/): Does CMMC require a penetration test? Level 1 and Level 2 do not name one. Level 3 does, in CA.L3-3.12.1e. Sources, scoping tips and evidence to keep.
- [CSRF testing: how pentesters check tokens, SameSite and login CSRF](https://penetrationtestservices.com/guides/csrf-testing/): How to test CSRF protection: an 8-step method, a test-case table for tokens, Origin and SameSite, JSON endpoints, login CSRF, and proof in a real browser.
- [Cyber insurance penetration testing requirements: what insurers ask and accept](https://penetrationtestservices.com/guides/cyber-insurance-penetration-testing-requirements/): Does cyber insurance require a pentest? No universal rule exists. See what applications ask, when a pentest comes up, what to send your broker and what it cannot do.
- [Does SOC 2 require penetration testing?](https://penetrationtestservices.com/guides/does-soc-2-require-penetration-testing/): Does SOC 2 require penetration testing? No. See the AICPA CC4.1 wording, why auditors still ask for a pentest report, and five questions to settle first.
- [DORA penetration testing: what TLPT is and who needs it](https://penetrationtestservices.com/guides/dora-penetration-testing/): DORA penetration testing explained: yearly resilience tests under Articles 24 and 25, TLPT under 26 and 27, and what a SaaS supplier should expect from bank customers.
- [External vs internal penetration testing: which one to buy](https://penetrationtestservices.com/guides/external-vs-internal-penetration-testing/): External vs internal penetration testing for a SaaS app and API: what each covers, how the terms map to cloud, which to buy first, and a scoping checklist.
- [FedRAMP penetration testing: who may test and how often](https://penetrationtestservices.com/guides/fedramp-penetration-testing/): FedRAMP penetration testing: a 3PAO runs the official test. What the guidance says, which document applies in 2026, timing, scope, and how to prepare.
- [Firebase security rules testing: Firestore, Storage and the emulator](https://penetrationtestservices.com/guides/firebase-security-rules-testing/): Firebase security rules testing for Firestore, Storage and Realtime Database: working unit tests for the Local Emulator Suite, safe example rules, and a checklist.
- [GDPR penetration testing: what Article 32 asks for](https://penetrationtestservices.com/guides/gdpr-penetration-testing/): Does GDPR require a penetration test? Article 32(1)(d) asks for regular testing, not a named pentest. What to scope, what evidence to keep, what to ask a provider.
- [HIPAA penetration testing: what the Security Rule says today and what HHS proposed](https://penetrationtestservices.com/guides/hipaa-penetration-testing/): HIPAA penetration testing requirements as of November 2026: the Security Rule in force does not name a pentest, and the January 2025 HHS proposal is not final.
- [How often should you pentest? Standards, triggers and a schedule](https://penetrationtestservices.com/guides/how-often-should-you-pentest/): Penetration testing frequency by standard: PCI DSS 11.4, SOC 2, ISO 27001, FedRAMP and DORA, plus ten triggers, a 12-month SaaS calendar and an annual test FAQ.
- [Penetration testing checklist: how to prepare for a pentest](https://penetrationtestservices.com/guides/how-to-prepare-for-a-penetration-test/): Penetration testing checklist for buyers: 30 items with owners across before, during and after the test. Scope, accounts, test data, contacts and retest.
- [How to read a penetration testing report, section by section](https://penetrationtestservices.com/guides/how-to-read-a-penetration-testing-report/): Penetration testing report explained: the 13 sections, five questions for the executive summary, an annotated finding, report formats, and how to plan the fixes.
- [IDOR testing: how pentesters find broken object-level authorization](https://penetrationtestservices.com/guides/idor-testing/): IDOR testing step by step: prove it with two accounts and a read-back, use a 7-case test table and demo requests, and fix BOLA with a server-side check.
- [ISO 27001 penetration testing: what the standard asks and auditors check](https://penetrationtestservices.com/guides/iso-27001-penetration-testing/): ISO 27001 penetration testing requirements: the standard does not name a pentest. See Annex A 8.8, 8.29 and 8.34, an evidence pack, and what to ask your auditor.
- [Multi-tenant isolation testing: how to check that tenants cannot see each other](https://penetrationtestservices.com/guides/multi-tenant-isolation-testing/): Multi-tenant security testing for SaaS: a two-tenant matrix of 12 areas (IDs, search, exports, caches, files), a sample leaking request and row-level security fixes.
- [NIS2 penetration testing: what Article 21 requires](https://penetrationtestservices.com/guides/nis2-penetration-testing/): Does NIS2 require a penetration test? What Article 21(2) says, who is in scope, why suppliers get pentest requests, and what evidence to send a customer.
- [OWASP API Security Top 10 (2023): the list and how to test each risk](https://penetrationtestservices.com/guides/owasp-api-security-top-10/): The OWASP API Security Top 10 2023 list with exact IDs from API1 to API10, plus test ideas, sample requests, a test-case table and the usual fix for each risk.
- [OWASP Top 10 2025: the list and what pentesters check for each item](https://penetrationtestservices.com/guides/owasp-top-10-2025/): OWASP Top 10:2025 with exact IDs, a one-line meaning for each category, a 2021 to 2025 mapping table and the checks a penetration tester runs.
- [PCI DSS penetration testing requirements: Requirement 11.4 explained](https://penetrationtestservices.com/guides/pci-dss-penetration-testing-requirements/): PCI penetration testing under PCI DSS v4.0.1 Requirement 11.4: 11.4.1 to 11.4.7 in one table, test types, who may test, evidence to keep and a QSA checklist.
- [Penetration testing for startups: when to buy the first one](https://penetrationtestservices.com/guides/penetration-testing-for-startups/): Penetration testing for startups: when to run the first test, what to fix before it, how to scope a small one, and how to reuse the report in customer reviews.
- [Penetration testing methodology: PTES, OSSTMM, NIST SP 800-115 and OWASP WSTG](https://penetrationtestservices.com/guides/penetration-testing-methodology/): Penetration testing methodology compared: PTES, OSSTMM, NIST SP 800-115 and OWASP WSTG, their real status, the phases they share and which to ask a provider for.
- [Penetration testing report template: 12 sections and a filled finding](https://penetrationtestservices.com/guides/penetration-testing-report-template/): A penetration testing report template you can copy: 12 sections, a blank finding block in Markdown, a filled example, a severity scale and a buyer checklist.
- [Penetration testing scope of work and rules of engagement](https://penetrationtestservices.com/guides/penetration-testing-rules-of-engagement/): Penetration testing scope of work and rules of engagement: the 10 clauses to write, in and out of scope examples for SaaS and API, and an SOW template.
- [Pentest attestation letter: what it contains and what it cannot prove](https://penetrationtestservices.com/guides/pentest-attestation-letter/): Penetration test letter explained: attestation vs authorization letter, a copyable template, a six-point review checklist and what no letter can prove to a buyer.
- [Pentest vs audit: what each one proves and who does it](https://penetrationtestservices.com/guides/pentest-vs-security-audit/): Pentest vs audit: a security audit checks controls against a standard, a pentest attacks the system. Comparison table, report examples and what to ask for.
- [Rate limiting and credential stuffing: how to test safely](https://penetrationtestservices.com/guides/rate-limiting-and-credential-stuffing/): Credential stuffing testing and rate limit tests done safely: OWASP OAT-008, a bounded test design, test cases for login, reset and MFA, and how to fix gaps.
- [Red team vs penetration testing: what is the difference?](https://penetrationtestservices.com/guides/red-team-vs-penetration-testing/): Red team vs pentest: how the two differ in goal, scope, stealth and who knows, with an 11-row comparison table and a decision table for choosing one.
- [Security questionnaire pentest questions: what buyers ask and how to answer](https://penetrationtestservices.com/guides/security-questionnaire-pentest-questions/): Pentest questions in security questionnaires (SIG, CAIQ, custom): 14 common questions with honest answer patterns, the evidence to attach, and what to avoid.
- [Supabase security audit: RLS, API keys, storage and RPC checklist](https://penetrationtestservices.com/guides/supabase-security-testing/): Supabase security audit for your own project: an 8-step checklist for RLS, publishable and secret keys, views, storage and RPC, with example policies.
- [Types of penetration testing: by target, knowledge and starting point](https://penetrationtestservices.com/guides/types-of-penetration-testing/): The types of penetration testing sorted on three axes (target, tester knowledge, starting point), plus a decision table that maps your situation to the test to ask for.
- [What is penetration testing? A plain guide for software teams](https://penetrationtestservices.com/guides/what-is-penetration-testing/): What is penetration testing? The meaning of a pentest in plain words, what it produces, types, scan vs pentest, five phases and one worked example finding.
- [Blind SQL injection: boolean vs time-based, and how testers prove it](https://penetrationtestservices.com/vulnerabilities/blind-sql-injection/): Blind SQL injection explained: boolean, time-based and out-of-band types, delay functions per database, how testers prove it without dumping data, and the fix.
- [Clickjacking: how to test your site and fix it with headers](https://penetrationtestservices.com/vulnerabilities/clickjacking/): Clickjacking explained: how the hidden iframe attack works, a 5-minute test, frame-ancestors and X-Frame-Options config for 8 stacks, and when it is a real finding.
- [Content Security Policy (CSP): how it works, how to test it, how to roll it out](https://penetrationtestservices.com/vulnerabilities/content-security-policy/): What a Content Security Policy is, the directives that matter, a strict nonce policy, a Report-Only rollout, config for common stacks and a tester's bypass checklist.
- [CORS misconfiguration: how it is exploited, tested and fixed](https://penetrationtestservices.com/vulnerabilities/cors-misconfiguration/): CORS misconfiguration explained: reflected origins, null, weak origin checks and credentials. How testers prove a cross-origin read, plus safe config for five stacks.
- [Cross-site scripting (XSS): examples, fixes and a test checklist](https://penetrationtestservices.com/vulnerabilities/cross-site-scripting/): Cross-site scripting explained: the three types, a worked example, an output encoding table, fixes for six stacks, CSP and cookie flags, and a tester's checklist.
- [DOM XSS (DOM-based cross-site scripting): sources, sinks and fixes](https://penetrationtestservices.com/vulnerabilities/dom-based-xss/): DOM XSS (DOM-based cross-site scripting) explained: sources and sinks, a worked example, safe replacements, a Trusted Types policy, CSP limits and how testers prove it.
- [File upload vulnerabilities: how uploads go wrong, how testers prove it, how to secure them](https://penetrationtestservices.com/vulnerabilities/file-upload-vulnerabilities/): File upload vulnerabilities explained: bypass classes, impact beyond web shells, safe proof by testers, and secure upload code for Node.js, Python, Java, PHP and Go.
- [GraphQL security testing: a test plan with queries and fixes](https://penetrationtestservices.com/vulnerabilities/graphql-security-testing/): A 10-step GraphQL security testing plan: find the endpoint, check introspection, test authorization, batching, depth limits and CSRF, then fix with code.
- [Host header injection: how it works, how testers prove it, how to fix it](https://penetrationtestservices.com/vulnerabilities/host-header-injection/): Host header injection explained: password reset poisoning, cache poisoning and routing bugs, real CVEs, how testers prove it safely, and fixes for eight stacks.
- [HTTP request smuggling: how it works, how testers prove it, how to fix it](https://penetrationtestservices.com/vulnerabilities/http-request-smuggling/): HTTP request smuggling explained: CL.TE, TE.CL, TE.TE, CL.0 and HTTP/2 variants, safe timing probes, real CVEs with dates, and fixes for proxies and app servers.
- [Insecure deserialization: how it works, how to test it and how to fix it](https://penetrationtestservices.com/vulnerabilities/insecure-deserialization/): Insecure deserialization explained: serialization vs deserialization, gadget chains, real CVEs, safe testing, and fixes for Java, Python, PHP, C# and Node.js.
- [JWT vulnerabilities: how attackers forge tokens and how to stop them](https://penetrationtestservices.com/vulnerabilities/jwt-vulnerabilities/): JWT vulnerabilities explained: alg none, key confusion, weak secrets, kid and jku abuse, missing claim checks. Safe verify code for four stacks and a test list.
- [Mass assignment: how it works, how to test it and how to fix it](https://penetrationtestservices.com/vulnerabilities/mass-assignment/): Mass assignment explained: how one extra JSON field changes a protected property, how testers prove it with a read-back, and vulnerable versus fixed code for 8 stacks.
- [NoSQL injection: how it works, how testers prove it, how to fix it](https://penetrationtestservices.com/vulnerabilities/nosql-injection/): NoSQL injection explained: MongoDB operator injection, a login demo, Rocket.Chat CVE-2021-22911, other databases, how testers prove it, and fixes for Node.js and Python.
- [OAuth vulnerabilities: attacks, fixes and a testing checklist](https://penetrationtestservices.com/vulnerabilities/oauth-vulnerabilities/): OAuth vulnerabilities explained: redirect_uri, state, PKCE, implicit flow, mix-up and consent flaws, with fixes for four stacks, dated cases and a test checklist.
- [Open redirect vulnerability: examples, CVEs, safe code and test cases](https://penetrationtestservices.com/vulnerabilities/open-redirect/): What an open redirect is, how it chains into OAuth token theft and SSRF, test cases a naive check misses, four real CVEs, and safe redirect code for 7 stacks.
- [Command injection: how it works, how testers prove it, how to fix it](https://penetrationtestservices.com/vulnerabilities/os-command-injection/): OS command injection explained: how it works, real CVEs, how testers prove it with controls, and safe code for Python, Node.js, Java, PHP, Go and C#.
- [Password reset vulnerabilities: how they work, how to test them and how to fix them](https://penetrationtestservices.com/vulnerabilities/password-reset-vulnerabilities/): Password reset vulnerabilities explained: 12 flaws from Host header poisoning to weak tokens, how testers prove each one, a Craft CMS case, and fixes for 5 stacks.
- [Path traversal (directory traversal): how ../ works, how testers prove it, how to fix it](https://penetrationtestservices.com/vulnerabilities/path-traversal/): Path traversal (directory traversal) explained: how ../ escapes a folder, encodings, Zip Slip, safe proof by testers, and fixes in Python, Node.js, Java, Go and PHP.
- [Prototype pollution: how it works, how to find it and how to fix it in Node.js](https://penetrationtestservices.com/vulnerabilities/prototype-pollution/): Prototype pollution explained: how one JSON key changes every object, client and server tests, lodash, minimist and protobufjs CVEs with fixed versions, and tested fixes.
- [Race condition vulnerability: how testers find it and how to fix it](https://penetrationtestservices.com/vulnerabilities/race-conditions/): A web race condition lets parallel requests beat a check. See limit overrun examples, how testers prove it, and fixes in SQL, Django, Node.js and Laravel.
- [Server-side template injection (SSTI): how it works, how testers detect it, how to fix it](https://penetrationtestservices.com/vulnerabilities/server-side-template-injection/): Server-side template injection (SSTI) explained: probe table for 10 template engines, SSTI vs XSS, a real CVE, and safe code for Flask, Express, Spring and Rails.
- [Session fixation: how it works, how to test it and how to fix it](https://penetrationtestservices.com/vulnerabilities/session-fixation/): Session fixation explained: how an attacker plants a session ID, the test that proves it, and the fix for PHP, Express, Django and Spring, plus SSO and JWT cases.
- [SQL injection: how it works, how testers prove it, how to fix it in 7 stacks](https://penetrationtestservices.com/vulnerabilities/sql-injection/): What SQL injection is, a safe demo, real cases with CVE IDs, how testers prove it, and parameterized query fixes for Java, Python, Node.js, PHP, C#, Go and Ruby.
- [Server-side request forgery (SSRF): how it works, how testers prove it, how to fix it](https://penetrationtestservices.com/vulnerabilities/ssrf/): Server-side request forgery (SSRF) explained: how it works, where it hides, how testers prove it with evidence, and allow-list code for Python, Node.js, Java and Go.
- [Stored XSS: how to find it, prove it and fix it](https://penetrationtestservices.com/vulnerabilities/stored-xss/): Stored XSS (persistent cross-site scripting) explained: a worked example, where it hides, how testers prove it with two sessions, severity by viewer, and fixes per stack.
- [Subdomain takeover: how it works, how testers prove it, how to fix dangling DNS](https://penetrationtestservices.com/vulnerabilities/subdomain-takeover/): Subdomain takeover and dangling DNS explained: provider fingerprints, a read-only detection script, real cases, safe proof steps and the order to remove records.
- [2FA bypass: how it works, how pentesters test it and how to fix it](https://penetrationtestservices.com/vulnerabilities/two-factor-authentication-bypass/): 2FA bypass explained: logic flaws such as response tampering and OTP brute force, phishing-class attacks such as MFA fatigue, real CVEs, tests and fixes in 4 stacks.
- [Web cache poisoning: how it works, how testers prove it, how to fix it](https://penetrationtestservices.com/vulnerabilities/web-cache-poisoning/): Web cache poisoning explained: unkeyed inputs, a two-request example, real CVEs, safe proof steps, and cache-key fixes for nginx, Cloudflare and CloudFront.
- [XML external entity (XXE) injection: how it works, how testers prove it, how to fix it](https://penetrationtestservices.com/vulnerabilities/xml-external-entity-xxe/): XML external entity (XXE) injection explained: how it works, hidden attack surface, recent CVEs, safe tests, and parser settings for Java, Python, PHP, .NET and Node.js.

Related guides on the same ground: [IDOR testing](/guides/idor-testing/), [CSRF testing](/guides/csrf-testing/), [business logic vulnerabilities](/guides/business-logic-vulnerabilities/), [rate limiting and credential stuffing](/guides/rate-limiting-and-credential-stuffing/) and the [OWASP Top 10:2025](/guides/owasp-top-10-2025/).