12 website vulnerabilities that cause real breaches

Behind almost every headline breach is a mundane web vulnerability that someone could have found with a scan. Here are the twelve that matter most — the exact classes Web Iron Shield actively tests for — with what each one is, how attackers use it, and its typical severity.

1. SQL injection CRITICAL

When a form field or URL parameter is passed straight into a database query, an attacker can rewrite that query — reading every user record, dumping password hashes, or deleting tables. It's decades old and still one of the most damaging bugs on the web. A scanner finds it by sending crafted input and watching for database errors or changed responses.

2. Cross-site scripting (XSS) HIGH

If your site reflects user input back into the page without escaping it, an attacker can inject JavaScript that runs in your visitors' browsers — stealing sessions, harvesting keystrokes, or defacing pages. Reflected, stored, and DOM-based variants all get tested.

3. Exposed .env and .git files CRITICAL

A single .env file left in a public folder can hand over your database password, mail credentials, and API keys in one request. An exposed .git directory can leak your entire source code. These are pure configuration mistakes — and among the fastest wins a scan delivers.

4. Leaked API keys CRITICAL

Hard-coded AWS, Google, Stripe, or AI-provider keys in your front-end JavaScript or exposed files are money and data waiting to be stolen. Web Iron Shield fingerprints the tell-tale patterns of leaked keys across your pages and assets.

5. Server-side request forgery (SSRF) HIGH

If your server fetches URLs a user controls, an attacker can point it at internal services or cloud metadata endpoints — a common path to full cloud compromise. Tested by supplying attacker-controlled destinations and watching where the server goes.

6. Command injection CRITICAL

When user input reaches a system shell, an attacker can run arbitrary commands on your server. Full takeover. Rare but catastrophic, so it's tested carefully and safely.

7. Path traversal HIGH

Manipulating a file parameter with sequences like ../../ can let an attacker read files outside the web root — configs, credentials, even system files.

8. Server-side template injection (SSTI) HIGH

When user input is rendered by a template engine, it can be coerced into executing code on the server. Increasingly common as apps lean on templating for everything.

9. XML external entity (XXE) HIGH

Endpoints that parse XML can be tricked into reading local files or making server-side requests through malicious entity definitions.

10. Weak JWT configuration MEDIUM

JSON Web Tokens with alg=none, weak signing secrets, or missing expiry let attackers forge their own tokens and impersonate any user. Tested by inspecting how your tokens are signed and validated.

11. IDOR — insecure direct object references HIGH

If changing an ID in a URL (/invoice?id=1001 → 1002) shows you someone else's data, that's IDOR — broken access control, and behind a huge share of data-exposure incidents.

12. Open redirect, CORS & host header issues MEDIUM

The quieter three: open redirects power convincing phishing links, permissive CORS lets hostile sites read your authenticated responses, and host header injection can poison caches and password-reset links. Individually medium; together, real risk.

Find yours before an attacker does

Every vulnerability above is discoverable with a scan of your own site. That's the entire point of running one: the attacker's checklist and your checklist are the same list — so get to it first. Web Iron Shield runs all twelve tests plus OWASP Top 10, exposed-file, leaked-key and CVE checks in a single pass, and hands you a fix for each finding.