Vulnerability Glossary
Plain-language reference for common web vulnerabilities — what each one is, why it's a risk, and how to detect and fix it.
A vulnerability scan is only as useful as your ability to act on it. Each entry in this glossary explains one web vulnerability in plain language: what it is, how attackers exploit it, how to confirm it on your own site, and the exact fix — with copy-paste configuration for nginx and Apache. No theory for its own sake, just what you need to recognize an issue in a report and close it.
Use it to triage a scan, harden a server, or learn the OWASP categories without wading through dense specs. Entries are short and practical, and each one links to the related issues it commonly appears alongside. New terms are added as Exploita's scanner learns to detect more issues — every entry maps to something the scanner actually checks for on a live site.
Entries are tagged by severity — the risk an issue typically carries if left unfixed. Critical and high issues can lead directly to compromise, account takeover, or data exposure; medium issues weaken your defenses or leak information that helps an attacker; low issues are best-practice hardening that closes the gaps before they matter. Browse by severity below, or run a full scan to see which of these actually affect your site.
Insecure Deserialization
Insecure deserialization is a flaw where an application rebuilds objects from attacker-controlled bytes, letting the runtime instantiate classes and run code paths the attacker chose. Because reconstruction executes real methods, it can escalate to remote code execution when a usable gadget chain exists in the installed dependencies.
Subdomain Takeover
A subdomain takeover is when a DNS record (usually a CNAME) still points at a third-party service whose resource has been deleted or was never claimed, letting anyone who registers that name on the provider serve their own content on your hostname.
TLS 1.0 Deprecated
TLS 1.0 is deprecated: the 1999 protocol version was formally retired by RFC 8996 in 2021 and banned by PCI DSS in 2018. A server that still accepts it exposes connections to known downgrade and cipher attacks, and fails most compliance audits.
Weak Cipher Suites
Weak cipher suites are TLS encryption negotiation options that use broken or outdated algorithms (RC4, 3DES, export-grade, NULL/anonymous), allowing attackers to decrypt, downgrade, or tamper with HTTPS traffic.
Web Cache Poisoning
Web cache poisoning is an attack in which a crafted request makes a shared cache (CDN, reverse proxy, Varnish) store a malicious response and then serve it to every other user requesting that URL. It happens when a request header influences the response but is not part of the cache key.
Clickjacking
Clickjacking is a UI redressing attack where an attacker loads your site in a transparent iframe over a decoy page, so users think they're clicking the attacker's content while actually clicking buttons on yours.
CRLF Injection
CRLF injection is a flaw where user input containing carriage return (%0D) and line feed (%0A) bytes is written into an HTTP response header, letting an attacker add their own headers or — with a doubled CRLF — end the header block and control what is parsed as the response body (HTTP response splitting).
Directory Listing Vulnerability
A directory listing vulnerability occurs when a web server returns an auto-generated index of files for a folder that has no index page, exposing file names, backups, and structure that should stay private.
Expired SSL Certificate
An expired SSL certificate is a TLS certificate whose notAfter date has passed, so browsers and API clients refuse the connection outright. Traffic to it would still be encrypted, but the certificate no longer proves the server's identity — TLS without authentication is not secure transport.
Insecure Cookies (Missing Secure & HttpOnly)
Insecure cookies are session or authentication cookies set without the Secure and/or HttpOnly attributes, so they can be captured over plain HTTP by a network attacker or read by malicious JavaScript through any XSS flaw.
Missing SameSite Cookie Attribute
A missing SameSite cookie attribute means a cookie has no SameSite flag in its Set-Cookie header, so browsers may send it on cross-site requests and open the door to CSRF.
Missing Subresource Integrity (SRI)
Missing Subresource Integrity (SRI) means an external script or stylesheet is loaded from a third-party CDN with no integrity hash, so a compromised or hijacked CDN can serve modified JavaScript that runs with full access to your page.
Mixed Content
Mixed content is when a page served over HTTPS loads sub-resources (scripts, styles, images, fonts, or iframes) over plain HTTP, breaking the page's encryption guarantees.
Open Redirect
An open redirect is a flaw where your app sends users to a URL taken from user-controlled input (like ?url= or ?next=) without validating it, letting attackers redirect visitors from your trusted domain to a malicious site.
SSL Certificate Name Mismatch
An SSL certificate name mismatch happens when the certificate a server presents does not list the requested hostname in its Subject Alternative Name (SAN) set. The connection is still encrypted, but the client cannot verify it is talking to the right server, so browsers show a full-page trust warning.
Username Enumeration
Username enumeration is an information-disclosure flaw where an app's response — its wording, status code, or timing — reveals whether a given account exists. It doesn't grant access by itself, but it hands attackers a verified list of valid accounts for credential stuffing and targeted phishing.
Autocomplete on Sensitive Form Fields
Autocomplete on sensitive form fields is a scanner finding raised when inputs like passwords or card numbers allow browser autofill. It's a low-severity, often-contested flag whose real fix is setting the correct autocomplete tokens per field, not disabling autofill wholesale.
HTTP TRACE Method Enabled
HTTP TRACE method enabled means your web server answers TRACE requests by echoing the received request back to the client (a loopback). It's a low-severity OWASP A05 security misconfiguration that scanners and auditors still flag, historically tied to Cross-Site Tracing (XST).
MIME Sniffing (Missing X-Content-Type-Options)
MIME sniffing is when a browser ignores the server's declared Content-Type and guesses the type from the response bytes. A missing X-Content-Type-Options: nosniff header allows it, which can let a mislabeled response be executed as script in your origin.
Missing Referrer-Policy
A missing Referrer-Policy header means the browser uses its default referrer behavior, which can leak the full URL of your pages — including paths, query parameters, and tokens — to third-party sites via the Referer header.
Server Version Disclosure
Server version disclosure is when a web server reveals its exact software and version in response headers like Server or X-Powered-By, handing attackers a shortcut to matching CVEs during reconnaissance.
WordPress User Enumeration
WordPress user enumeration is the disclosure of valid login names to anonymous visitors through core surfaces like the /wp-json/wp/v2/users REST route, ?author=N redirects and the core user sitemap. Because a WordPress username is also the login name, it hands an attacker half of every credential pair.
These entries explain individual vulnerabilities. To find which ones actually affect your site — verified with proof, not guesswork — run a full scan with Exploita's AI-powered scanner.
Run a Full Vulnerability Scan