What are the most common web - application vulnerabilities and how can you detect them?

Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.

Key takeaways

• The ten most frequent web - app flaws are documented by Rapid7 and the OWASP Top 10 2025.
• Each flaw has a concrete detection method you can run with a free Decloak scan (core layers 1 - 8).
• Fixes focus on input validation, proper access checks, and keeping libraries up to date.

What are the ten most common web - application vulnerabilities?

The short answer is SQL injection, cross - site scripting, cross - site request forgery, broken access control, insecure deserialization, security mis - configuration, sensitive data exposure, server - side request forgery, path traversal and open redirect. The list combines Rapid7’s classic examples with the latest OWASP Top 10 2025 categories.

How does SQL injection work and how can I spot it?

SQL injection occurs when untrusted input is concatenated into a database query without proper escaping, allowing an attacker to run arbitrary SQL. To detect it, look for query strings that include user - controlled parameters and test them with typical payloads (e.g., ' OR '1'='1). Decloak’s free scan runs Layer 4 JavaScript CVE checks that flag outdated database libraries and Layer 1 HTTP/TLS checks that highlight missing parameter sanitisation warnings.

Remediation steps

1. Use prepared statements or ORM query builders.
2. Validate input against a whitelist of allowed characters.
3. Enable database - level query logging to catch unexpected statements.

Why is cross - site scripting (XSS) dangerous and how can I detect it?

XSS injects malicious scripts into a page that runs in the victim’s browser, stealing cookies or performing actions on behalf of the user. Detection methods include scanning for innerHTML, document.write or eval calls that incorporate unsanitised data. Decloak’s Layer 4 scanner flags the presence of dangerous code patterns such as eval() and unescaped innerHTML sinks.

Remediation steps

1. Encode output based on context (HTML, JavaScript, URL).
2. Adopt a content security policy that restricts script sources.
3. Remove unnecessary dynamic script generation.

How can I recognize cross - site request forgery (CSRF) and prevent it?

CSRF tricks a logged - in user into sending a forged request to the target site. Look for state - changing HTTP methods (POST, PUT, DELETE) that lack anti - CSRF tokens or SameSite cookie attributes. Decloak’s Layer 1 checks report missing SameSite flags and Layer 7 vibe - coded platform security highlights frameworks that do not enforce CSRF protection by default.

Remediation steps

1. Require anti - CSRF tokens for all state - changing requests.
2. Set cookies with SameSite=Lax or Strict.
3. Verify the Origin or Referer header on sensitive endpoints.

What is broken access control and how do I know if it exists?

Broken access control means the application fails to enforce permission checks, allowing users to access or modify data they shouldn’t. Typical signs are IDOR (insecure direct object references) and overly permissive CORS policies. Decloak’s Layer 7 platform fingerprinting flags common misconfigurations for builders such as Supabase, Bubble and Next.js, while Layer 1 reports CORS headers that are too open.

Remediation steps

1. Enforce authorization checks on every backend endpoint.
2. Use role - based access control with least - privilege defaults.
3. Restrict CORS to trusted origins only.

How does insecure deserialization lead to remote code execution?

When an application deserialises data from an untrusted source without validation, an attacker can craft objects that execute arbitrary code. Detection includes searching for common deserialization libraries (e.g., java.io.ObjectInputStream, pickle in Python) and checking for lack of integrity checks. Decloak’s Layer 4 flags known vulnerable deserialization libraries as part of its CVE database.

Remediation steps

1. Avoid deserialising untrusted data whenever possible.
2. If required, use signed tokens or integrity checks.
3. Keep deserialization libraries up to date.

What counts as security mis - configuration and how can I find it?

Security mis - configuration covers default credentials, unnecessary services, outdated software and permissive settings such as open X - Frame - Options. Layer 1 of a free Decloak scan evaluates HTTP headers, TLS settings and server banners for common mis - configurations. Layer 7 adds platform - specific checks for things like exposed Supabase service_role keys.

Remediation steps

1. Harden server configuration files (e.g., disable directory listing).
2. Change default passwords and remove unused services.
3. Apply security - focused HTTP headers (X - Content - Type - Options, X - Frame - Options).

Why does sensitive data exposure happen and how can I verify my protection?

Sensitive data exposure occurs when data at rest or in transit is stored or transmitted without strong encryption. Look for missing Strict - Transport - Security headers, weak cipher suites, or plaintext storage of passwords. Decloak’s Layer 1 TLS posture check reports weak ciphers and missing HSTS, while Layer 2 static HTML analysis can spot hard - coded secrets in page source.

Remediation steps

1. Enforce HTTPS with strong TLS 1.2/1.3 cipher suites.
2. Hash passwords with a modern algorithm (e.g., Argon2).
3. Encrypt any stored PII or credit - card data.

How can I detect server - side request forgery (SSRF) and stop it?

SSRF forces the server to make HTTP requests to internal resources, potentially exposing internal APIs. Detection includes scanning for URL parameters that are fetched server - side without validation. Decloak’s Layer 7 platform checks flag known SSRF - prone patterns in popular frameworks.

Remediation steps

1. Validate and whitelist outbound URLs.
2. Use network - level egress filtering.
3. Disable unnecessary DNS resolution features.

What is path traversal and how do I test for it?

Path traversal lets an attacker read or write files outside the intended directory by manipulating file - path inputs (e.g., ../). Look for endpoints that accept file names and test with payloads such as ../../etc/passwd. Decloak’s Layer 4 scans for common vulnerable file - handling functions in JavaScript and reports them.

Remediation steps

1. Normalize and validate file - path inputs against a whitelist.
2. Run file operations with least - privilege OS permissions.
3. Avoid exposing file system paths in URLs.

Why are open redirects a problem and how can I identify them?

Open redirects use a user - controlled URL parameter to forward visitors to an arbitrary site, facilitating phishing. Detection involves finding redirect endpoints and testing with external URLs. Decloak’s Layer 4 flags window.location assignments that use unsanitised query parameters.

Remediation steps

1. Validate redirect targets against an allow - list.
2. Use relative paths instead of full URLs where possible.
3. Log and monitor unexpected redirect attempts.

How does a free Decloak scan help me verify these vulnerabilities?

A free Decloak scan runs eight core layers in about 15 seconds and returns a graded report with evidence for each finding. Layers 1 - 3 cover HTTP/TLS posture, static HTML and rendered network behaviour, while Layer 4 finds vulnerable JavaScript libraries and dangerous code patterns. Layer 7 detects platform - specific misconfigurations such as exposed Supabase service_role keys. The report includes an AI - written executive summary and a table mapping each finding to the relevant OWASP Top 10 2025 sub - category, making remediation prioritisation straightforward.

Quick comparison of detection methods

Final thoughts

Understanding the concrete manifestations of each web - app flaw lets you focus scanning and remediation efforts. A quick free Decloak scan gives you immediate evidence for many of these issues, and the graded report helps you prioritize fixes before they can be exploited.