Loading...
Loading...
Analyze vulnerable code snippets, understand the flaws, and learn how to write secure code.
Showing 25 of 25 snippets
python
A classic SQL injection vulnerability in a login function that allows attackers to bypass authentication.
javascript
User input is reflected back in the page without proper sanitization, allowing script injection.
javascript
Direct object reference allows accessing other users' profiles by changing the ID parameter.
javascript
Server-side request forgery through unvalidated URL fetching for link previews.
python
Using MD5 for password hashing provides inadequate security against modern attacks.
python
User input is passed directly to system commands without sanitization.
javascript
File path from user input allows directory traversal to access unauthorized files.
javascript
JWT verification accepts "none" algorithm, allowing tokens to be forged.
python
Dynamic column sorting vulnerable to SQL injection through ORDER BY clause.
python
Stored input is later used unsafely in a different query context.
javascript
User comments are stored and displayed to all users without sanitization.
javascript
Client-side JavaScript processes URL fragment unsafely.
python
Image proxy fetches user-provided URLs without validation.
javascript
API endpoint exposes internal object IDs without access control.
python
XML External Entity vulnerability allowing file disclosure through unsafe XML parsing.
python
Directory traversal vulnerability allowing unauthorized file access through path manipulation.
javascript
Unvalidated redirect vulnerability allowing phishing attacks through malicious URLs.
python
Predictable session token generation using weak random number generator.
python
Insecure deserialization allowing arbitrary code execution through crafted pickle payloads.
javascript
Advanced SSRF attack using DNS rebinding to bypass IP-based blocklists.
javascript
Authorization bypass by modifying JWT claims when signature is not properly validated.
python
Simple command injection through unsanitized user input in shell commands.
python
Bypassing weak command injection filters using encoding and alternative syntax.
javascript
Incomplete path sanitization that can be bypassed with double encoding or nested sequences.
python
Bypassing path traversal filters using double URL encoding.