These are some of the vulnerabilities most often found when websites are scanned. Developers should plan to prevent each of them from the start of a project.

1. SQL injection

An attacker uses application input to change a database query. If successful, they can read, create, change or delete data in the database. SQL injection remains one of the most damaging web vulnerabilities.

2. Cross-site scripting (XSS)

XSS targets an application's users. The attacker gets their own script, usually JavaScript, into the application's output so that it runs in the victim's browser. It can be used to hijack sessions, deface pages or redirect users to malicious sites.

3. Broken authentication and session management

These issues all relate to maintaining a user's identity. If credentials and session identifiers are not protected at all times, an attacker can hijack an active session and act as that user.

4. Insecure direct object references

The application exposes a reference to an internal object, such as a file, a database record or a key, in a URL or parameter. If the server does not check permissions, an attacker can change the reference to access other users' data.

5. Security misconfiguration

Several types of vulnerability that come from a lack of attention to configuration. A secure configuration must be defined and deployed for the application, frameworks, application server, web server, database server and platform. Misconfiguration can expose private data or features and lead to a full system compromise.

6. Cross-site request forgery (CSRF)

A user is tricked into performing an action they did not intend. Another website sends a request to an application where the user is already logged in, such as their bank, and the browser attaches the user's session automatically. Targets include social media, webmail, online banking and the web interfaces of network devices.

What to do about them

• Scan your websites regularly with a web vulnerability scanner to find these issues.
• Fix the findings, starting with the most severe, and retest each fix.
• Train developers on how each vulnerability arises, so new code avoids them.

How Vooki Pro helps

• Scans for all the common website vulnerabilities in one run: injection, XSS, access control, authentication, misconfiguration and more.
• Checks outdated software against a CVE database of more than 10,000 entries.
• Gives every finding a severity, CVSS score, evidence and remediation.

Frequently asked questions

What is the most common website vulnerability?

Injection flaws, cross-site scripting and security misconfigurations (such as missing headers) are among the most frequently found.

How do I check my website for vulnerabilities?

Run an authenticated DAST scan, review the findings by severity, fix, and retest.

Related: What is DAST (dynamic application security testing)? · HTTP security headers: the essential list