Vulnerability types
Plain-language definitions of the vulnerability types we tag on CVE detail pages — what each one is and what an attacker gains. Each CVE’s type is inferred from its CWE weaknesses (and, for RCE/LPE/DoS, its CVSS vector).
Remote Code Execution (RCE)
An attacker runs their own code on the target over a network, without needing an account. The highest-impact class — usually full compromise of the service.
SQL Injection (SQLi)
Untrusted input is concatenated into a database query, letting an attacker read, modify, or destroy data — and sometimes reach the underlying host.
XML External Entity (XXE)
An XML parser is tricked into fetching external resources, exposing local files, internal services (SSRF), or causing denial of service.
Untrusted Deserialization
The application rebuilds objects from attacker-controlled serialized data, which can trigger code execution or logic abuse depending on the classes available.
Server-Side Request Forgery (SSRF)
The server is coerced into making requests to attacker-chosen destinations, reaching internal services and cloud metadata endpoints the attacker can’t.
OS Command Injection
User input flows into a shell command, letting an attacker run arbitrary operating-system commands with the application’s privileges.
Authentication Bypass
A flaw in the login / session logic lets an attacker act as another user (or an authenticated one) without valid credentials.
Path Traversal
Crafted paths (../) escape the intended directory, letting an attacker read or write files outside it — often config, secrets, or code.
Cross-Site Scripting (XSS)
Attacker-controlled script runs in another user’s browser in the app’s context — stealing sessions, keystrokes, or performing actions as the victim.
Memory-Safety / Overflow
Buffer overflows, out-of-bounds access, and use-after-free corrupt memory, which can crash the program or be steered into code execution.
Local Privilege Escalation (LPE)
An attacker who already has local access raises their privileges — typically to administrator/root — via a privilege-management or permission flaw.
Denial of Service (DoS)
The vulnerability lets an attacker exhaust resources or crash the service, making it unavailable to legitimate users.
Information Disclosure
The application leaks data it shouldn’t — error details, other users’ data, secrets, or internal state — useful on its own or to enable further attacks.
Improper Access Control
Authorization checks are missing or wrong, letting a user reach data or actions that should be restricted to others.
Cross-Site Request Forgery (CSRF)
A victim’s browser is tricked into sending an authenticated state-changing request they didn’t intend.
Cryptographic Weakness
Weak, misused, or missing cryptography — broken algorithms, poor randomness, or unverified certificates — undermines confidentiality or integrity.
Hard-coded / Exposed Credentials
Passwords, keys, or tokens are embedded in the product or exposed, giving anyone who finds them ready-made access.
Open Redirect
The app redirects to an attacker-supplied URL, lending its trusted domain to phishing and token-theft chains.
Race Condition / TOCTOU
A timing gap between check and use lets an attacker slip in a change — corrupting state, escalating privileges, or bypassing a check.