- Second-order SQL injection through stored profile fields A value that is escaped on insert but concatenated on later use is injectable when the app reads it back into a raw query.
- HTTP/2 to HTTP/1 downgrade request smuggling Front ends that translate HTTP/2 to HTTP/1 can be desynced by smuggling a Content-Length or CRLF the rewriter trusts.
- Client-side prototype pollution to DOM XSS A polluted prototype property read by a sink like a template loader or script src becomes reliable XSS without any server bug.
- WebSocket cross-site hijacking WebSocket handshakes that rely only on cookies and skip origin checks can be opened from any site and driven with the victim's session.
- OAuth account takeover via redirect_uri and response_type juggling Loose redirect_uri matching or switching to the token response type can leak the code or access token to an attacker-controlled URL.
- Chain PHP filter wrappers to read source and reach RCE A local file include on a PHP target can leak source via base64 and, with the iconv filter chain, generate arbitrary bytes for code execution.
- Reflected CORS with credentials for data theft An origin-reflecting ACAO plus allow-credentials lets any site read authenticated API responses in the victim's browser.
- Mass assignment to escalate your own role Endpoints that bind the whole request body to a model often accept fields the UI never sends, like role or isAdmin.
- NoSQL operator injection for auth bypass When JSON bodies flow into a Mongo query unfiltered, operator objects turn a login into an always-true match.
- Server-side prototype pollution to RCE in Node A polluted Object.prototype can inject options into a later child_process call, turning a merge bug into command execution.