Web Vulnerabilities
SQL Injection (SQLi)
- Mechanism: Direct concatenation of literals or numerals allows user input to be evaluated as code.
- Root Cause: Application languages (e.g., Python) do not parse SQL strings natively, leading to code injection.
- Mitigation: Enforce prepared statements (parameterized queries).
Cross-Site Scripting (XSS) & Rich Text
- Unsanitized HTML in rich text fields allows arbitrary client-side script execution.
- Mitigation: Disable or strip unsafe HTML rendering contexts.