Web-Application-Security

Command Injection is a vulnerability that allows attackers to execute arbitrary operating system commands by manipulating application input. This SECMONS glossary entry explains how command injection works, its impact, how it differs from SQL injection, and how defenders can prevent it.

File Inclusion vulnerabilities, including Local File Inclusion (LFI) and Remote File Inclusion (RFI), allow attackers to include unintended files in application execution flow. This SECMONS glossary entry explains how file inclusion works, how it differs from path traversal, and how defenders should mitigate it.

Insecure Direct Object Reference (IDOR) is an access control vulnerability where an application exposes internal object references without proper authorization checks. This SECMONS glossary entry explains how IDOR works, real-world impact, and how defenders should prevent and detect it.

Path Traversal, also known as Directory Traversal, is a vulnerability that allows attackers to access files and directories outside the intended application root. This SECMONS glossary entry explains how path traversal works, its impact, and how defenders should prevent and detect it.

SQL Injection (SQLi) is a vulnerability that allows attackers to manipulate database queries by injecting malicious input into application fields. This SECMONS glossary entry explains how SQL injection works, common impact scenarios, and how defenders should mitigate and detect it.