The UnboundCompute blog
Writing on web security
-
What is CSV injection (formula injection)?
CSV injection turns stored user text into live spreadsheet formulas on export. Learn how formula injection works, how to detect it, and…
-
What is an open redirect vulnerability?
An open redirect vulnerability lets an attacker forward users from a trusted site to a malicious one. Learn how it works, why…
-
What is path traversal?
Learn how a path traversal bug turns a file parameter into a read of your secrets and source code, and the exact…
-
What is prototype pollution?
Learn what prototype pollution is, how a single JSON write poisons Object.prototype, why it leaks into other objects, and how to detect…
-
What is CSRF (cross site request forgery)?
A csrf attack tricks a logged in browser into sending a request the user never meant. Learn how it works, what makes…
-
What is insecure deserialization?
Insecure deserialization explained from zero: how rebuilding objects from untrusted bytes leads to tampering and code execution, and how to prevent it.
-
What is XXE injection and how does it work?
Learn how xxe injection works from zero: XML, DTDs, external entities, file reads, SSRF, blind and out of band leaks, and the…
-
What is SSRF? Server Side Request Forgery Explained
Server side request forgery (SSRF) lets an attacker make your server send requests for them. Learn how SSRF works, why it is…
-
Web and API Security Glossary: Vulnerabilities and Terms Explained
A plain language glossary of web application vulnerabilities and security terms, from XSS and IDOR to SSRF and business logic flaws. Built…
-
Why we only report proven vulnerabilities
We use vulnerability verification to prove a bug is real and exploitable before we report it, so your team gets signal, not…