Intel
Payloads
For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.
From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky. The repository.
WeaknessSQL Injection
- Every class
- Cross-site Scripting5
- Cross-Site Request Forgery1
- Open Redirect1
- Server-Side Request Forgery1
- SQL Injection4
- Command and Code Injection7
- Injection and Smuggling10
- Deserialization and Object Injection5
- File and Path Handling5
- Race Conditions1
- Denial of Service1
- Input Validation and Logic1
- Misconfiguration and Insecure Design10
- Cryptography1
- Information Disclosure4
- Authentication4
- Insecure Direct Object Reference1
- Other weaknesses2
4 of 64 topics · 1,085 passages in all
SQL Injection
- SQL Injection186 passages · 149 code blocks
SQL Injection (SQLi) is a type of security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. SQL Injection is one of the most common and severe types of web application vulnerabilities, enabling attackers to execute arbitrary SQL code on…
- GraphQL Injection19 passages · 21 code blocks
GraphQL is a query language for APIs and a runtime for fulfilling those queries with existing data. A GraphQL service is created by defining types and fields on those types, then providing functions for each field on each type
- ORM Leak12 passages · 9 code blocks
An ORM leak vulnerability occurs when sensitive information, such as database structure or user data, is unintentionally exposed due to improper handling of ORM queries. This can happen if the application returns raw error messages, debug information, or allows attackers to manipulate queries in wa…
- NoSQL Injection10 passages · 9 code blocks
NoSQL databases provide looser consistency restrictions than traditional SQL databases. By requiring fewer relational constraints and consistency checks, NoSQL databases often offer performance and scaling benefits. Yet these databases are still potentially vulnerable to injection attacks, even if…
Data as of 2026-11-14.