Malicious file upload and unsafe deserialization
An application accepts or processes a malicious file or serialized object and enables code execution, control bypass, or compromise of other users.
Shadow and zombie APIs without managed inventory
Unknown, forgotten, or outdated API versions remain reachable without current controls, ownership, documentation, and monitoring.
SSRF – Server-Side Request Forgery
An adversary causes a server or API to fetch an attacker-controlled address and reaches internal services, cloud metadata, or protected network targets.
Ransomware and availability impact
An adversary encrypts or manipulates data, stops services, inhibits recovery, and creates operational impact.
Reconnaissance and attack surface mapping
An adversary collects information about people, systems, cloud services, and internet-facing infrastructure and searches for a viable initial-access path.