A banking app's login form runs the query SELECT * FROM users WHERE u='" + input + "'. An attacker types admin' -- in the username field and is logged in as admin with no password. Which category?

A patient portal lets logged-in users view records at URLs like /records/5821. A user discovers that changing the URL to /records/5822 returns another patient's full history. Authentication works correctly — only logged-in users can reach the page. Which category?

A company discovers that its application debug logs — shipped to a third-party SaaS monitoring service — contain full HTTP request bodies. This includes passwords from login forms and credit card numbers from checkout. No one has been hacked yet. Which category best describes this finding?

An attacker obtains a valid session cookie by sniffing unencrypted Wi-Fi at a coffee shop. They paste the cookie into their own browser and are logged in as the victim, with full access to the victim's account. No password was ever exposed. Which primary category applies to the session-cookie theft itself?

A 2017 breach exposed 147 million records when attackers exploited a two-month-old unpatched vulnerability in an Apache Struts framework the company was using. Which OWASP category most directly describes the failure that allowed the breach?

A data breach releases a company's user database. Within 24 hours, plaintext passwords from millions of accounts appear on a forum. Investigators find the database stored passwords using MD5 hashing with no salt. Which category applies to the password exposure?

An attacker submits this comment on a blog: . Every future visitor who views the comment unknowingly sends their session cookie to the attacker. Which category applies to the attack itself?

During a penetration test, consultants find a production server's admin panel is accessible on a public IP address. The panel accepts the default credentials admin / admin that were never changed since deployment. Which category most directly applies?