Dark Byte Logo DARK BYTE SOLUTIONS
Home Services Hacktivity VRT FAQ Terms & Conditions Privacy Policy Refund Policy Contact Hacker Sign In Company Sign In
DarkByte VRT

Vulnerability Rating Taxonomy

A DarkByte Solutions classification framework for prioritizing vulnerability reports across bug bounty, vulnerability disclosure, and security testing workflows.

DarkByte Taxonomy Table

Priority, category, vulnerability type, and variant mapping in a structured table format.

Critical High Medium Low Informational
Priority ↕
VRT Category ↕
Specific Vulnerability Name ↕
Variant / Affected Function ↕
Critical
AI Application Security
Large Language Model (LLM) Security
Prompt Injection
Critical
AI Application Security
Large Language Model (LLM) Security
Training Data Poisoning
Critical
AI Application Security
Large Language Model (LLM) Security
Model Output Leakage
Critical
AI Application Security
Agentic Security
Tool Invocation Abuse
Critical
AI Application Security
Model Access Control Failure
Unauthorized Model Use
Critical
Broken Access Control (BAC)
Insecure Direct Object Reference (IDOR)
Modify/View Sensitive Information
Critical
Broken Access Control (BAC)
Privilege Escalation
Administrative Function Abuse
Critical
Broken Access Control (BAC)
Tenant Isolation Failure
Cross-Tenant Administrative Access
Critical
Broken Authentication & Session
Authentication Bypass
Direct Account Access
Critical
Broken Authentication & Session
Session Hijacking
Sensitive Account Takeover
Critical
Broken Authentication & Session
Password Reset Takeover
No Verification or Token Abuse
Critical
Injection
SQL Injection
Direct Database Extraction
Critical
Injection
SQL Injection
Write / Delete / Modify Database Content
Critical
Injection
Command Injection
Remote Code Execution
Critical
Injection
Server-Side Template Injection
Template to Code Execution
Critical
Injection
Expression Language Injection
Application Server Code Execution
Critical
API Security
Broken Object Level Authorization
Cross-Tenant Sensitive Access
Critical
API Security
Mass Assignment
Privilege Abuse Through Hidden Parameters
Critical
API Security
Server-Side Request Forgery (SSRF)
Internal Service Access
Critical
API Security
GraphQL Authorization Failure
Sensitive Object Enumeration
Critical
Cloud & Storage
Public Bucket Exposure
Sensitive Production Data Disclosure
Critical
Cloud & Storage
Instance Metadata Access
Credential Theft from Cloud Metadata
Critical
Business Logic
Payment Logic Abuse
Unauthorized Price or Payment Manipulation
Critical
Business Logic
Account Linking Abuse
Takeover Through Trust Flow Weakness
Critical
Sensitive Data Exposure
Credential Disclosure
Production Secret / API Key Exposure
Critical
Sensitive Data Exposure
Backup Disclosure
Production Database Backup Exposure
Critical
File Handling
Arbitrary File Upload
Executable Upload or Processing Abuse
Critical
File Handling
Path Traversal
Arbitrary Sensitive File Read
Critical
Deserialization
Insecure Deserialization
Remote Code Execution
Critical
Cryptography
Improper Signature Validation
Authentication Trust Bypass
Critical
Automotive Security Misconfiguration
RF Hub
Key Fob Cloning
Critical
Automotive Security Misconfiguration
Infotainment / Head Unit
Sensitive Vehicle Data Exposure
High
AI Application Security
Improper Output Handling
Malicious Prompt Response Rendering
High
AI Application Security
Vector & Embedding Weaknesses
Unauthorized Retrieval Exposure
High
AI Application Security
Prompt Context Leakage
Sensitive Instruction Disclosure
High
Broken Access Control (BAC)
Insecure Direct Object Reference (IDOR)
View Non-Public Records
High
Broken Access Control (BAC)
Role Misconfiguration
Unauthorized Management Actions
High
Broken Access Control (BAC)
Horizontal Privilege Escalation
Peer Account Access
High
Broken Access Control (BAC)
Vertical Privilege Escalation
Moderator or Staff Function Access
High
Broken Authentication & Session
Weak Password Reset
Token Reuse or Reset Takeover
High
Broken Authentication & Session
Missing MFA Controls
High-Privilege Account Exposure
High
Broken Authentication & Session
JWT Validation Weakness
Token Forgery or Trust Abuse
High
Broken Authentication & Session
OAuth Misconfiguration
Improper Trust Flow
High
Client-Side Security
Stored Cross-Site Scripting (XSS)
Admin Panel Impact
High
Client-Side Security
DOM XSS
High-Privilege User Context
High
Client-Side Security
HTML Injection
Trusted UI Manipulation
High
Injection
NoSQL Injection
Unauthorized Data Enumeration
High
Injection
LDAP Injection
Directory Enumeration / Auth Impact
High
Injection
XPath Injection
Sensitive Query Manipulation
High
Injection
CRLF Injection
Response Splitting / Header Injection
High
API Security
Broken Function Level Authorization
Restricted Endpoint Abuse
High
API Security
Excessive Data Exposure
Sensitive API Response Leakage
High
API Security
Improper Rate Limiting
Credential Stuffing or Brute Force Enablement
High
API Security
Improper Asset Management
Exposed Deprecated Sensitive Endpoint
High
File Handling
Arbitrary File Upload
Malicious Document or Stored Payload Upload
High
File Handling
Reflected File Download
Victim-Side File Abuse
High
Sensitive Data Exposure
Sensitive Report Disclosure
Internal PII Exposure
High
Sensitive Data Exposure
Source Code Disclosure
Sensitive Application Logic Exposure
High
Sensitive Data Exposure
Environment File Exposure
Secret Leakage
High
Cloud & Storage
Container Misconfiguration
Sensitive Runtime Secret Exposure
High
Cloud & Storage
IAM Misconfiguration
Excessive Role Permissions
High
Cloud & Storage
Kubernetes Dashboard Exposure
Administrative Cluster Access
High
Mobile Security
Improper Certificate Validation
MITM Against Mobile App Traffic
High
Mobile Security
Hardcoded Secrets
Production Key Extraction
High
Business Logic
Workflow Bypass
Approval or Security Gate Circumvention
High
Business Logic
Race Condition
Repeatable State Manipulation with Impact
High
Business Logic
Gift Card / Balance Abuse
Repeatable Monetary Impact
High
Business Logic
Invitation Abuse
Unauthorized Access to Restricted Resources
High
Cryptography
Weak Token Construction
Predictable Token Abuse
High
Email Security
Email Spoofing
Trusted Communication Impersonation
High
Infrastructure Security
Admin Panel Exposure
Unauthenticated Sensitive Access
High
Server Security
Server-Side Request Forgery (SSRF)
Credential or Service Discovery
Medium
AI Application Security
Output Sanitization Weakness
Unsafe Rendering with Limited Impact
Medium
AI Application Security
Model Enumeration
Feature Discovery Through Weak Responses
Medium
Broken Access Control (BAC)
Insecure Direct Object Reference (IDOR)
Access to Low-Sensitivity Data
Medium
Broken Access Control (BAC)
Object Enumeration
Sequential Resource Discovery
Medium
Broken Access Control (BAC)
Export Authorization Weakness
Unauthorized Report Download
Medium
Broken Authentication & Session
Session Fixation
Login Flow Weakness
Medium
Broken Authentication & Session
Verbose Authentication Errors
User Enumeration
Medium
Broken Authentication & Session
Weak Logout
Session Not Properly Invalidated
Medium
Broken Authentication & Session
Username Enumeration
Account Discovery
Medium
Client-Side Security
Reflected Cross-Site Scripting (XSS)
Non-Privileged User Impact
Medium
Client-Side Security
Clickjacking
Sensitive Action UI Redress
Medium
Client-Side Security
Open Redirect
Trusted Redirect Flow Abuse
Medium
Client-Side Security
Tabnabbing
User Navigation Context Abuse
Medium
Injection
CSV Injection
Client-Side Formula Execution
Medium
Injection
Server Side Include Injection
Unexpected Server Parsing
Medium
Injection
Template Injection
Limited Expression Abuse
Medium
API Security
Weak Input Validation
Unexpected Backend Behavior
Medium
API Security
Improper Pagination Controls
Mass Resource Enumeration
Medium
API Security
GraphQL Introspection Exposure
Schema Enumeration
Medium
API Security
Improper CORS Policy
Cross-Origin Data Access Conditions
Medium
Sensitive Data Exposure
Metadata Disclosure
Internal System Information Leak
Medium
Sensitive Data Exposure
Stack Trace Disclosure
Framework & Path Exposure
Medium
Sensitive Data Exposure
Token Leakage in URL
Session Exposure via Logs or Referrers
Medium
Sensitive Data Exposure
Error Message Leakage
Internal Query / Config Information
Medium
File Handling
Path Traversal
Limited File Read
Medium
File Handling
Unsafe Export
Sensitive Report Download Exposure
Medium
File Handling
File Parsing Abuse
Backend Processing Weakness
Medium
Cloud & Storage
Public Snapshot Exposure
Recoverable Historical Data Exposure
Medium
Cloud & Storage
Weak Object ACLs
Limited Internal Asset Listing
Medium
Mobile Security
Insecure Local Storage
Sensitive Data at Rest Exposure
Medium
Mobile Security
Improper WebView Controls
Untrusted Content Loading
Medium
Mobile Security
Exported Component Abuse
App-Level Authorization Weakness
Medium
Security Misconfiguration
Debug Mode Enabled
Operational Information Disclosure
Medium
Security Misconfiguration
Directory Listing
Sensitive File Enumeration
Medium
Security Misconfiguration
Default Credentials
Low-Barrier Administrative Risk
Medium
Security Misconfiguration
Weak CORS Rules
Cross-Origin Abuse Conditions
Medium
Business Logic
Coupon / Credit Abuse
Repeatable Business Workflow Manipulation
Medium
Business Logic
Registration Flow Weakness
Improper Account State Creation
Medium
Business Logic
Order Workflow Abuse
Unexpected State Changes
Medium
Cryptography
Weak Encryption in Transit
Sensitive Data Readability Under Specific Conditions
Medium
Email Security
Email Header Injection
Mail Workflow Manipulation
Medium
Infrastructure Security
Subdomain Takeover
Dormant Asset Reuse with Impact
Medium
Availability & Abuse
Resource Exhaustion
Moderate Service Disruption
Low
AI Application Security
Model Metadata Disclosure
Version or Configuration Detail Exposure
Low
Broken Authentication & Session
Weak Password Policy
Insufficient Complexity Controls
Low
Broken Authentication & Session
Password Length Weakness
Insufficient Authentication Hygiene
Low
Broken Authentication & Session
No Account Lockout
Brute Force Friction Weakness
Low
Client-Side Security
Missing Content Security Policy
Defense-in-Depth Weakness
Low
Client-Side Security
Autocomplete on Sensitive Fields
Local Browser Exposure
Low
Client-Side Security
Missing Frame Ancestors Restriction
Clickjacking Mitigation Absent
Low
Client-Side Security
Cross-Origin Resource Policy Weakness
Browser Isolation Hardening Gap
Low
Injection
Host Header Injection
Non-Critical Upstream Routing Impact
Low
Injection
Parameter Pollution
Unexpected Duplicate Parameter Handling
Low
Sensitive Data Exposure
Email Address Disclosure
Limited Contact Information Exposure
Low
Sensitive Data Exposure
Username Disclosure
Low-Sensitivity Identity Exposure
Low
Sensitive Data Exposure
Cache Exposure
Non-Sensitive Historic Response Access
Low
File Handling
Filename Disclosure
Internal Naming Convention Leak
Low
Cloud & Storage
Public Asset Listing
Non-Sensitive Static Resource Enumeration
Low
Mobile Security
Debuggable App Build
Reverse Engineering Ease
Low
Security Misconfiguration
Version Disclosure
Technology Fingerprinting
Low
Security Misconfiguration
Missing Security Headers
Browser Hardening Weakness
Low
Security Misconfiguration
Server Banner Disclosure
Service Fingerprinting
Low
Security Misconfiguration
Weak TLS Configuration
Legacy Cipher Support
Low
Business Logic
Minor Abuse Case
Low-Impact Feature Misuse
Low
Cryptography
Weak Hashing Usage
Low-Risk Legacy Implementation
Low
Email Security
Missing DMARC Policy
Email Protection Improvement
Low
Infrastructure Security
Open Port Exposure
Non-Sensitive Surface Enumeration
Low
Availability & Abuse
Insufficient Anti-Automation
Low-Impact Bot Activity
Informational
Best Practice
Cookie Configuration
Missing SameSite Attribute
Informational
Best Practice
Cookie Configuration
Missing Secure Flag in Non-Sensitive Context
Informational
Best Practice
Transport Security
HTTP to HTTPS Improvement
Informational
Best Practice
Header Hygiene
Non-Critical Missing Browser Header
Informational
Best Practice
DNS / Email Security
SPF Improvement Recommended
Informational
Best Practice
DNS / Email Security
DKIM Improvement Recommended
Informational
Best Practice
DNS / Email Security
DMARC Improvement Recommended
Informational
Best Practice
Server Configuration
Banner Disclosure
Informational
Best Practice
General Observation
Security Hardening Recommendation
Informational
Best Practice
General Observation
Non-Exploitable Misconfiguration Note
Informational
Reconnaissance Exposure
robots.txt Entry
Path Discovery Without Direct Impact
Informational
Reconnaissance Exposure
Public JavaScript Reference
Endpoint Enumeration Only
Informational
Reconnaissance Exposure
Sitemap Discovery
Public Route Enumeration
Informational
Documentation Exposure
API Documentation Listing
Public Reference Without Sensitive Data
Informational
Platform Hygiene
Deprecated Asset Presence
No Proven Security Impact
Informational
Platform Hygiene
Legacy Endpoint Reference
Historical Surface Indicator
tracking pixel