Cybersecurity glossary

Unique identifier in the form CVE-YYYY-NNNN, assigned by MITRE to a publicly disclosed vulnerability. Industry standard for referencing specific security flaws.

Industry standard to score vulnerability severity on a 0–10 scale. Combines attack vector, complexity, privileges required, user interaction, and impact on C, I, A.

Vulnerability that lets a remote attacker run arbitrary code on the vulnerable system. The highest-severity category — and the most-hunted in bug bounty.

Vulnerability that lets a user with local access (shell, regular user) elevate privileges — typically to root/SYSTEM. Critical in multi-tenant and post-compromise scenarios.

Publicly unknown vulnerability with no patch available. The name comes from the vendor having 'zero days' to react before the first attack.

Technique that manipulates an LLM's input (ChatGPT, Claude, Gemini) to override its original instructions and make it act outside its intended behaviour.

Vulnerability where attacker-controlled JavaScript executes in a victim's browser under a trusted domain's context. Session theft, account takeover, and targeted phishing.

Injection of malicious SQL into a backend query via unsafe concatenation of user input. Allows reading/modifying the database, and sometimes RCE via xp_cmdshell or load_file.

Vulnerability where an attacker tricks the server into issuing HTTP requests to attacker-chosen targets. Allows reaching cloud metadata, internal networks, and localhost services.

Access control vulnerability: the server exposes guessable or predictable IDs and doesn't validate that the requester is authorised to access that resource.

Malware that encrypts a victim's files and demands ransom (typically in crypto) for the decryption key. Organised criminal business model.

Social engineering technique where the attacker impersonates a trusted identity (bank, support, colleague) to steal credentials, OTPs, money, or trigger malware execution.

Threat actor with significant resources, long-term objectives, and sophisticated techniques. Often state-sponsored or backed by high-tier organised crime.

Attack that compromises a software supply-chain component (dependency, build pipeline, vendor) to infect all of its consumers with a single intrusion.