OWASP API Security Top 10 (2023) with vulnerable code, working fixes and tests in Node.js: BOLA, auth, rate limits, SSRF and ...
A critical WordPress exploit chain dubbed WP2Shell lets unauthenticated attackers run arbitrary code on vulnerable websites by combining REST API route confusion with SQL injection.