Looking into the mentioned unforgivable vulnerabilities and stubborn weaknesses published by CISA:

Unforgivable Vulnerabilities (PDF)

Given the above criteria, following are some candidates for unforgivable vulnerabilities that satisfy all (or most) of the criteria for an unforgivable vulnerability. […]

1. Buffer overflow using long strings of "A" characters in:
   • a. Username/password during authentication
   • b. File or directory name
   • c. Arguments to most common features of the product or product class
2. XSS using well-formed <script> tags, especially in the:
   • a. Username/password of an authentication routine
   • b. Body, subject, title, or to/from of a message
3. SQL injection using ' in the:
   • a. Username/password of an authentication routine
   • b. "id" or other identifier field
   • c. Numeric field
4. Remote file inclusion from direct input such as:
   • a. include($_GET['dir'] . "/config.inc");
5. Directory traversal using "../.." or "/a/b/c" in GET or SEND commands of frequently-used file sharing functionality (e.g., a GET in a web/FTP server, or a send-file command in a chat client)
6. World-writable critical files:
   • a. Executables
   • b. Libraries
   • c. Configuration files
7. Direct requests of administrator scripts
8. Grow-your-own crypto
9. Authentication bypass using "authenticated=1" cookie/form field
10. TOCTOU race condition – symlink
11. Privilege escalation launching "help" (Windows)
12. Hard-coded or undocumented account/password
13. Unchecked length/width/height/size values passed to malloc()/calloc()

Stubborn Weaknesses

| CWE-ID | Description | 2023 Rank | |

|

|

| | CWE-787 | Out-of-bounds Write | 1 | | CWE-79 | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | 2 | | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | 3 | | CWE-416 | Use After Free | 4 | | CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 5 | | CWE-20 | Improper Input Validation | 6 | | CWE-125 | Out-of-bounds Read | 7 | | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | 8 | | CWE-352 | Cross-Site Request Forgery (CSRF) | 9 | | CWE-476 | NULL Pointer Dereference | 12 | | CWE-287 | Improper Authentication | 13 | | CWE-190 | Integer Overflow or Wraparound | 14 | | CWE-502 | Deserialization of Untrusted Data | 15 | | CWE-119 | Improper Restriction of Operations within Bounds of a Memory Buffer | 17 | | CWE-798 | Use of Hard-coded Credentials | 18 |